CVE-2024-50182

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

secretmem: disable memfd_secret() if arch cannot set direct map

Return -ENOSYS from memfd_secret() syscall if !can_set_direct_map(). This

is the case for example on some arm64 configurations, where marking 4k

PTEs in the direct map not present can only be done if the direct map is

set up at 4k granularity in the first place (as ARM's break-before-make

semantics do not easily allow breaking apart large/gigantic pages).

More precisely, on arm64 systems with !can_set_direct_map(),

set_direct_map_invalid_noflush() is a no-op, however it returns success

(0) instead of an error. This means that memfd_secret will seemingly

"work" (e.g. syscall succeeds, you can mmap the fd and fault in pages),

but it does not actually achieve its goal of removing its memory from the

direct map.

Note that with this patch, memfd_secret() will start erroring on systems

where can_set_direct_map() returns false (arm64 with

CONFIG_RODATA_FUL

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References