CVE-2024-47676

In the Linux kernel, the following vulnerability has been resolved:

mm/hugetlb.c: fix UAF of vma in hugetlb fault pathway

Syzbot reports a UAF in hugetlb_fault(). This happens because vmf_anon_prepare() could drop the per-VMA lock and allow the current VMA to be freed before hugetlb_vma_unlock_read() is called.

We can fix this by using a modified version of vmf_anon_prepare() that doesnt release the VMA lock on failure, and then release it ourselves after hugetlb_vma_unlock_read().

Weakness

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory “belongs” to the code that operates on the new pointer.

Affected Software

Potential Mitigations

References

• https://git.kernel.org/stable/c/98b74bb4d7e96b4da5ef3126511febe55b76b807
• https://git.kernel.org/stable/c/d59ebc99dee0a2687a26df94b901eb8216dbf876
• https://git.kernel.org/stable/c/e897d184a8dd4a4e1f39c8c495598e4d9472776c