In the Linux kernel, the following vulnerability has been resolved:
userfaultfd: release page in error path to avoid BUG_ON
Consider the following sequence of events:
1. Userspace issues a UFFD ioctl, which ends up calling into
shmem_mfill_atomic_pte(). We successfully account the blocks, we
shmem_alloc_page(), but then the copy_from_user() fails. We return
-ENOENT. We don't release the page we allocated.
2. Our caller detects this error code, tries the copy_from_user() after
dropping the mmap_lock, and retries, calling back into
shmem_mfill_atomic_pte().
3. Meanwhile, let's say another process filled up the tmpfs being used.
4. So shmem_mfill_atomic_pte() fails to account blocks this time, and
immediately returns - without releasing the page.
This triggers a BUG_ON in our caller, which asserts that the page
should always be consumed, unless -ENOENT is returned.
To fix this, detect if we have such a "dangling" page when accounting
fails, and if so, release it before returning.
Metrics
Affected Vendors & Products
References
History
Thu, 26 Dec 2024 15:30:00 +0000
Type | Values Removed | Values Added |
---|---|---|
CPEs | cpe:2.3:o:linux:linux_kernel:5.12:rc2:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:5.12:rc3:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:5.12:rc4:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:5.12:rc5:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:5.12:rc6:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:5.12:rc7:*:*:*:*:*:* |
cpe:2.3:o:linux:linux_kernel:5.13:rc1:*:*:*:*:*:* |
Tue, 24 Dec 2024 14:45:00 +0000
Type | Values Removed | Values Added |
---|---|---|
First Time appeared |
Linux
Linux linux Kernel |
|
CPEs | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:5.12:rc1:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:5.12:rc2:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:5.12:rc3:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:5.12:rc4:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:5.12:rc5:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:5.12:rc6:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:5.12:rc7:*:*:*:*:*:* |
|
Vendors & Products |
Linux
Linux linux Kernel |
Mon, 04 Nov 2024 13:15:00 +0000
Type | Values Removed | Values Added |
---|---|---|
Metrics |
ssvc
|

Status: PUBLISHED
Assigner: Linux
Published: 2024-02-28T08:13:15.310Z
Updated: 2025-05-04T07:01:49.099Z
Reserved: 2024-02-27T18:42:55.948Z
Link: CVE-2021-46988

Updated: 2024-08-04T05:24:38.475Z

Status : Analyzed
Published: 2024-02-28T09:15:37.640
Modified: 2024-12-26T15:01:37.110
Link: CVE-2021-46988
