CVE-2024-35872

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-35872
In the Linux kernel, the following vulnerability has been resolved: mm/secretmem: fix GUP-fast succeeding on secretmem folios folio_is_secretmem() currently relies on secretmem folios being LRU folios, to save some cycles. However, folios might reside in a folio batch without the LRU flag set, or temporarily have their LRU flag cleared. Consequently, the LRU flag is unreliable for this purpose. In particular, this is the case when secretmem_fault() allocates a fresh page and calls filemap_add_folio()->folio_add_lru(). The folio might be added to the per-cpu folio batch and won't get the LRU flag set until the batch was drained using e.g., lru_add_drain(). Consequently, folio_is_secretmem() might not detect secretmem folios and GUP-fast can succeed in grabbing a secretmem folio, crashing the kernel when we would later try reading/writing to the folio, because the folio has been unmapped from the directmap. Fix it by removing that unreliable check.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/201e4aaf405dfd1308da54448654053004c579b5 Patch
https://git.kernel.org/stable/c/43fad1d0284de30159661d0badfc3cbaf7e6f8f8 Patch
https://git.kernel.org/stable/c/65291dcfcf8936e1b23cfd7718fdfde7cfaf7706 Patch
https://git.kernel.org/stable/c/6564b014af92b677c1f07c44d7f5b595d589cf6e Patch
https://git.kernel.org/stable/c/9c2b4b657739ecda38e3b383354a29566955ac48 Patch
https://git.kernel.org/stable/c/201e4aaf405dfd1308da54448654053004c579b5 Patch
https://git.kernel.org/stable/c/43fad1d0284de30159661d0badfc3cbaf7e6f8f8 Patch
https://git.kernel.org/stable/c/65291dcfcf8936e1b23cfd7718fdfde7cfaf7706 Patch
https://git.kernel.org/stable/c/6564b014af92b677c1f07c44d7f5b595d589cf6e Patch
https://git.kernel.org/stable/c/9c2b4b657739ecda38e3b383354a29566955ac48 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*
History

24 Sep 2025, 21:16

Type Values Removed Values Added
CPE cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
CWE NVD-CWE-noinfo
First Time Linux linux Kernel
Linux
References () https://git.kernel.org/stable/c/201e4aaf405dfd1308da54448654053004c579b5 - () https://git.kernel.org/stable/c/201e4aaf405dfd1308da54448654053004c579b5 - Patch
References () https://git.kernel.org/stable/c/43fad1d0284de30159661d0badfc3cbaf7e6f8f8 - () https://git.kernel.org/stable/c/43fad1d0284de30159661d0badfc3cbaf7e6f8f8 - Patch
References () https://git.kernel.org/stable/c/65291dcfcf8936e1b23cfd7718fdfde7cfaf7706 - () https://git.kernel.org/stable/c/65291dcfcf8936e1b23cfd7718fdfde7cfaf7706 - Patch
References () https://git.kernel.org/stable/c/6564b014af92b677c1f07c44d7f5b595d589cf6e - () https://git.kernel.org/stable/c/6564b014af92b677c1f07c44d7f5b595d589cf6e - Patch
References () https://git.kernel.org/stable/c/9c2b4b657739ecda38e3b383354a29566955ac48 - () https://git.kernel.org/stable/c/9c2b4b657739ecda38e3b383354a29566955ac48 - Patch
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5

21 Nov 2024, 09:21

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/201e4aaf405dfd1308da54448654053004c579b5 - () https://git.kernel.org/stable/c/201e4aaf405dfd1308da54448654053004c579b5 -
References () https://git.kernel.org/stable/c/43fad1d0284de30159661d0badfc3cbaf7e6f8f8 - () https://git.kernel.org/stable/c/43fad1d0284de30159661d0badfc3cbaf7e6f8f8 -
References () https://git.kernel.org/stable/c/65291dcfcf8936e1b23cfd7718fdfde7cfaf7706 - () https://git.kernel.org/stable/c/65291dcfcf8936e1b23cfd7718fdfde7cfaf7706 -
References () https://git.kernel.org/stable/c/6564b014af92b677c1f07c44d7f5b595d589cf6e - () https://git.kernel.org/stable/c/6564b014af92b677c1f07c44d7f5b595d589cf6e -
References () https://git.kernel.org/stable/c/9c2b4b657739ecda38e3b383354a29566955ac48 - () https://git.kernel.org/stable/c/9c2b4b657739ecda38e3b383354a29566955ac48 -
Summary
  • (es) En el kernel de Linux, se resolvió la siguiente vulnerabilidad: mm/secretmem: corrige el éxito rápido de GUP en folios secretmem folio_is_secretmem() actualmente depende de que los folios secretmem sean folios LRU, para guardar algunos ciclos. Sin embargo, las publicaciones pueden residir en un lote de publicaciones sin el indicador LRU establecido o tener su indicador LRU borrado temporalmente. En consecuencia, la bandera LRU no es fiable para este fin. En particular, este es el caso cuando secretmem_fault() asigna una página nueva y llama a filemap_add_folio()->folio_add_lru(). La publicación podría agregarse al lote de publicaciones por CPU y no se establecerá el indicador LRU hasta que el lote se drene usando, por ejemplo, lru_add_drain(). En consecuencia, es posible que folio_is_secretmem() no detecte folios secretmem y GUP-fast puede lograr capturar un folio secretmem, bloqueando el kernel cuando más tarde intentemos leer/escribir en el folio, porque el folio no se ha desasignado del mapa directo. Solucionarlo eliminando ese cheque poco confiable.

19 May 2024, 09:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-05-19 09:15

Updated : 2025-09-24 21:16

NVD link : CVE-2024-35872

Mitre link : CVE-2024-35872

CVE.ORG link : CVE-2024-35872

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
NVD-CWE-noinfo