UBUNTU-CVE-2024-50182
In the Linux kernel, the following vulnerability has been resolved: secretmem: disable memfd_secret() if arch cannot set direct map Return -ENOSYS from memfd_secret() syscall if !can_set_direct_map(). This is the case for example on some arm64 configurations, where marking 4k PTEs in the direct map not present can only be done if the direct map is set up at 4k granularity in the first place (as ARM's break-before-make semantics do not easily allow breaking apart large/gigantic pages). More precisely, on arm64 systems with !can_set_direct_map(), set_direct_map_invalid_noflush() is a no-op, however it returns success (0) instead of an error. This means that memfd_secret will seemingly "work" (e.g. syscall succeeds, you can mmap the fd and fault in pages), but it does not actually achieve its goal of removing its memory from the direct map. Note that with this patch, memfd_secret() will start erroring on systems where can_set_direct_map() returns false (arm64 with CONFIG_RODATA_FULL_DEFAULT_ENABLED=n, CONFIG_DEBUG_PAGEALLOC=n and CONFIG_KFENCE=n), but that still seems better than the current silent failure. Since CONFIG_RODATA_FULL_DEFAULT_ENABLED defaults to 'y', most arm64 systems actually have a working memfd_secret() and aren't be affected. From going through the iterations of the original memfd_secret patch series, it seems that disabling the syscall in these scenarios was the intended behavior [1] (preferred over having set_direct_map_invalid_noflush return an error as that would result in SIGBUSes at page-fault time), however the check for it got dropped between v16 [2] and v17 [3], when secretmem moved away from CMA allocations. [1]: https://lore.kernel.org/lkml/[email protected]/ [2]: https://lore.kernel.org/lkml/[email protected]/#t [3]: https://lore.kernel.org/lkml/[email protected]/
02 / AFFECTED SOFTWARE
Affected packages
11 explicit affected versions
10 explicit affected versions
8 explicit affected versions
24 explicit affected versions
5 explicit affected versions
8 explicit affected versions
10 explicit affected versions
12 explicit affected versions
15 explicit affected versions
9 explicit affected versions
4 explicit affected versions
1 explicit affected versions
1 explicit affected versions
1 explicit affected versions
12 explicit affected versions
15 explicit affected versions
12 explicit affected versions
10 explicit affected versions
41 explicit affected versions
57 explicit affected versions
50 explicit affected versions
6 explicit affected versions
4 explicit affected versions
12 explicit affected versions
19 explicit affected versions
6 explicit affected versions
67 explicit affected versions
19 explicit affected versions
52 explicit affected versions
60 explicit affected versions
53 explicit affected versions
10 explicit affected versions
58 explicit affected versions
14 explicit affected versions
11 explicit affected versions
17 explicit affected versions
59 explicit affected versions
7 explicit affected versions
7 explicit affected versions
13 explicit affected versions
16 explicit affected versions
35 explicit affected versions
19 explicit affected versions
19 explicit affected versions
18 explicit affected versions
18 explicit affected versions
41 explicit affected versions
19 explicit affected versions
13 explicit affected versions
23 explicit affected versions
24 explicit affected versions
1 explicit affected versions
21 explicit affected versions
16 explicit affected versions
10 explicit affected versions
20 explicit affected versions
34 explicit affected versions
1 explicit affected versions
50 explicit affected versions
12 explicit affected versions
14 explicit affected versions
7 explicit affected versions
1 explicit affected versions
12 explicit affected versions
12 explicit affected versions
14 explicit affected versions
11 explicit affected versions
6 explicit affected versions
37 explicit affected versions
1 explicit affected versions
13 explicit affected versions
52 explicit affected versions
26 explicit affected versions
13 explicit affected versions
12 explicit affected versions
29 explicit affected versions
13 explicit affected versions
64 explicit affected versions
13 explicit affected versions
14 explicit affected versions
59 explicit affected versions
22 explicit affected versions
50 explicit affected versions
33 explicit affected versions
23 explicit affected versions
10 explicit affected versions
1 explicit affected versions
11 explicit affected versions
12 explicit affected versions
7 explicit affected versions
12 explicit affected versions
44 explicit affected versions
60 explicit affected versions
10 explicit affected versions
26 explicit affected versions
18 explicit affected versions
1 explicit affected versions
10 explicit affected versions
23 explicit affected versions
13 explicit affected versions
19 explicit affected versions
16 explicit affected versions
63 explicit affected versions
22 explicit affected versions
51 explicit affected versions
3 explicit affected versions
1 explicit affected versions
2 explicit affected versions
51 explicit affected versions
7 explicit affected versions
20 explicit affected versions
12 explicit affected versions
47 explicit affected versions
27 explicit affected versions
34 explicit affected versions
15 explicit affected versions
18 explicit affected versions
13 explicit affected versions
13 explicit affected versions
7 explicit affected versions
2 explicit affected versions
45 explicit affected versions
44 explicit affected versions
16 explicit affected versions
3 explicit affected versions
13 explicit affected versions
26 explicit affected versions
7 explicit affected versions
37 explicit affected versions
23 explicit affected versions
14 explicit affected versions
38 explicit affected versions
52 explicit affected versions
33 explicit affected versions
51 explicit affected versions
11 explicit affected versions
13 explicit affected versions
7 explicit affected versions
60 explicit affected versions
58 explicit affected versions
13 explicit affected versions
43 explicit affected versions
10 explicit affected versions
8 explicit affected versions
17 explicit affected versions
14 explicit affected versions
4 explicit affected versions
11 explicit affected versions
1 explicit affected versions
14 explicit affected versions
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
In the Linux kernel, the following vulnerability has been resolved: secretmem: disable memfd_secret() if arch cannot set direct map Return -ENOSYS from memfd_secret() syscall if !can_set_direct_map(). This is the case for example on some arm64 configurations, where marking 4k PTEs in the direct map not present can only be done if the direct map is set up at 4k granularity in the first place (as ARM's break-before-make semantics do not easily allow breaking apart large/gigantic pages). More precisely, on arm64 systems with !can_set_direct_map(), set_direct_map_invalid_noflush() is a no-op, however it returns success (0) instead of an error. This means that memfd_secret will seemingly "work" (e.g. syscall succeeds, you can mmap the fd and fault in pages), but it does not actually achieve its goal of removing its memory from the direct map. Note that with this patch, memfd_secret() will start erroring on systems where can_set_direct_map() returns false (arm64 with CONFIG_RODATA_FULL_DEFAULT_ENABLED=n, CONFIG_DEBUG_PAGEALLOC=n and CONFIG_KFENCE=n), but that still seems better than the current silent failure. Since CONFIG_RODATA_FULL_DEFAULT_ENABLED defaults to 'y', most arm64 systems actually have a working memfd_secret() and aren't be affected. From going through the iterations of the original memfd_secret patch series, it seems that disabling the syscall in these scenarios was the intended behavior [1] (preferred over having set_direct_map_invalid_noflush return an error as that would result in SIGBUSes at page-fault time), however the check for it got dropped between v16 [2] and v17 [3], when secretmem moved away from CMA allocations. [1]: https://lore.kernel.org/lkml/[email protected]/ [2]: https://lore.kernel.org/lkml/[email protected]/#t [3]: https://lore.kernel.org/lkml/[email protected]/
05 / REFERENCES
Further evidence
- https://git.kernel.org/linus/532b53cebe58f34ce1c0f34d866f5c0e335c53c6
- https://git.kernel.org/stable/c/532b53cebe58f34ce1c0f34d866f5c0e335c53c6
- https://git.kernel.org/stable/c/5ea0b7af38754d2b45ead9257bca47e84662e926
- https://git.kernel.org/stable/c/757786abe4547eb3d9d0e8350a63bdb0f9824af2
- https://git.kernel.org/stable/c/7caf966390e6e4ebf42775df54e7ee1f280ce677
- https://git.kernel.org/stable/c/d0ae6ffa1aeb297aef89f49cfb894a83c329ebad
- https://ubuntu.com/security/CVE-2024-50182
- https://ubuntu.com/security/notices/USN-7276-1
- https://ubuntu.com/security/notices/USN-7277-1
- https://ubuntu.com/security/notices/USN-7288-1
- https://ubuntu.com/security/notices/USN-7288-2
- https://ubuntu.com/security/notices/USN-7289-1
- https://ubuntu.com/security/notices/USN-7289-2
- https://ubuntu.com/security/notices/USN-7289-3
- https://ubuntu.com/security/notices/USN-7289-4
- https://ubuntu.com/security/notices/USN-7291-1
- https://ubuntu.com/security/notices/USN-7305-1
- https://ubuntu.com/security/notices/USN-7308-1
- https://ubuntu.com/security/notices/USN-7310-1
- https://ubuntu.com/security/notices/USN-7331-1
- https://ubuntu.com/security/notices/USN-7383-1
- https://ubuntu.com/security/notices/USN-7383-2
- https://ubuntu.com/security/notices/USN-7384-1
- https://ubuntu.com/security/notices/USN-7384-2
- https://ubuntu.com/security/notices/USN-7385-1
- https://ubuntu.com/security/notices/USN-7386-1
- https://ubuntu.com/security/notices/USN-7388-1
- https://ubuntu.com/security/notices/USN-7389-1
- https://ubuntu.com/security/notices/USN-7390-1
- https://ubuntu.com/security/notices/USN-7403-1
- https://ubuntu.com/security/notices/USN-7451-1
- https://ubuntu.com/security/notices/USN-7458-1
- https://ubuntu.com/security/notices/USN-7468-1
- https://ubuntu.com/security/notices/USN-7523-1
- https://ubuntu.com/security/notices/USN-7524-1
- https://www.cve.org/CVERecord?id=CVE-2024-50182