CVE-2024-47674

CVE Details

Release Date:

2024-10-15

Description

In the Linux kernel, the following vulnerability has been resolved:\nmm: avoid leaving partial pfn mappings around in error case\nAs Jann points out, PFN mappings are special, because unlike normal\nmemory mappings, there is no lifetime information associated with the\nmapping - it is just a raw mapping of PFNs with no reference counting of\na 'struct page'.\nThat's all very much intentional, but it does mean that it's easy to\nmess up the cleanup in case of errors. Yes, a failed mmap() will always\neventually clean up any partial mappings, but without any explicit\nlifetime in the page table mapping itself, it's very easy to do the\nerror handling in the wrong order.\nIn particular, it's easy to mistakenly free the physical backing store\nbefore the page tables are actually cleaned up and (temporarily) have\nstale dangling PTE entries.\nTo make this situation less error-prone, just make sure that any partial\npfn mapping is torn down early, before any other error handling.

See more information about CVE-2024-47674 from MITRE CVE dictionary and NIST NVD

NOTE: The following CVSS metrics and score provided are preliminary and subject to review.

CVSS v3 metrics

Base Score:	5.5
Vector String:	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Version:	3.1
Attack Vector:	Local
Attack Complexity:	Low
Privileges Required:	Low
User Interaction:	None
Scope:	Unchanged
Confidentiality:	None
Integrity:	None
Availability:	High

Errata information

Platform	Errata	Release Date
Oracle Linux version 7 (kernel-uek)	ELSA-2024-12845	2024-11-25
Oracle Linux version 7 (kernel-uek)	ELSA-2024-12884	2024-12-16
Oracle Linux version 8 (kernel-uek)	ELSA-2024-12796	2024-10-20
Oracle Linux version 8 (kernel-uek)	ELSA-2024-12815	2024-11-11
Oracle Linux version 8 (kernel-uek)	ELSA-2024-12830	2024-11-20
Oracle Linux version 8 (kernel-uek)	ELSA-2024-12845	2024-11-25
Oracle Linux version 8 (kernel-uek)	ELSA-2024-12884	2024-12-16
Oracle Linux version 9 (kernel-uek)	ELSA-2024-12796	2024-10-20
Oracle Linux version 9 (kernel-uek)	ELSA-2024-12815	2024-11-11
Oracle Linux version 9 (kernel-uek)	ELSA-2024-12830	2024-11-20