CVE-2024-36000
Description
In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix missing hugetlb_lock for resv uncharge There is a recent report on UFFDIO_COPY over hugetlb: https://lore.kernel.org/all/[email protected]/ 350: lockdep_assert_held(&hugetlb_lock); Should be an issue in hugetlb but triggered in an userfault context, where it goes into the unlikely path where two threads modifying the resv map together. Mike has a fix in that path for resv uncharge but it looks like the locking criteria was overlooked: hugetlb_cgroup_uncharge_folio_rsvd() will update the cgroup pointer, so it requires to be called with the lock held.
How to fix
- linux linux_kernel5.10, 6.1.91, 6.6.30, 6.8.9 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| linux linux_kernel | 5.9.7 ≤ v < 5.10, 5.10.1 ≤ v < 6.1.91, 6.2 ≤ v < 6.6.30, 6.7 ≤ v < 6.8.9, 5.10, 6.9 | 5.10, 6.1.91, 6.6.30, 6.8.9 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.