CVE-2024-35877 (GCVE-0-2024-35877)
Vulnerability from cvelistv5 – Published: 2024-05-19 08:34 – Updated: 2026-05-12 11:52
VLAI
EPSS
VEX
Title
x86/mm/pat: fix VM_PAT handling in COW mappings
Summary
In the Linux kernel, the following vulnerability has been resolved:
x86/mm/pat: fix VM_PAT handling in COW mappings
PAT handling won't do the right thing in COW mappings: the first PTE (or,
in fact, all PTEs) can be replaced during write faults to point at anon
folios. Reliably recovering the correct PFN and cachemode using
follow_phys() from PTEs will not work in COW mappings.
Using follow_phys(), we might just get the address+protection of the anon
folio (which is very wrong), or fail on swap/nonswap entries, failing
follow_phys() and triggering a WARN_ON_ONCE() in untrack_pfn() and
track_pfn_copy(), not properly calling free_pfn_range().
In free_pfn_range(), we either wouldn't call memtype_free() or would call
it with the wrong range, possibly leaking memory.
To fix that, let's update follow_phys() to refuse returning anon folios,
and fallback to using the stored PFN inside vma->vm_pgoff for COW mappings
if we run into that.
We will now properly handle untrack_pfn() with COW mappings, where we
don't need the cachemode. We'll have to fail fork()->track_pfn_copy() if
the first page was replaced by an anon folio, though: we'd have to store
the cachemode in the VMA to make this work, likely growing the VMA size.
For now, lets keep it simple and let track_pfn_copy() just fail in that
case: it would have failed in the past with swap/nonswap entries already,
and it would have done the wrong thing with anon folios.
Simple reproducer to trigger the WARN_ON_ONCE() in untrack_pfn():
<--- C reproducer --->
#include <stdio.h>
#include <sys/mman.h>
#include <unistd.h>
#include <liburing.h>
int main(void)
{
struct io_uring_params p = {};
int ring_fd;
size_t size;
char *map;
ring_fd = io_uring_setup(1, &p);
if (ring_fd < 0) {
perror("io_uring_setup");
return 1;
}
size = p.sq_off.array + p.sq_entries * sizeof(unsigned);
/* Map the submission queue ring MAP_PRIVATE */
map = mmap(0, size, PROT_READ | PROT_WRITE, MAP_PRIVATE,
ring_fd, IORING_OFF_SQ_RING);
if (map == MAP_FAILED) {
perror("mmap");
return 1;
}
/* We have at least one page. Let's COW it. */
*map = 0;
pause();
return 0;
}
<--- C reproducer --->
On a system with 16 GiB RAM and swap configured:
# ./iouring &
# memhog 16G
# killall iouring
[ 301.552930] ------------[ cut here ]------------
[ 301.553285] WARNING: CPU: 7 PID: 1402 at arch/x86/mm/pat/memtype.c:1060 untrack_pfn+0xf4/0x100
[ 301.553989] Modules linked in: binfmt_misc nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_g
[ 301.558232] CPU: 7 PID: 1402 Comm: iouring Not tainted 6.7.5-100.fc38.x86_64 #1
[ 301.558772] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebu4
[ 301.559569] RIP: 0010:untrack_pfn+0xf4/0x100
[ 301.559893] Code: 75 c4 eb cf 48 8b 43 10 8b a8 e8 00 00 00 3b 6b 28 74 b8 48 8b 7b 30 e8 ea 1a f7 000
[ 301.561189] RSP: 0018:ffffba2c0377fab8 EFLAGS: 00010282
[ 301.561590] RAX: 00000000ffffffea RBX: ffff9208c8ce9cc0 RCX: 000000010455e047
[ 301.562105] RDX: 07fffffff0eb1e0a RSI: 0000000000000000 RDI: ffff9208c391d200
[ 301.562628] RBP: 0000000000000000 R08: ffffba2c0377fab8 R09: 0000000000000000
[ 301.563145] R10: ffff9208d2292d50 R11: 0000000000000002 R12: 00007fea890e0000
[ 301.563669] R13: 0000000000000000 R14: ffffba2c0377fc08 R15: 0000000000000000
[ 301.564186] FS: 0000000000000000(0000) GS:ffff920c2fbc0000(0000) knlGS:0000000000000000
[ 301.564773] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 301.565197] CR2: 00007fea88ee8a20 CR3: 00000001033a8000 CR4: 0000000000750ef0
[ 301.565725] PKRU: 55555554
[ 301.565944] Call Trace:
[ 301.566148] <TASK>
[ 301.566325] ? untrack_pfn+0xf4/0x100
[ 301.566618] ? __warn+0x81/0x130
[ 301.566876] ? untrack_pfn+0xf4/0x100
[ 3
---truncated---
Severity
No CVSS data available.
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-01-16 21:13 UTC
Assigner
References
11 references
Impacted products
3 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Linux | Linux |
Affected:
5899329b19100c0b82dc78e9b21ed8b920c9ffb3 , < f18681daaec9665a15c5e7e0f591aad5d0ac622b
(git)
Affected: 5899329b19100c0b82dc78e9b21ed8b920c9ffb3 , < 09e6bb53217bf388a0d2fd7fb21e74ab9dffc173 (git) Affected: 5899329b19100c0b82dc78e9b21ed8b920c9ffb3 , < c2b2430b48f3c9eaccd2c3d2ad75bb540d4952f4 (git) Affected: 5899329b19100c0b82dc78e9b21ed8b920c9ffb3 , < 7cfee26d1950250b14c5cb0a37b142f3fcc6396a (git) Affected: 5899329b19100c0b82dc78e9b21ed8b920c9ffb3 , < 97e93367e82752e475a33839a80b33bdbef1209f (git) Affected: 5899329b19100c0b82dc78e9b21ed8b920c9ffb3 , < 51b7841f3fe84606ec0bd8da859d22e05e5419ec (git) Affected: 5899329b19100c0b82dc78e9b21ed8b920c9ffb3 , < 1341e4b32e1fb1b0acd002ccd56f07bd32f2abc6 (git) Affected: 5899329b19100c0b82dc78e9b21ed8b920c9ffb3 , < 04c35ab3bdae7fefbd7c7a7355f29fa03a035221 (git) |
guessed | |
| Linux | Linux |
Affected:
2.6.29
Unaffected: 0 , < 2.6.29 (semver) Unaffected: 4.19.312 , ≤ 4.19.* (semver) Unaffected: 5.4.274 , ≤ 5.4.* (semver) Unaffected: 5.10.215 , ≤ 5.10.* (semver) Unaffected: 5.15.155 , ≤ 5.15.* (semver) Unaffected: 6.1.85 , ≤ 6.1.* (semver) Unaffected: 6.6.26 , ≤ 6.6.* (semver) Unaffected: 6.8.5 , ≤ 6.8.* (semver) Unaffected: 6.9 , ≤ * (original_commit_for_fix) |
guessed | |
| Siemens | SIMATIC S7-1500 TM MFP - GNU/Linux subsystem |
Affected:
0 , < *
(custom)
|
guessed |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-35877",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-01-16T21:13:41.454834Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-noinfo Not enough information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-01-16T21:14:37.162Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T03:21:48.797Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/f18681daaec9665a15c5e7e0f591aad5d0ac622b"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/09e6bb53217bf388a0d2fd7fb21e74ab9dffc173"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/c2b2430b48f3c9eaccd2c3d2ad75bb540d4952f4"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/7cfee26d1950250b14c5cb0a37b142f3fcc6396a"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/97e93367e82752e475a33839a80b33bdbef1209f"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/51b7841f3fe84606ec0bd8da859d22e05e5419ec"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/1341e4b32e1fb1b0acd002ccd56f07bd32f2abc6"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/04c35ab3bdae7fefbd7c7a7355f29fa03a035221"
},
{
"tags": [
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html"
},
{
"tags": [
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-12T11:52:17.843Z",
"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"shortName": "siemens-SADP"
},
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"
}
],
"x_adpType": "supplier"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/x86/mm/pat/memtype.c",
"mm/memory.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f18681daaec9665a15c5e7e0f591aad5d0ac622b",
"status": "affected",
"version": "5899329b19100c0b82dc78e9b21ed8b920c9ffb3",
"versionType": "git"
},
{
"lessThan": "09e6bb53217bf388a0d2fd7fb21e74ab9dffc173",
"status": "affected",
"version": "5899329b19100c0b82dc78e9b21ed8b920c9ffb3",
"versionType": "git"
},
{
"lessThan": "c2b2430b48f3c9eaccd2c3d2ad75bb540d4952f4",
"status": "affected",
"version": "5899329b19100c0b82dc78e9b21ed8b920c9ffb3",
"versionType": "git"
},
{
"lessThan": "7cfee26d1950250b14c5cb0a37b142f3fcc6396a",
"status": "affected",
"version": "5899329b19100c0b82dc78e9b21ed8b920c9ffb3",
"versionType": "git"
},
{
"lessThan": "97e93367e82752e475a33839a80b33bdbef1209f",
"status": "affected",
"version": "5899329b19100c0b82dc78e9b21ed8b920c9ffb3",
"versionType": "git"
},
{
"lessThan": "51b7841f3fe84606ec0bd8da859d22e05e5419ec",
"status": "affected",
"version": "5899329b19100c0b82dc78e9b21ed8b920c9ffb3",
"versionType": "git"
},
{
"lessThan": "1341e4b32e1fb1b0acd002ccd56f07bd32f2abc6",
"status": "affected",
"version": "5899329b19100c0b82dc78e9b21ed8b920c9ffb3",
"versionType": "git"
},
{
"lessThan": "04c35ab3bdae7fefbd7c7a7355f29fa03a035221",
"status": "affected",
"version": "5899329b19100c0b82dc78e9b21ed8b920c9ffb3",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/x86/mm/pat/memtype.c",
"mm/memory.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.29"
},
{
"lessThan": "2.6.29",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.19.*",
"status": "unaffected",
"version": "4.19.312",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.4.*",
"status": "unaffected",
"version": "5.4.274",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.215",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.155",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.85",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.26",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.8.*",
"status": "unaffected",
"version": "6.8.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.9",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.19.312",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.4.274",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.215",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.155",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.85",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.26",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.8.5",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.9",
"versionStartIncluding": "2.6.29",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/mm/pat: fix VM_PAT handling in COW mappings\n\nPAT handling won\u0027t do the right thing in COW mappings: the first PTE (or,\nin fact, all PTEs) can be replaced during write faults to point at anon\nfolios. Reliably recovering the correct PFN and cachemode using\nfollow_phys() from PTEs will not work in COW mappings.\n\nUsing follow_phys(), we might just get the address+protection of the anon\nfolio (which is very wrong), or fail on swap/nonswap entries, failing\nfollow_phys() and triggering a WARN_ON_ONCE() in untrack_pfn() and\ntrack_pfn_copy(), not properly calling free_pfn_range().\n\nIn free_pfn_range(), we either wouldn\u0027t call memtype_free() or would call\nit with the wrong range, possibly leaking memory.\n\nTo fix that, let\u0027s update follow_phys() to refuse returning anon folios,\nand fallback to using the stored PFN inside vma-\u003evm_pgoff for COW mappings\nif we run into that.\n\nWe will now properly handle untrack_pfn() with COW mappings, where we\ndon\u0027t need the cachemode. We\u0027ll have to fail fork()-\u003etrack_pfn_copy() if\nthe first page was replaced by an anon folio, though: we\u0027d have to store\nthe cachemode in the VMA to make this work, likely growing the VMA size.\n\nFor now, lets keep it simple and let track_pfn_copy() just fail in that\ncase: it would have failed in the past with swap/nonswap entries already,\nand it would have done the wrong thing with anon folios.\n\nSimple reproducer to trigger the WARN_ON_ONCE() in untrack_pfn():\n\n\u003c--- C reproducer ---\u003e\n #include \u003cstdio.h\u003e\n #include \u003csys/mman.h\u003e\n #include \u003cunistd.h\u003e\n #include \u003cliburing.h\u003e\n\n int main(void)\n {\n struct io_uring_params p = {};\n int ring_fd;\n size_t size;\n char *map;\n\n ring_fd = io_uring_setup(1, \u0026p);\n if (ring_fd \u003c 0) {\n perror(\"io_uring_setup\");\n return 1;\n }\n size = p.sq_off.array + p.sq_entries * sizeof(unsigned);\n\n /* Map the submission queue ring MAP_PRIVATE */\n map = mmap(0, size, PROT_READ | PROT_WRITE, MAP_PRIVATE,\n ring_fd, IORING_OFF_SQ_RING);\n if (map == MAP_FAILED) {\n perror(\"mmap\");\n return 1;\n }\n\n /* We have at least one page. Let\u0027s COW it. */\n *map = 0;\n pause();\n return 0;\n }\n\u003c--- C reproducer ---\u003e\n\nOn a system with 16 GiB RAM and swap configured:\n # ./iouring \u0026\n # memhog 16G\n # killall iouring\n[ 301.552930] ------------[ cut here ]------------\n[ 301.553285] WARNING: CPU: 7 PID: 1402 at arch/x86/mm/pat/memtype.c:1060 untrack_pfn+0xf4/0x100\n[ 301.553989] Modules linked in: binfmt_misc nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_g\n[ 301.558232] CPU: 7 PID: 1402 Comm: iouring Not tainted 6.7.5-100.fc38.x86_64 #1\n[ 301.558772] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebu4\n[ 301.559569] RIP: 0010:untrack_pfn+0xf4/0x100\n[ 301.559893] Code: 75 c4 eb cf 48 8b 43 10 8b a8 e8 00 00 00 3b 6b 28 74 b8 48 8b 7b 30 e8 ea 1a f7 000\n[ 301.561189] RSP: 0018:ffffba2c0377fab8 EFLAGS: 00010282\n[ 301.561590] RAX: 00000000ffffffea RBX: ffff9208c8ce9cc0 RCX: 000000010455e047\n[ 301.562105] RDX: 07fffffff0eb1e0a RSI: 0000000000000000 RDI: ffff9208c391d200\n[ 301.562628] RBP: 0000000000000000 R08: ffffba2c0377fab8 R09: 0000000000000000\n[ 301.563145] R10: ffff9208d2292d50 R11: 0000000000000002 R12: 00007fea890e0000\n[ 301.563669] R13: 0000000000000000 R14: ffffba2c0377fc08 R15: 0000000000000000\n[ 301.564186] FS: 0000000000000000(0000) GS:ffff920c2fbc0000(0000) knlGS:0000000000000000\n[ 301.564773] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 301.565197] CR2: 00007fea88ee8a20 CR3: 00000001033a8000 CR4: 0000000000750ef0\n[ 301.565725] PKRU: 55555554\n[ 301.565944] Call Trace:\n[ 301.566148] \u003cTASK\u003e\n[ 301.566325] ? untrack_pfn+0xf4/0x100\n[ 301.566618] ? __warn+0x81/0x130\n[ 301.566876] ? untrack_pfn+0xf4/0x100\n[ 3\n---truncated---"
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T20:12:58.539Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f18681daaec9665a15c5e7e0f591aad5d0ac622b"
},
{
"url": "https://git.kernel.org/stable/c/09e6bb53217bf388a0d2fd7fb21e74ab9dffc173"
},
{
"url": "https://git.kernel.org/stable/c/c2b2430b48f3c9eaccd2c3d2ad75bb540d4952f4"
},
{
"url": "https://git.kernel.org/stable/c/7cfee26d1950250b14c5cb0a37b142f3fcc6396a"
},
{
"url": "https://git.kernel.org/stable/c/97e93367e82752e475a33839a80b33bdbef1209f"
},
{
"url": "https://git.kernel.org/stable/c/51b7841f3fe84606ec0bd8da859d22e05e5419ec"
},
{
"url": "https://git.kernel.org/stable/c/1341e4b32e1fb1b0acd002ccd56f07bd32f2abc6"
},
{
"url": "https://git.kernel.org/stable/c/04c35ab3bdae7fefbd7c7a7355f29fa03a035221"
}
],
"title": "x86/mm/pat: fix VM_PAT handling in COW mappings",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2024-35877",
"datePublished": "2024-05-19T08:34:34.604Z",
"dateReserved": "2024-05-17T13:50:33.110Z",
"dateUpdated": "2026-05-12T11:52:17.843Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2024-35877",
"date": "2026-09-15",
"epss": "0.00254",
"percentile": "0.1702"
},
"fkie_nvd": {
"descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nx86/mm/pat: fix VM_PAT handling in COW mappings\\n\\nPAT handling won\u0027t do the right thing in COW mappings: the first PTE (or,\\nin fact, all PTEs) can be replaced during write faults to point at anon\\nfolios. Reliably recovering the correct PFN and cachemode using\\nfollow_phys() from PTEs will not work in COW mappings.\\n\\nUsing follow_phys(), we might just get the address+protection of the anon\\nfolio (which is very wrong), or fail on swap/nonswap entries, failing\\nfollow_phys() and triggering a WARN_ON_ONCE() in untrack_pfn() and\\ntrack_pfn_copy(), not properly calling free_pfn_range().\\n\\nIn free_pfn_range(), we either wouldn\u0027t call memtype_free() or would call\\nit with the wrong range, possibly leaking memory.\\n\\nTo fix that, let\u0027s update follow_phys() to refuse returning anon folios,\\nand fallback to using the stored PFN inside vma-\u003evm_pgoff for COW mappings\\nif we run into that.\\n\\nWe will now properly handle untrack_pfn() with COW mappings, where we\\ndon\u0027t need the cachemode. We\u0027ll have to fail fork()-\u003etrack_pfn_copy() if\\nthe first page was replaced by an anon folio, though: we\u0027d have to store\\nthe cachemode in the VMA to make this work, likely growing the VMA size.\\n\\nFor now, lets keep it simple and let track_pfn_copy() just fail in that\\ncase: it would have failed in the past with swap/nonswap entries already,\\nand it would have done the wrong thing with anon folios.\\n\\nSimple reproducer to trigger the WARN_ON_ONCE() in untrack_pfn():\\n\\n\u003c--- C reproducer ---\u003e\\n #include \u003cstdio.h\u003e\\n #include \u003csys/mman.h\u003e\\n #include \u003cunistd.h\u003e\\n #include \u003cliburing.h\u003e\\n\\n int main(void)\\n {\\n struct io_uring_params p = {};\\n int ring_fd;\\n size_t size;\\n char *map;\\n\\n ring_fd = io_uring_setup(1, \u0026p);\\n if (ring_fd \u003c 0) {\\n perror(\\\"io_uring_setup\\\");\\n return 1;\\n }\\n size = p.sq_off.array + p.sq_entries * sizeof(unsigned);\\n\\n /* Map the submission queue ring MAP_PRIVATE */\\n map = mmap(0, size, PROT_READ | PROT_WRITE, MAP_PRIVATE,\\n ring_fd, IORING_OFF_SQ_RING);\\n if (map == MAP_FAILED) {\\n perror(\\\"mmap\\\");\\n return 1;\\n }\\n\\n /* We have at least one page. Let\u0027s COW it. */\\n *map = 0;\\n pause();\\n return 0;\\n }\\n\u003c--- C reproducer ---\u003e\\n\\nOn a system with 16 GiB RAM and swap configured:\\n # ./iouring \u0026\\n # memhog 16G\\n # killall iouring\\n[ 301.552930] ------------[ cut here ]------------\\n[ 301.553285] WARNING: CPU: 7 PID: 1402 at arch/x86/mm/pat/memtype.c:1060 untrack_pfn+0xf4/0x100\\n[ 301.553989] Modules linked in: binfmt_misc nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_g\\n[ 301.558232] CPU: 7 PID: 1402 Comm: iouring Not tainted 6.7.5-100.fc38.x86_64 #1\\n[ 301.558772] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebu4\\n[ 301.559569] RIP: 0010:untrack_pfn+0xf4/0x100\\n[ 301.559893] Code: 75 c4 eb cf 48 8b 43 10 8b a8 e8 00 00 00 3b 6b 28 74 b8 48 8b 7b 30 e8 ea 1a f7 000\\n[ 301.561189] RSP: 0018:ffffba2c0377fab8 EFLAGS: 00010282\\n[ 301.561590] RAX: 00000000ffffffea RBX: ffff9208c8ce9cc0 RCX: 000000010455e047\\n[ 301.562105] RDX: 07fffffff0eb1e0a RSI: 0000000000000000 RDI: ffff9208c391d200\\n[ 301.562628] RBP: 0000000000000000 R08: ffffba2c0377fab8 R09: 0000000000000000\\n[ 301.563145] R10: ffff9208d2292d50 R11: 0000000000000002 R12: 00007fea890e0000\\n[ 301.563669] R13: 0000000000000000 R14: ffffba2c0377fc08 R15: 0000000000000000\\n[ 301.564186] FS: 0000000000000000(0000) GS:ffff920c2fbc0000(0000) knlGS:0000000000000000\\n[ 301.564773] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\n[ 301.565197] CR2: 00007fea88ee8a20 CR3: 00000001033a8000 CR4: 0000000000750ef0\\n[ 301.565725] PKRU: 55555554\\n[ 301.565944] Call Trace:\\n[ 301.566148] \u003cTASK\u003e\\n[ 301.566325] ? untrack_pfn+0xf4/0x100\\n[ 301.566618] ? __warn+0x81/0x130\\n[ 301.566876] ? untrack_pfn+0xf4/0x100\\n[ 3\\n---truncated---\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: x86/mm/pat: corrige el manejo de VM_PAT en asignaciones COW El manejo de PAT no funcionar\\u00e1 correctamente en las asignaciones COW: la primera PTE (o, de hecho, todas las PTE) pueden ser reemplazado durante fallos de escritura para se\\u00f1alar folios an\\u00f3nimos. Recuperar de manera confiable el PFN y el modo de cach\\u00e9 correctos usando follow_phys() de las PTE no funcionar\\u00e1 en las asignaciones COW. Usando follow_phys(), podr\\u00edamos obtener la direcci\\u00f3n+protecci\\u00f3n de la publicaci\\u00f3n an\\u00f3nima (lo cual es muy incorrecto), o fallar en las entradas de intercambio/no intercambio, fallando en follow_phys() y activando un WARN_ON_ONCE() en untrack_pfn() y track_pfn_copy() , no llamando correctamente a free_pfn_range(). En free_pfn_range(), no llamar\\u00edamos a memtype_free() o lo llamar\\u00edamos con el rango incorrecto, posiblemente perdiendo memoria. Para solucionarlo, actualicemos follow_phys() para rechazar la devoluci\\u00f3n de publicaciones an\\u00f3nimas y recurramos al uso del PFN almacenado dentro de vma-\u0026gt;vm_pgoff para asignaciones COW si nos encontramos con eso. Ahora manejaremos adecuadamente untrack_pfn() con asignaciones COW, donde no necesitamos el modo cach\\u00e9. Sin embargo, tendremos que fallar fork()-\u0026gt;track_pfn_copy() si la primera p\\u00e1gina fue reemplazada por una publicaci\\u00f3n an\\u00f3nima: tendr\\u00edamos que almacenar el modo de cach\\u00e9 en el VMA para que esto funcione, probablemente aumentando el tama\\u00f1o del VMA. Por ahora, manteng\\u00e1moslo simple y dejemos que track_pfn_copy() simplemente falle en ese caso: ya habr\\u00eda fallado en el pasado con entradas de intercambio/no intercambio, y habr\\u00eda hecho algo incorrecto con folios an\\u00f3nimos. Reproductor simple para activar WARN_ON_ONCE() en untrack_pfn(): \u0026lt;--- Reproductor C ---\u0026gt; #include #include #include #include int main(void) { struct io_uring_params p = {}; int anillo_fd; tama\\u00f1o_t tama\\u00f1o; carb\\u00f3n *mapa; ring_fd = io_uring_setup(1, \u0026amp;p); if (ring_fd \u0026lt; 0) { perror(\\\"io_uring_setup\\\"); devolver 1; } tama\\u00f1o = p.sq_off.array + p.sq_entries * tama\\u00f1o de (sin firmar); /* Asigna el anillo de cola de env\\u00edo MAP_PRIVATE */ map = mmap(0, size, PROT_READ | PROT_WRITE, MAP_PRIVATE, ring_fd, IORING_OFF_SQ_RING); if (mapa == MAP_FAILED) { perror(\\\"mmap\\\"); devolver 1; } /* Tenemos al menos una p\\u00e1gina. Vamos a acobardarnos. */ *mapa = 0; pausa(); devolver 0; } \u0026lt;--- Reproductor C ---\u0026gt; En un sistema con 16 GiB de RAM y swap configurado: # ./iouring \u0026amp; # memhog 16G # killall iouring [ 301.552930] ------------[ cut aqu\\u00ed ]------------ [ 301.553285] ADVERTENCIA: CPU: 7 PID: 1402 en arch/x86/mm/pat/memtype.c:1060 untrack_pfn+0xf4/0x100 [ 301.553989] M\\u00f3dulos vinculados en : binfmt_misc nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_g [ 301.558232] CPU: 7 PID: 1402 Comm: iouring No contaminado 6.7.5-100.fc38.x86_64 #1 [ 301.558772] Nombre del hardware: PC est\\u00e1ndar QEMU (Q35 + ICH9, 2009), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebu4 [ 301.559569] RIP: 0010:untrack_pfn+0xf4/0x100 [ 301.559893] C\\u00f3digo: 75 c4 eb cf 48 8b 43 10 8b a8 e8 00 00 00 3b b 28 74 b8 48 8b 7b 30 e8 ea 1a f7 000 [ 301.561189] RSP: 0018:ffffba2c0377fab8 EFLAGS: 00010282 [ 301.561590] RAX: 00000000ffffffea RBX: ffff9208c8ce9cc0 RCX: 455e047 [301.562105] RDX: 07fffffff0eb1e0a RSI: 0000000000000000 RDI: ffff9208c391d200 [301.562628] RBP: 0000000000000000 R08: 8 R09: 0000000000000000 [ 301.563145] R10: ffff9208d2292d50 R11: 0000000000000002 R12: 00007fea890e0000 [ 301.563669] R13: 00000 R14: ffffba2c0377fc08 R15: 00000000000000000 [ 301.564186] FS: 0000000000000000(0000) GS:ffff920c2fbc0000(0000) knlGS:0000000000000000 0 [301.564773] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 301.565197] CR2: 00007fea88ee8a20 CR3: 00000001033a8000 CR4: 0000000000750ef0 [ 301.565725] KRU: 55555554 [ 301.565944] Seguimiento de llamadas: [ 301.566148] [ 301.566325] ? untrack_pfn+0xf4/0x100 [301.566618]? __advertir+0x81/0x130 [ 301.566876] ? untrack_pfn+0xf4/0x100 [ 3 ---truncado---\"}]",
"id": "CVE-2024-35877",
"lastModified": "2024-11-21T09:21:06.417",
"metrics": "{\"cvssMetricV31\": [{\"source\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 5.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 3.6}]}",
"published": "2024-05-19T09:15:08.990",
"references": "[{\"url\": \"https://git.kernel.org/stable/c/04c35ab3bdae7fefbd7c7a7355f29fa03a035221\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/09e6bb53217bf388a0d2fd7fb21e74ab9dffc173\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/1341e4b32e1fb1b0acd002ccd56f07bd32f2abc6\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/51b7841f3fe84606ec0bd8da859d22e05e5419ec\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/7cfee26d1950250b14c5cb0a37b142f3fcc6396a\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/97e93367e82752e475a33839a80b33bdbef1209f\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/c2b2430b48f3c9eaccd2c3d2ad75bb540d4952f4\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/f18681daaec9665a15c5e7e0f591aad5d0ac622b\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/04c35ab3bdae7fefbd7c7a7355f29fa03a035221\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/09e6bb53217bf388a0d2fd7fb21e74ab9dffc173\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/1341e4b32e1fb1b0acd002ccd56f07bd32f2abc6\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/51b7841f3fe84606ec0bd8da859d22e05e5419ec\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/7cfee26d1950250b14c5cb0a37b142f3fcc6396a\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/97e93367e82752e475a33839a80b33bdbef1209f\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/c2b2430b48f3c9eaccd2c3d2ad75bb540d4952f4\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/f18681daaec9665a15c5e7e0f591aad5d0ac622b\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"vulnStatus": "Awaiting Analysis"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2024-35877\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-19T09:15:08.990\",\"lastModified\":\"2026-06-17T07:35:36.967\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nx86/mm/pat: fix VM_PAT handling in COW mappings\\n\\nPAT handling won\u0027t do the right thing in COW mappings: the first PTE (or,\\nin fact, all PTEs) can be replaced during write faults to point at anon\\nfolios. Reliably recovering the correct PFN and cachemode using\\nfollow_phys() from PTEs will not work in COW mappings.\\n\\nUsing follow_phys(), we might just get the address+protection of the anon\\nfolio (which is very wrong), or fail on swap/nonswap entries, failing\\nfollow_phys() and triggering a WARN_ON_ONCE() in untrack_pfn() and\\ntrack_pfn_copy(), not properly calling free_pfn_range().\\n\\nIn free_pfn_range(), we either wouldn\u0027t call memtype_free() or would call\\nit with the wrong range, possibly leaking memory.\\n\\nTo fix that, let\u0027s update follow_phys() to refuse returning anon folios,\\nand fallback to using the stored PFN inside vma-\u003evm_pgoff for COW mappings\\nif we run into that.\\n\\nWe will now properly handle untrack_pfn() with COW mappings, where we\\ndon\u0027t need the cachemode. We\u0027ll have to fail fork()-\u003etrack_pfn_copy() if\\nthe first page was replaced by an anon folio, though: we\u0027d have to store\\nthe cachemode in the VMA to make this work, likely growing the VMA size.\\n\\nFor now, lets keep it simple and let track_pfn_copy() just fail in that\\ncase: it would have failed in the past with swap/nonswap entries already,\\nand it would have done the wrong thing with anon folios.\\n\\nSimple reproducer to trigger the WARN_ON_ONCE() in untrack_pfn():\\n\\n\u003c--- C reproducer ---\u003e\\n #include \u003cstdio.h\u003e\\n #include \u003csys/mman.h\u003e\\n #include \u003cunistd.h\u003e\\n #include \u003cliburing.h\u003e\\n\\n int main(void)\\n {\\n struct io_uring_params p = {};\\n int ring_fd;\\n size_t size;\\n char *map;\\n\\n ring_fd = io_uring_setup(1, \u0026p);\\n if (ring_fd \u003c 0) {\\n perror(\\\"io_uring_setup\\\");\\n return 1;\\n }\\n size = p.sq_off.array + p.sq_entries * sizeof(unsigned);\\n\\n /* Map the submission queue ring MAP_PRIVATE */\\n map = mmap(0, size, PROT_READ | PROT_WRITE, MAP_PRIVATE,\\n ring_fd, IORING_OFF_SQ_RING);\\n if (map == MAP_FAILED) {\\n perror(\\\"mmap\\\");\\n return 1;\\n }\\n\\n /* We have at least one page. Let\u0027s COW it. */\\n *map = 0;\\n pause();\\n return 0;\\n }\\n\u003c--- C reproducer ---\u003e\\n\\nOn a system with 16 GiB RAM and swap configured:\\n # ./iouring \u0026\\n # memhog 16G\\n # killall iouring\\n[ 301.552930] ------------[ cut here ]------------\\n[ 301.553285] WARNING: CPU: 7 PID: 1402 at arch/x86/mm/pat/memtype.c:1060 untrack_pfn+0xf4/0x100\\n[ 301.553989] Modules linked in: binfmt_misc nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_g\\n[ 301.558232] CPU: 7 PID: 1402 Comm: iouring Not tainted 6.7.5-100.fc38.x86_64 #1\\n[ 301.558772] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebu4\\n[ 301.559569] RIP: 0010:untrack_pfn+0xf4/0x100\\n[ 301.559893] Code: 75 c4 eb cf 48 8b 43 10 8b a8 e8 00 00 00 3b 6b 28 74 b8 48 8b 7b 30 e8 ea 1a f7 000\\n[ 301.561189] RSP: 0018:ffffba2c0377fab8 EFLAGS: 00010282\\n[ 301.561590] RAX: 00000000ffffffea RBX: ffff9208c8ce9cc0 RCX: 000000010455e047\\n[ 301.562105] RDX: 07fffffff0eb1e0a RSI: 0000000000000000 RDI: ffff9208c391d200\\n[ 301.562628] RBP: 0000000000000000 R08: ffffba2c0377fab8 R09: 0000000000000000\\n[ 301.563145] R10: ffff9208d2292d50 R11: 0000000000000002 R12: 00007fea890e0000\\n[ 301.563669] R13: 0000000000000000 R14: ffffba2c0377fc08 R15: 0000000000000000\\n[ 301.564186] FS: 0000000000000000(0000) GS:ffff920c2fbc0000(0000) knlGS:0000000000000000\\n[ 301.564773] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\n[ 301.565197] CR2: 00007fea88ee8a20 CR3: 00000001033a8000 CR4: 0000000000750ef0\\n[ 301.565725] PKRU: 55555554\\n[ 301.565944] Call Trace:\\n[ 301.566148] \u003cTASK\u003e\\n[ 301.566325] ? untrack_pfn+0xf4/0x100\\n[ 301.566618] ? __warn+0x81/0x130\\n[ 301.566876] ? untrack_pfn+0xf4/0x100\\n[ 3\\n---truncated---\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: x86/mm/pat: corrige el manejo de VM_PAT en asignaciones COW El manejo de PAT no funcionar\u00e1 correctamente en las asignaciones COW: la primera PTE (o, de hecho, todas las PTE) pueden ser reemplazado durante fallos de escritura para se\u00f1alar folios an\u00f3nimos. Recuperar de manera confiable el PFN y el modo de cach\u00e9 correctos usando follow_phys() de las PTE no funcionar\u00e1 en las asignaciones COW. Usando follow_phys(), podr\u00edamos obtener la direcci\u00f3n+protecci\u00f3n de la publicaci\u00f3n an\u00f3nima (lo cual es muy incorrecto), o fallar en las entradas de intercambio/no intercambio, fallando en follow_phys() y activando un WARN_ON_ONCE() en untrack_pfn() y track_pfn_copy() , no llamando correctamente a free_pfn_range(). En free_pfn_range(), no llamar\u00edamos a memtype_free() o lo llamar\u00edamos con el rango incorrecto, posiblemente perdiendo memoria. Para solucionarlo, actualicemos follow_phys() para rechazar la devoluci\u00f3n de publicaciones an\u00f3nimas y recurramos al uso del PFN almacenado dentro de vma-\u0026gt;vm_pgoff para asignaciones COW si nos encontramos con eso. Ahora manejaremos adecuadamente untrack_pfn() con asignaciones COW, donde no necesitamos el modo cach\u00e9. Sin embargo, tendremos que fallar fork()-\u0026gt;track_pfn_copy() si la primera p\u00e1gina fue reemplazada por una publicaci\u00f3n an\u00f3nima: tendr\u00edamos que almacenar el modo de cach\u00e9 en el VMA para que esto funcione, probablemente aumentando el tama\u00f1o del VMA. Por ahora, manteng\u00e1moslo simple y dejemos que track_pfn_copy() simplemente falle en ese caso: ya habr\u00eda fallado en el pasado con entradas de intercambio/no intercambio, y habr\u00eda hecho algo incorrecto con folios an\u00f3nimos. Reproductor simple para activar WARN_ON_ONCE() en untrack_pfn(): \u0026lt;--- Reproductor C ---\u0026gt; #include #include #include #include int main(void) { struct io_uring_params p = {}; int anillo_fd; tama\u00f1o_t tama\u00f1o; carb\u00f3n *mapa; ring_fd = io_uring_setup(1, \u0026amp;p); if (ring_fd \u0026lt; 0) { perror(\\\"io_uring_setup\\\"); devolver 1; } tama\u00f1o = p.sq_off.array + p.sq_entries * tama\u00f1o de (sin firmar); /* Asigna el anillo de cola de env\u00edo MAP_PRIVATE */ map = mmap(0, size, PROT_READ | PROT_WRITE, MAP_PRIVATE, ring_fd, IORING_OFF_SQ_RING); if (mapa == MAP_FAILED) { perror(\\\"mmap\\\"); devolver 1; } /* Tenemos al menos una p\u00e1gina. Vamos a acobardarnos. */ *mapa = 0; pausa(); devolver 0; } \u0026lt;--- Reproductor C ---\u0026gt; En un sistema con 16 GiB de RAM y swap configurado: # ./iouring \u0026amp; # memhog 16G # killall iouring [ 301.552930] ------------[ cut aqu\u00ed ]------------ [ 301.553285] ADVERTENCIA: CPU: 7 PID: 1402 en arch/x86/mm/pat/memtype.c:1060 untrack_pfn+0xf4/0x100 [ 301.553989] M\u00f3dulos vinculados en : binfmt_misc nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_g [ 301.558232] CPU: 7 PID: 1402 Comm: iouring No contaminado 6.7.5-100.fc38.x86_64 #1 [ 301.558772] Nombre del hardware: PC est\u00e1ndar QEMU (Q35 + ICH9, 2009), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebu4 [ 301.559569] RIP: 0010:untrack_pfn+0xf4/0x100 [ 301.559893] C\u00f3digo: 75 c4 eb cf 48 8b 43 10 8b a8 e8 00 00 00 3b b 28 74 b8 48 8b 7b 30 e8 ea 1a f7 000 [ 301.561189] RSP: 0018:ffffba2c0377fab8 EFLAGS: 00010282 [ 301.561590] RAX: 00000000ffffffea RBX: ffff9208c8ce9cc0 RCX: 455e047 [301.562105] RDX: 07fffffff0eb1e0a RSI: 0000000000000000 RDI: ffff9208c391d200 [301.562628] RBP: 0000000000000000 R08: 8 R09: 0000000000000000 [ 301.563145] R10: ffff9208d2292d50 R11: 0000000000000002 R12: 00007fea890e0000 [ 301.563669] R13: 00000 R14: ffffba2c0377fc08 R15: 00000000000000000 [ 301.564186] FS: 0000000000000000(0000) GS:ffff920c2fbc0000(0000) knlGS:0000000000000000 0 [301.564773] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 301.565197] CR2: 00007fea88ee8a20 CR3: 00000001033a8000 CR4: 0000000000750ef0 [ 301.565725] KRU: 55555554 [ 301.565944] Seguimiento de llamadas: [ 301.566148] [ 301.566325] ? untrack_pfn+0xf4/0x100 [301.566618]? __advertir+0x81/0x130 [ 301.566876] ? untrack_pfn+0xf4/0x100 [ 3 ---truncado---\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"arch/x86/mm/pat/memtype.c\",\"mm/memory.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5899329b19100c0b82dc78e9b21ed8b920c9ffb3\",\"lessThan\":\"f18681daaec9665a15c5e7e0f591aad5d0ac622b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5899329b19100c0b82dc78e9b21ed8b920c9ffb3\",\"lessThan\":\"09e6bb53217bf388a0d2fd7fb21e74ab9dffc173\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5899329b19100c0b82dc78e9b21ed8b920c9ffb3\",\"lessThan\":\"c2b2430b48f3c9eaccd2c3d2ad75bb540d4952f4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5899329b19100c0b82dc78e9b21ed8b920c9ffb3\",\"lessThan\":\"7cfee26d1950250b14c5cb0a37b142f3fcc6396a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5899329b19100c0b82dc78e9b21ed8b920c9ffb3\",\"lessThan\":\"97e93367e82752e475a33839a80b33bdbef1209f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5899329b19100c0b82dc78e9b21ed8b920c9ffb3\",\"lessThan\":\"51b7841f3fe84606ec0bd8da859d22e05e5419ec\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5899329b19100c0b82dc78e9b21ed8b920c9ffb3\",\"lessThan\":\"1341e4b32e1fb1b0acd002ccd56f07bd32f2abc6\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5899329b19100c0b82dc78e9b21ed8b920c9ffb3\",\"lessThan\":\"04c35ab3bdae7fefbd7c7a7355f29fa03a035221\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"arch/x86/mm/pat/memtype.c\",\"mm/memory.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2.6.29\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"2.6.29\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.19.312\",\"lessThanOrEqual\":\"4.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.274\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.215\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.155\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.85\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.26\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.8.5\",\"lessThanOrEqual\":\"6.8.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.9\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]},{\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\",\"affectedData\":[{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-01-16T21:13:41.454834Z\",\"id\":\"CVE-2024-35877\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-401\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.6.29\",\"versionEndExcluding\":\"4.19.312\",\"matchCriteriaId\":\"FC6D429D-BBC0-45CE-BDD8-A62B2EF8F67A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.20\",\"versionEndExcluding\":\"5.4.274\",\"matchCriteriaId\":\"F45A0F3C-C16D-49C4-86D6-D021C3D4B834\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.215\",\"matchCriteriaId\":\"9CD5894E-58E9-4B4A-B0F4-3E6BC134B8F5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.155\",\"matchCriteriaId\":\"F11B6314-A852-4FBD-AD84-ECE23F5C092B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.85\",\"matchCriteriaId\":\"325665BF-2409-49D9-B391-39AD4566FDBD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.26\",\"matchCriteriaId\":\"C520696A-A594-4FFC-A32D-12DA535CE911\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.8.5\",\"matchCriteriaId\":\"DBD6C99E-4250-4DFE-8447-FF2075939D10\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"22BEDD49-2C6D-402D-9DBF-6646F6ECD10B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"DF73CB2A-DFFD-46FB-9BFE-AA394F27EA37\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"07B237A9-69A3-4A9C-9DA0-4E06BD37AE73\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/04c35ab3bdae7fefbd7c7a7355f29fa03a035221\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/09e6bb53217bf388a0d2fd7fb21e74ab9dffc173\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/1341e4b32e1fb1b0acd002ccd56f07bd32f2abc6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/51b7841f3fe84606ec0bd8da859d22e05e5419ec\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7cfee26d1950250b14c5cb0a37b142f3fcc6396a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/97e93367e82752e475a33839a80b33bdbef1209f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c2b2430b48f3c9eaccd2c3d2ad75bb540d4952f4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f18681daaec9665a15c5e7e0f591aad5d0ac622b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/04c35ab3bdae7fefbd7c7a7355f29fa03a035221\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/09e6bb53217bf388a0d2fd7fb21e74ab9dffc173\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/1341e4b32e1fb1b0acd002ccd56f07bd32f2abc6\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/51b7841f3fe84606ec0bd8da859d22e05e5419ec\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7cfee26d1950250b14c5cb0a37b142f3fcc6396a\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/97e93367e82752e475a33839a80b33bdbef1209f\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c2b2430b48f3c9eaccd2c3d2ad75bb540d4952f4\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f18681daaec9665a15c5e7e0f591aad5d0ac622b\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://cert-portal.siemens.com/productcert/html/ssa-265688.html\",\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\"}]}}",
"redhat_vex": {
"aggregate_severity": "Moderate",
"current_release_date": "2026-06-28T11:09:10+00:00",
"cve": "CVE-2024-35877",
"id": "CVE-2024-35877",
"initial_release_date": "2024-05-19T00:00:00+00:00",
"product_status:fixed": "709",
"product_status:known_affected": "64",
"product_status:known_not_affected": "8",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "kernel: x86/mm/pat: fix VM_PAT handling in COW mappings",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-35877.json",
"version": "3"
},
"suse_vex": {
"aggregate_severity": "moderate",
"current_release_date": "2026-09-03T16:42:19Z",
"cve": "CVE-2024-35877",
"id": "CVE-2024-35877",
"initial_release_date": "2024-05-21T01:59:35Z",
"product_status:known_affected": "583",
"product_status:recommended": "770",
"source": "SUSE CSAF VEX",
"status": "interim",
"title": "SUSE CVE CVE-2024-35877",
"url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-35877.json",
"version": "95"
},
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/f18681daaec9665a15c5e7e0f591aad5d0ac622b\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/09e6bb53217bf388a0d2fd7fb21e74ab9dffc173\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/c2b2430b48f3c9eaccd2c3d2ad75bb540d4952f4\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/7cfee26d1950250b14c5cb0a37b142f3fcc6396a\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/97e93367e82752e475a33839a80b33bdbef1209f\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/51b7841f3fe84606ec0bd8da859d22e05e5419ec\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/1341e4b32e1fb1b0acd002ccd56f07bd32f2abc6\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/04c35ab3bdae7fefbd7c7a7355f29fa03a035221\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T03:21:48.797Z\"}}, {\"affected\": [{\"vendor\": \"Siemens\", \"product\": \"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}], \"x_adpType\": \"supplier\", \"references\": [{\"url\": \"https://cert-portal.siemens.com/productcert/html/ssa-265688.html\"}], \"providerMetadata\": {\"orgId\": \"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\", \"shortName\": \"siemens-SADP\", \"dateUpdated\": \"2026-05-12T11:52:17.843Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-35877\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-01-16T21:13:41.454834Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"description\": \"CWE-noinfo Not enough information\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-06-18T16:56:41.421Z\"}}], \"cna\": {\"title\": \"x86/mm/pat: fix VM_PAT handling in COW mappings\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5899329b19100c0b82dc78e9b21ed8b920c9ffb3\", \"lessThan\": \"f18681daaec9665a15c5e7e0f591aad5d0ac622b\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"5899329b19100c0b82dc78e9b21ed8b920c9ffb3\", \"lessThan\": \"09e6bb53217bf388a0d2fd7fb21e74ab9dffc173\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"5899329b19100c0b82dc78e9b21ed8b920c9ffb3\", \"lessThan\": \"c2b2430b48f3c9eaccd2c3d2ad75bb540d4952f4\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"5899329b19100c0b82dc78e9b21ed8b920c9ffb3\", \"lessThan\": \"7cfee26d1950250b14c5cb0a37b142f3fcc6396a\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"5899329b19100c0b82dc78e9b21ed8b920c9ffb3\", \"lessThan\": \"97e93367e82752e475a33839a80b33bdbef1209f\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"5899329b19100c0b82dc78e9b21ed8b920c9ffb3\", \"lessThan\": \"51b7841f3fe84606ec0bd8da859d22e05e5419ec\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"5899329b19100c0b82dc78e9b21ed8b920c9ffb3\", \"lessThan\": \"1341e4b32e1fb1b0acd002ccd56f07bd32f2abc6\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"5899329b19100c0b82dc78e9b21ed8b920c9ffb3\", \"lessThan\": \"04c35ab3bdae7fefbd7c7a7355f29fa03a035221\", \"versionType\": \"git\"}], \"programFiles\": [\"arch/x86/mm/pat/memtype.c\", \"mm/memory.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"2.6.29\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"2.6.29\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"4.19.312\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.19.*\"}, {\"status\": \"unaffected\", \"version\": \"5.4.274\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.215\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.155\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.85\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.26\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8.5\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.8.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"arch/x86/mm/pat/memtype.c\", \"mm/memory.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/f18681daaec9665a15c5e7e0f591aad5d0ac622b\"}, {\"url\": \"https://git.kernel.org/stable/c/09e6bb53217bf388a0d2fd7fb21e74ab9dffc173\"}, {\"url\": \"https://git.kernel.org/stable/c/c2b2430b48f3c9eaccd2c3d2ad75bb540d4952f4\"}, {\"url\": \"https://git.kernel.org/stable/c/7cfee26d1950250b14c5cb0a37b142f3fcc6396a\"}, {\"url\": \"https://git.kernel.org/stable/c/97e93367e82752e475a33839a80b33bdbef1209f\"}, {\"url\": \"https://git.kernel.org/stable/c/51b7841f3fe84606ec0bd8da859d22e05e5419ec\"}, {\"url\": \"https://git.kernel.org/stable/c/1341e4b32e1fb1b0acd002ccd56f07bd32f2abc6\"}, {\"url\": \"https://git.kernel.org/stable/c/04c35ab3bdae7fefbd7c7a7355f29fa03a035221\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nx86/mm/pat: fix VM_PAT handling in COW mappings\\n\\nPAT handling won\u0027t do the right thing in COW mappings: the first PTE (or,\\nin fact, all PTEs) can be replaced during write faults to point at anon\\nfolios. Reliably recovering the correct PFN and cachemode using\\nfollow_phys() from PTEs will not work in COW mappings.\\n\\nUsing follow_phys(), we might just get the address+protection of the anon\\nfolio (which is very wrong), or fail on swap/nonswap entries, failing\\nfollow_phys() and triggering a WARN_ON_ONCE() in untrack_pfn() and\\ntrack_pfn_copy(), not properly calling free_pfn_range().\\n\\nIn free_pfn_range(), we either wouldn\u0027t call memtype_free() or would call\\nit with the wrong range, possibly leaking memory.\\n\\nTo fix that, let\u0027s update follow_phys() to refuse returning anon folios,\\nand fallback to using the stored PFN inside vma-\u003evm_pgoff for COW mappings\\nif we run into that.\\n\\nWe will now properly handle untrack_pfn() with COW mappings, where we\\ndon\u0027t need the cachemode. We\u0027ll have to fail fork()-\u003etrack_pfn_copy() if\\nthe first page was replaced by an anon folio, though: we\u0027d have to store\\nthe cachemode in the VMA to make this work, likely growing the VMA size.\\n\\nFor now, lets keep it simple and let track_pfn_copy() just fail in that\\ncase: it would have failed in the past with swap/nonswap entries already,\\nand it would have done the wrong thing with anon folios.\\n\\nSimple reproducer to trigger the WARN_ON_ONCE() in untrack_pfn():\\n\\n\u003c--- C reproducer ---\u003e\\n #include \u003cstdio.h\u003e\\n #include \u003csys/mman.h\u003e\\n #include \u003cunistd.h\u003e\\n #include \u003cliburing.h\u003e\\n\\n int main(void)\\n {\\n struct io_uring_params p = {};\\n int ring_fd;\\n size_t size;\\n char *map;\\n\\n ring_fd = io_uring_setup(1, \u0026p);\\n if (ring_fd \u003c 0) {\\n perror(\\\"io_uring_setup\\\");\\n return 1;\\n }\\n size = p.sq_off.array + p.sq_entries * sizeof(unsigned);\\n\\n /* Map the submission queue ring MAP_PRIVATE */\\n map = mmap(0, size, PROT_READ | PROT_WRITE, MAP_PRIVATE,\\n ring_fd, IORING_OFF_SQ_RING);\\n if (map == MAP_FAILED) {\\n perror(\\\"mmap\\\");\\n return 1;\\n }\\n\\n /* We have at least one page. Let\u0027s COW it. */\\n *map = 0;\\n pause();\\n return 0;\\n }\\n\u003c--- C reproducer ---\u003e\\n\\nOn a system with 16 GiB RAM and swap configured:\\n # ./iouring \u0026\\n # memhog 16G\\n # killall iouring\\n[ 301.552930] ------------[ cut here ]------------\\n[ 301.553285] WARNING: CPU: 7 PID: 1402 at arch/x86/mm/pat/memtype.c:1060 untrack_pfn+0xf4/0x100\\n[ 301.553989] Modules linked in: binfmt_misc nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_g\\n[ 301.558232] CPU: 7 PID: 1402 Comm: iouring Not tainted 6.7.5-100.fc38.x86_64 #1\\n[ 301.558772] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebu4\\n[ 301.559569] RIP: 0010:untrack_pfn+0xf4/0x100\\n[ 301.559893] Code: 75 c4 eb cf 48 8b 43 10 8b a8 e8 00 00 00 3b 6b 28 74 b8 48 8b 7b 30 e8 ea 1a f7 000\\n[ 301.561189] RSP: 0018:ffffba2c0377fab8 EFLAGS: 00010282\\n[ 301.561590] RAX: 00000000ffffffea RBX: ffff9208c8ce9cc0 RCX: 000000010455e047\\n[ 301.562105] RDX: 07fffffff0eb1e0a RSI: 0000000000000000 RDI: ffff9208c391d200\\n[ 301.562628] RBP: 0000000000000000 R08: ffffba2c0377fab8 R09: 0000000000000000\\n[ 301.563145] R10: ffff9208d2292d50 R11: 0000000000000002 R12: 00007fea890e0000\\n[ 301.563669] R13: 0000000000000000 R14: ffffba2c0377fc08 R15: 0000000000000000\\n[ 301.564186] FS: 0000000000000000(0000) GS:ffff920c2fbc0000(0000) knlGS:0000000000000000\\n[ 301.564773] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\n[ 301.565197] CR2: 00007fea88ee8a20 CR3: 00000001033a8000 CR4: 0000000000750ef0\\n[ 301.565725] PKRU: 55555554\\n[ 301.565944] Call Trace:\\n[ 301.566148] \u003cTASK\u003e\\n[ 301.566325] ? untrack_pfn+0xf4/0x100\\n[ 301.566618] ? __warn+0x81/0x130\\n[ 301.566876] ? untrack_pfn+0xf4/0x100\\n[ 3\\n---truncated---\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.19.312\", \"versionStartIncluding\": \"2.6.29\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.274\", \"versionStartIncluding\": \"2.6.29\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.215\", \"versionStartIncluding\": \"2.6.29\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.155\", \"versionStartIncluding\": \"2.6.29\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.85\", \"versionStartIncluding\": \"2.6.29\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.26\", \"versionStartIncluding\": \"2.6.29\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8.5\", \"versionStartIncluding\": \"2.6.29\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9\", \"versionStartIncluding\": \"2.6.29\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-11T20:12:58.539Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2024-35877\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-12T11:52:17.843Z\", \"dateReserved\": \"2024-05-17T13:50:33.110Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-05-19T08:34:34.604Z\", \"assignerShortName\": \"Linux\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…