NetSight
IP …
medium5.5

CVE-2024-36000

In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix missing hugetlb_lock for resv uncharge There is a recent report on UFFDIO_C…

Impact

In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix missing hugetlb_lock for resv uncharge There is a recent report on UFFDIO_COPY over hugetlb: https://lore.kernel.org/all/000000000000ee06de0616177560@google.com/ 350: lockdep_assert_held(&hugetlb_lock); Should be an issue in hugetlb but triggered in an userfault context, where it goes into the unlikely path where two threads modifying the resv map together. Mike has a fix in that path for resv uncharge but it looks like the locking criteria was overlooked: hugetlb_cgroup_uncharge_folio_rsvd() will update the cgroup pointer, so it requires to be called with the lock held.

Affected products

VendorProductAffected versions
LinuxLinux Kernel
from 5.9.7 before 5.10
from 5.10.1 before 6.1.91
from 6.2 before 6.6.30
from 6.7 before 6.8.9
Versions 5.10, 6.9

Weakness classification

CWE-617

References