CVE-2024-45025

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

fix bitmap corruption on close_range() with CLOSE_RANGE_UNSHARE

copy_fd_bitmaps(new, old, count) is expected to copy the first

count/BITS_PER_LONG bits from old->full_fds_bits[] and fill

the rest with zeroes. What it does is copying enough words

(BITS_TO_LONGS(count/BITS_PER_LONG)), then memsets the rest.

That works fine, *if* all bits past the cutoff point are

clear. Otherwise we are risking garbage from the last word

we'd copied.

For most of the callers that is true - expand_fdtable() has

count equal to old->max_fds, so there's no open descriptors

past count, let alone fully occupied words in ->open_fds[],

which is what bits in ->full_fds_bits[] correspond to.

The other caller (dup_fd()) passes sane_fdtable_size(old_fdt, max_fds),

which is the smallest multiple of BITS_PER_LONG that covers all

opened descriptors below max_fds. In the common case (copying on

fork()) max_fds is ~0U, so all opened descriptors wil

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References