CVE-2024-50250 fsdax: dax_unshare_iter needs to copy entire blocks
A flaw in Linux kernel fsdax allows attackers to read stale memory or corrupt user data due to incorrect block copying during unshare operations.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-50250?
CVE-2024-50250 is a high-severity vulnerability in Linux kernel, published on 9 Nov 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
fsdax: dax_unshare_iter needs to copy entire blocks
The code that copies data from srcmap to iomap in dax_unshare_iter is very very broken, which bfoster's recent fsx changes have exposed.
If the pos and len passed to dax_file_unshare are not aligned to an fsblock boundary, the iter pos and length in the _iter function will reflect this unalignment.
dax_iomap_direct_access always returns a pointer to the start of the kmapped fsdax page, even if its pos argument is in the middle of that page. This is catastrophic for data integrity when iter->pos is not aligned to a page, because daddr/saddr do not point to the same byte in the file as iter->pos. Hence we corrupt user data by copying it to the wrong place.
If iter->pos + iomap_length() in the _iter function not aligned to a page, then we fail to copy a full block, and only partially populate the destination block. This is catastrophic for data confidentiality because we expose stale pmem contents.
Fix both of these issues by aligning copy_pos/copy_len to a page boundary (remember, this is fsdax so 1 fsblock == 1 base page) so that we always copy full blocks.
We're not done yet -- there's no call to invalidate_inode_pages2_range, so programs that have the file range mmap'd will continue accessing the old memory mapping after the file metadata updates have completed.
Be careful with the return value -- if the unshare succeeds, we still need to return the number of bytes that the iomap iter thinks we're operating on.
Which versions are affected by CVE-2024-50250?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-50250?
Apply the vendor's patch.
Is CVE-2024-50250 being exploited?
There is no known exploitation of CVE-2024-50250 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-53373, BELL-CVE-2024-50250, DEBIAN-CVE-2024-50250, GHSA-prf6-fvr5-qhc9, UBUNTU-CVE-2024-50250.