CVE-2024-36881

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

mm/userfaultfd: reset ptes when close() for wr-protected ones

Userfaultfd unregister includes a step to remove wr-protect bits from all

the relevant pgtable entries, but that only covered an explicit

UFFDIO_UNREGISTER ioctl, not a close() on the userfaultfd itself. Cover

that too. This fixes a WARN trace.

The only user visible side effect is the user can observe leftover

wr-protect bits even if the user close()ed on an userfaultfd when

releasing the last reference of it. However hopefully that should be

harmless, and nothing bad should happen even if so.

This change is now more important after the recent page-table-check

patch we merged in mm-unstable (446dd9ad37d0 ("mm/page_table_check:

support userfault wr-protect entries")), as we'll do sanity check on

uffd-wp bits without vma context. So it's better if we can 100%

guarantee no uffd-wp bit leftovers, to make sure each report will be

valid.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References