CVE-2024-36000

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-36000
In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix missing hugetlb_lock for resv uncharge There is a recent report on UFFDIO_COPY over hugetlb: https://lore.kernel.org/all/000000000000ee06de0616177560@google.com/ 350: lockdep_assert_held(&hugetlb_lock); Should be an issue in hugetlb but triggered in an userfault context, where it goes into the unlikely path where two threads modifying the resv map together. Mike has a fix in that path for resv uncharge but it looks like the locking criteria was overlooked: hugetlb_cgroup_uncharge_folio_rsvd() will update the cgroup pointer, so it requires to be called with the lock held.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/4c806333efea1000a2a9620926f560ad2e1ca7cc Patch
https://git.kernel.org/stable/c/538faabf31e9c53d8c870d114846fda958a0de10 Patch
https://git.kernel.org/stable/c/b76b46902c2d0395488c8412e1116c2486cdfcb2 Patch
https://git.kernel.org/stable/c/f6c5d21db16a0910152ec8aa9d5a7aed72694505 Patch
https://git.kernel.org/stable/c/4c806333efea1000a2a9620926f560ad2e1ca7cc Patch
https://git.kernel.org/stable/c/538faabf31e9c53d8c870d114846fda958a0de10 Patch
https://git.kernel.org/stable/c/b76b46902c2d0395488c8412e1116c2486cdfcb2 Patch
https://git.kernel.org/stable/c/f6c5d21db16a0910152ec8aa9d5a7aed72694505 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.10:-:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.10:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.10:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.10:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.10:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.10:rc7:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc5:*:*:*:*:*:*
History

23 Sep 2025, 18:23

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/4c806333efea1000a2a9620926f560ad2e1ca7cc - () https://git.kernel.org/stable/c/4c806333efea1000a2a9620926f560ad2e1ca7cc - Patch
References () https://git.kernel.org/stable/c/538faabf31e9c53d8c870d114846fda958a0de10 - () https://git.kernel.org/stable/c/538faabf31e9c53d8c870d114846fda958a0de10 - Patch
References () https://git.kernel.org/stable/c/b76b46902c2d0395488c8412e1116c2486cdfcb2 - () https://git.kernel.org/stable/c/b76b46902c2d0395488c8412e1116c2486cdfcb2 - Patch
References () https://git.kernel.org/stable/c/f6c5d21db16a0910152ec8aa9d5a7aed72694505 - () https://git.kernel.org/stable/c/f6c5d21db16a0910152ec8aa9d5a7aed72694505 - Patch
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
First Time Linux linux Kernel
Linux
CWE CWE-617
CPE cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.10:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.10:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.10:rc7:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.10:-:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.10:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.10:rc6:*:*:*:*:*:*

21 Nov 2024, 09:21

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/4c806333efea1000a2a9620926f560ad2e1ca7cc - () https://git.kernel.org/stable/c/4c806333efea1000a2a9620926f560ad2e1ca7cc -
References () https://git.kernel.org/stable/c/538faabf31e9c53d8c870d114846fda958a0de10 - () https://git.kernel.org/stable/c/538faabf31e9c53d8c870d114846fda958a0de10 -
References () https://git.kernel.org/stable/c/b76b46902c2d0395488c8412e1116c2486cdfcb2 - () https://git.kernel.org/stable/c/b76b46902c2d0395488c8412e1116c2486cdfcb2 -
References () https://git.kernel.org/stable/c/f6c5d21db16a0910152ec8aa9d5a7aed72694505 - () https://git.kernel.org/stable/c/f6c5d21db16a0910152ec8aa9d5a7aed72694505 -
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: mm/hugetlb: corrige la falta de Hugetlb_lock para descarga de resv. Hay un informe reciente sobre UFFDIO_COPY sobre Hugetlb: https://lore.kernel.org/all/000000000000ee06de0616177560@google.com/ 350: lockdep_assert_held(&hugetlb_lock); Debería ser un problema en hugetlb pero se activa en un contexto de error de usuario, donde entra en la ruta poco probable en la que dos subprocesos modifican el mapa resv juntos. Mike tiene una solución en esa ruta para la descarga de resv, pero parece que se pasó por alto el criterio de bloqueo: hugetlb_cgroup_uncharge_folio_rsvd() actualizará el puntero de cgroup, por lo que es necesario llamarlo con el bloqueo retenido.

20 May 2024, 10:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-05-20 10:15

Updated : 2025-09-23 18:23

NVD link : CVE-2024-36000

Mitre link : CVE-2024-36000

CVE.ORG link : CVE-2024-36000

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-617

Reachable Assertion