Bug 1225844 (CVE-2024-36943) - VUL-0: CVE-2024-36943: kernel: fs/proc/task_mmu: fix loss of young/dirty bits during pagemap scan
Summary: VUL-0: CVE-2024-36943: kernel: fs/proc/task_mmu: fix loss of young/dirty bits...
Status: RESOLVED INVALID
Alias: CVE-2024-36943
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Assignee: Security Team bot
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/408166/
Whiteboard: CVSSv3.1:SUSE:CVE-2024-36943:5.3:(AV:...
Keywords:
Depends on:
Blocks:
 
Reported: 2024-06-03 13:55 UTC by SMASH SMASH
Modified: 2024-06-06 12:36 UTC (History)
3 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description SMASH SMASH 2024-06-03 13:55:47 UTC
In the Linux kernel, the following vulnerability has been resolved:

fs/proc/task_mmu: fix loss of young/dirty bits during pagemap scan

make_uffd_wp_pte() was previously doing:

  pte = ptep_get(ptep);
  ptep_modify_prot_start(ptep);
  pte = pte_mkuffd_wp(pte);
  ptep_modify_prot_commit(ptep, pte);

But if another thread accessed or dirtied the pte between the first 2
calls, this could lead to loss of that information.  Since
ptep_modify_prot_start() gets and clears atomically, the following is the
correct pattern and prevents any possible race.  Any access after the
first call would see an invalid pte and cause a fault:

  pte = ptep_modify_prot_start(ptep);
  pte = pte_mkuffd_wp(pte);
  ptep_modify_prot_commit(ptep, pte);

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-36943
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2024/CVE-2024-36943.mbox
https://git.kernel.org/stable/c/74b3d66f91d9f539f99faad74d796fa9a389a015
https://git.kernel.org/stable/c/c70dce4982ce1718bf978a35f8e26160b82081f4
https://www.cve.org/CVERecord?id=CVE-2024-36943
https://bugzilla.redhat.com/show_bug.cgi?id=2284470
Comment 1 Miroslav Franc 2024-06-06 09:50:32 UTC
This, including the fix, pertains only to stable.  Switching back to the security team.