GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-35877 (GCVE-0-2024-35877)

Vulnerability from cvelistv5 – Published: 2024-05-19 08:34 – Updated: 2026-05-12 11:52
VLAI
Title
x86/mm/pat: fix VM_PAT handling in COW mappings
Summary
In the Linux kernel, the following vulnerability has been resolved: x86/mm/pat: fix VM_PAT handling in COW mappings PAT handling won't do the right thing in COW mappings: the first PTE (or, in fact, all PTEs) can be replaced during write faults to point at anon folios. Reliably recovering the correct PFN and cachemode using follow_phys() from PTEs will not work in COW mappings. Using follow_phys(), we might just get the address+protection of the anon folio (which is very wrong), or fail on swap/nonswap entries, failing follow_phys() and triggering a WARN_ON_ONCE() in untrack_pfn() and track_pfn_copy(), not properly calling free_pfn_range(). In free_pfn_range(), we either wouldn't call memtype_free() or would call it with the wrong range, possibly leaking memory. To fix that, let's update follow_phys() to refuse returning anon folios, and fallback to using the stored PFN inside vma->vm_pgoff for COW mappings if we run into that. We will now properly handle untrack_pfn() with COW mappings, where we don't need the cachemode. We'll have to fail fork()->track_pfn_copy() if the first page was replaced by an anon folio, though: we'd have to store the cachemode in the VMA to make this work, likely growing the VMA size. For now, lets keep it simple and let track_pfn_copy() just fail in that case: it would have failed in the past with swap/nonswap entries already, and it would have done the wrong thing with anon folios. Simple reproducer to trigger the WARN_ON_ONCE() in untrack_pfn(): <--- C reproducer ---> #include <stdio.h> #include <sys/mman.h> #include <unistd.h> #include <liburing.h> int main(void) { struct io_uring_params p = {}; int ring_fd; size_t size; char *map; ring_fd = io_uring_setup(1, &p); if (ring_fd < 0) { perror("io_uring_setup"); return 1; } size = p.sq_off.array + p.sq_entries * sizeof(unsigned); /* Map the submission queue ring MAP_PRIVATE */ map = mmap(0, size, PROT_READ | PROT_WRITE, MAP_PRIVATE, ring_fd, IORING_OFF_SQ_RING); if (map == MAP_FAILED) { perror("mmap"); return 1; } /* We have at least one page. Let's COW it. */ *map = 0; pause(); return 0; } <--- C reproducer ---> On a system with 16 GiB RAM and swap configured: # ./iouring & # memhog 16G # killall iouring [ 301.552930] ------------[ cut here ]------------ [ 301.553285] WARNING: CPU: 7 PID: 1402 at arch/x86/mm/pat/memtype.c:1060 untrack_pfn+0xf4/0x100 [ 301.553989] Modules linked in: binfmt_misc nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_g [ 301.558232] CPU: 7 PID: 1402 Comm: iouring Not tainted 6.7.5-100.fc38.x86_64 #1 [ 301.558772] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebu4 [ 301.559569] RIP: 0010:untrack_pfn+0xf4/0x100 [ 301.559893] Code: 75 c4 eb cf 48 8b 43 10 8b a8 e8 00 00 00 3b 6b 28 74 b8 48 8b 7b 30 e8 ea 1a f7 000 [ 301.561189] RSP: 0018:ffffba2c0377fab8 EFLAGS: 00010282 [ 301.561590] RAX: 00000000ffffffea RBX: ffff9208c8ce9cc0 RCX: 000000010455e047 [ 301.562105] RDX: 07fffffff0eb1e0a RSI: 0000000000000000 RDI: ffff9208c391d200 [ 301.562628] RBP: 0000000000000000 R08: ffffba2c0377fab8 R09: 0000000000000000 [ 301.563145] R10: ffff9208d2292d50 R11: 0000000000000002 R12: 00007fea890e0000 [ 301.563669] R13: 0000000000000000 R14: ffffba2c0377fc08 R15: 0000000000000000 [ 301.564186] FS: 0000000000000000(0000) GS:ffff920c2fbc0000(0000) knlGS:0000000000000000 [ 301.564773] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 301.565197] CR2: 00007fea88ee8a20 CR3: 00000001033a8000 CR4: 0000000000750ef0 [ 301.565725] PKRU: 55555554 [ 301.565944] Call Trace: [ 301.566148] <TASK> [ 301.566325] ? untrack_pfn+0xf4/0x100 [ 301.566618] ? __warn+0x81/0x130 [ 301.566876] ? untrack_pfn+0xf4/0x100 [ 3 ---truncated---
Severity
No CVSS data available.
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-01-16 21:13 UTC
CWE
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 5899329b19100c0b82dc78e9b21ed8b920c9ffb3 , < f18681daaec9665a15c5e7e0f591aad5d0ac622b (git)
Affected: 5899329b19100c0b82dc78e9b21ed8b920c9ffb3 , < 09e6bb53217bf388a0d2fd7fb21e74ab9dffc173 (git)
Affected: 5899329b19100c0b82dc78e9b21ed8b920c9ffb3 , < c2b2430b48f3c9eaccd2c3d2ad75bb540d4952f4 (git)
Affected: 5899329b19100c0b82dc78e9b21ed8b920c9ffb3 , < 7cfee26d1950250b14c5cb0a37b142f3fcc6396a (git)
Affected: 5899329b19100c0b82dc78e9b21ed8b920c9ffb3 , < 97e93367e82752e475a33839a80b33bdbef1209f (git)
Affected: 5899329b19100c0b82dc78e9b21ed8b920c9ffb3 , < 51b7841f3fe84606ec0bd8da859d22e05e5419ec (git)
Affected: 5899329b19100c0b82dc78e9b21ed8b920c9ffb3 , < 1341e4b32e1fb1b0acd002ccd56f07bd32f2abc6 (git)
Affected: 5899329b19100c0b82dc78e9b21ed8b920c9ffb3 , < 04c35ab3bdae7fefbd7c7a7355f29fa03a035221 (git)
guessed Create a notification for this product.
Linux Linux Affected: 2.6.29
Unaffected: 0 , < 2.6.29 (semver)
Unaffected: 4.19.312 , ≤ 4.19.* (semver)
Unaffected: 5.4.274 , ≤ 5.4.* (semver)
Unaffected: 5.10.215 , ≤ 5.10.* (semver)
Unaffected: 5.15.155 , ≤ 5.15.* (semver)
Unaffected: 6.1.85 , ≤ 6.1.* (semver)
Unaffected: 6.6.26 , ≤ 6.6.* (semver)
Unaffected: 6.8.5 , ≤ 6.8.* (semver)
Unaffected: 6.9 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem Affected: 0 , < * (custom)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-35877",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-01-16T21:13:41.454834Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-01-16T21:14:37.162Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T03:21:48.797Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/f18681daaec9665a15c5e7e0f591aad5d0ac622b"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/09e6bb53217bf388a0d2fd7fb21e74ab9dffc173"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/c2b2430b48f3c9eaccd2c3d2ad75bb540d4952f4"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/7cfee26d1950250b14c5cb0a37b142f3fcc6396a"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/97e93367e82752e475a33839a80b33bdbef1209f"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/51b7841f3fe84606ec0bd8da859d22e05e5419ec"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/1341e4b32e1fb1b0acd002ccd56f07bd32f2abc6"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/04c35ab3bdae7fefbd7c7a7355f29fa03a035221"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-12T11:52:17.843Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/mm/pat/memtype.c",
            "mm/memory.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f18681daaec9665a15c5e7e0f591aad5d0ac622b",
              "status": "affected",
              "version": "5899329b19100c0b82dc78e9b21ed8b920c9ffb3",
              "versionType": "git"
            },
            {
              "lessThan": "09e6bb53217bf388a0d2fd7fb21e74ab9dffc173",
              "status": "affected",
              "version": "5899329b19100c0b82dc78e9b21ed8b920c9ffb3",
              "versionType": "git"
            },
            {
              "lessThan": "c2b2430b48f3c9eaccd2c3d2ad75bb540d4952f4",
              "status": "affected",
              "version": "5899329b19100c0b82dc78e9b21ed8b920c9ffb3",
              "versionType": "git"
            },
            {
              "lessThan": "7cfee26d1950250b14c5cb0a37b142f3fcc6396a",
              "status": "affected",
              "version": "5899329b19100c0b82dc78e9b21ed8b920c9ffb3",
              "versionType": "git"
            },
            {
              "lessThan": "97e93367e82752e475a33839a80b33bdbef1209f",
              "status": "affected",
              "version": "5899329b19100c0b82dc78e9b21ed8b920c9ffb3",
              "versionType": "git"
            },
            {
              "lessThan": "51b7841f3fe84606ec0bd8da859d22e05e5419ec",
              "status": "affected",
              "version": "5899329b19100c0b82dc78e9b21ed8b920c9ffb3",
              "versionType": "git"
            },
            {
              "lessThan": "1341e4b32e1fb1b0acd002ccd56f07bd32f2abc6",
              "status": "affected",
              "version": "5899329b19100c0b82dc78e9b21ed8b920c9ffb3",
              "versionType": "git"
            },
            {
              "lessThan": "04c35ab3bdae7fefbd7c7a7355f29fa03a035221",
              "status": "affected",
              "version": "5899329b19100c0b82dc78e9b21ed8b920c9ffb3",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/mm/pat/memtype.c",
            "mm/memory.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.29"
            },
            {
              "lessThan": "2.6.29",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.312",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.274",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.215",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.155",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.85",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.26",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.312",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.274",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.215",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.155",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.85",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.26",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.5",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/mm/pat: fix VM_PAT handling in COW mappings\n\nPAT handling won\u0027t do the right thing in COW mappings: the first PTE (or,\nin fact, all PTEs) can be replaced during write faults to point at anon\nfolios.  Reliably recovering the correct PFN and cachemode using\nfollow_phys() from PTEs will not work in COW mappings.\n\nUsing follow_phys(), we might just get the address+protection of the anon\nfolio (which is very wrong), or fail on swap/nonswap entries, failing\nfollow_phys() and triggering a WARN_ON_ONCE() in untrack_pfn() and\ntrack_pfn_copy(), not properly calling free_pfn_range().\n\nIn free_pfn_range(), we either wouldn\u0027t call memtype_free() or would call\nit with the wrong range, possibly leaking memory.\n\nTo fix that, let\u0027s update follow_phys() to refuse returning anon folios,\nand fallback to using the stored PFN inside vma-\u003evm_pgoff for COW mappings\nif we run into that.\n\nWe will now properly handle untrack_pfn() with COW mappings, where we\ndon\u0027t need the cachemode.  We\u0027ll have to fail fork()-\u003etrack_pfn_copy() if\nthe first page was replaced by an anon folio, though: we\u0027d have to store\nthe cachemode in the VMA to make this work, likely growing the VMA size.\n\nFor now, lets keep it simple and let track_pfn_copy() just fail in that\ncase: it would have failed in the past with swap/nonswap entries already,\nand it would have done the wrong thing with anon folios.\n\nSimple reproducer to trigger the WARN_ON_ONCE() in untrack_pfn():\n\n\u003c--- C reproducer ---\u003e\n #include \u003cstdio.h\u003e\n #include \u003csys/mman.h\u003e\n #include \u003cunistd.h\u003e\n #include \u003cliburing.h\u003e\n\n int main(void)\n {\n         struct io_uring_params p = {};\n         int ring_fd;\n         size_t size;\n         char *map;\n\n         ring_fd = io_uring_setup(1, \u0026p);\n         if (ring_fd \u003c 0) {\n                 perror(\"io_uring_setup\");\n                 return 1;\n         }\n         size = p.sq_off.array + p.sq_entries * sizeof(unsigned);\n\n         /* Map the submission queue ring MAP_PRIVATE */\n         map = mmap(0, size, PROT_READ | PROT_WRITE, MAP_PRIVATE,\n                    ring_fd, IORING_OFF_SQ_RING);\n         if (map == MAP_FAILED) {\n                 perror(\"mmap\");\n                 return 1;\n         }\n\n         /* We have at least one page. Let\u0027s COW it. */\n         *map = 0;\n         pause();\n         return 0;\n }\n\u003c--- C reproducer ---\u003e\n\nOn a system with 16 GiB RAM and swap configured:\n # ./iouring \u0026\n # memhog 16G\n # killall iouring\n[  301.552930] ------------[ cut here ]------------\n[  301.553285] WARNING: CPU: 7 PID: 1402 at arch/x86/mm/pat/memtype.c:1060 untrack_pfn+0xf4/0x100\n[  301.553989] Modules linked in: binfmt_misc nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_g\n[  301.558232] CPU: 7 PID: 1402 Comm: iouring Not tainted 6.7.5-100.fc38.x86_64 #1\n[  301.558772] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebu4\n[  301.559569] RIP: 0010:untrack_pfn+0xf4/0x100\n[  301.559893] Code: 75 c4 eb cf 48 8b 43 10 8b a8 e8 00 00 00 3b 6b 28 74 b8 48 8b 7b 30 e8 ea 1a f7 000\n[  301.561189] RSP: 0018:ffffba2c0377fab8 EFLAGS: 00010282\n[  301.561590] RAX: 00000000ffffffea RBX: ffff9208c8ce9cc0 RCX: 000000010455e047\n[  301.562105] RDX: 07fffffff0eb1e0a RSI: 0000000000000000 RDI: ffff9208c391d200\n[  301.562628] RBP: 0000000000000000 R08: ffffba2c0377fab8 R09: 0000000000000000\n[  301.563145] R10: ffff9208d2292d50 R11: 0000000000000002 R12: 00007fea890e0000\n[  301.563669] R13: 0000000000000000 R14: ffffba2c0377fc08 R15: 0000000000000000\n[  301.564186] FS:  0000000000000000(0000) GS:ffff920c2fbc0000(0000) knlGS:0000000000000000\n[  301.564773] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[  301.565197] CR2: 00007fea88ee8a20 CR3: 00000001033a8000 CR4: 0000000000750ef0\n[  301.565725] PKRU: 55555554\n[  301.565944] Call Trace:\n[  301.566148]  \u003cTASK\u003e\n[  301.566325]  ? untrack_pfn+0xf4/0x100\n[  301.566618]  ? __warn+0x81/0x130\n[  301.566876]  ? untrack_pfn+0xf4/0x100\n[  3\n---truncated---"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T20:12:58.539Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f18681daaec9665a15c5e7e0f591aad5d0ac622b"
        },
        {
          "url": "https://git.kernel.org/stable/c/09e6bb53217bf388a0d2fd7fb21e74ab9dffc173"
        },
        {
          "url": "https://git.kernel.org/stable/c/c2b2430b48f3c9eaccd2c3d2ad75bb540d4952f4"
        },
        {
          "url": "https://git.kernel.org/stable/c/7cfee26d1950250b14c5cb0a37b142f3fcc6396a"
        },
        {
          "url": "https://git.kernel.org/stable/c/97e93367e82752e475a33839a80b33bdbef1209f"
        },
        {
          "url": "https://git.kernel.org/stable/c/51b7841f3fe84606ec0bd8da859d22e05e5419ec"
        },
        {
          "url": "https://git.kernel.org/stable/c/1341e4b32e1fb1b0acd002ccd56f07bd32f2abc6"
        },
        {
          "url": "https://git.kernel.org/stable/c/04c35ab3bdae7fefbd7c7a7355f29fa03a035221"
        }
      ],
      "title": "x86/mm/pat: fix VM_PAT handling in COW mappings",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-35877",
    "datePublished": "2024-05-19T08:34:34.604Z",
    "dateReserved": "2024-05-17T13:50:33.110Z",
    "dateUpdated": "2026-05-12T11:52:17.843Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-35877",
      "date": "2026-09-16",
      "epss": "0.00254",
      "percentile": "0.17083"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nx86/mm/pat: fix VM_PAT handling in COW mappings\\n\\nPAT handling won\u0027t do the right thing in COW mappings: the first PTE (or,\\nin fact, all PTEs) can be replaced during write faults to point at anon\\nfolios.  Reliably recovering the correct PFN and cachemode using\\nfollow_phys() from PTEs will not work in COW mappings.\\n\\nUsing follow_phys(), we might just get the address+protection of the anon\\nfolio (which is very wrong), or fail on swap/nonswap entries, failing\\nfollow_phys() and triggering a WARN_ON_ONCE() in untrack_pfn() and\\ntrack_pfn_copy(), not properly calling free_pfn_range().\\n\\nIn free_pfn_range(), we either wouldn\u0027t call memtype_free() or would call\\nit with the wrong range, possibly leaking memory.\\n\\nTo fix that, let\u0027s update follow_phys() to refuse returning anon folios,\\nand fallback to using the stored PFN inside vma-\u003evm_pgoff for COW mappings\\nif we run into that.\\n\\nWe will now properly handle untrack_pfn() with COW mappings, where we\\ndon\u0027t need the cachemode.  We\u0027ll have to fail fork()-\u003etrack_pfn_copy() if\\nthe first page was replaced by an anon folio, though: we\u0027d have to store\\nthe cachemode in the VMA to make this work, likely growing the VMA size.\\n\\nFor now, lets keep it simple and let track_pfn_copy() just fail in that\\ncase: it would have failed in the past with swap/nonswap entries already,\\nand it would have done the wrong thing with anon folios.\\n\\nSimple reproducer to trigger the WARN_ON_ONCE() in untrack_pfn():\\n\\n\u003c--- C reproducer ---\u003e\\n #include \u003cstdio.h\u003e\\n #include \u003csys/mman.h\u003e\\n #include \u003cunistd.h\u003e\\n #include \u003cliburing.h\u003e\\n\\n int main(void)\\n {\\n         struct io_uring_params p = {};\\n         int ring_fd;\\n         size_t size;\\n         char *map;\\n\\n         ring_fd = io_uring_setup(1, \u0026p);\\n         if (ring_fd \u003c 0) {\\n                 perror(\\\"io_uring_setup\\\");\\n                 return 1;\\n         }\\n         size = p.sq_off.array + p.sq_entries * sizeof(unsigned);\\n\\n         /* Map the submission queue ring MAP_PRIVATE */\\n         map = mmap(0, size, PROT_READ | PROT_WRITE, MAP_PRIVATE,\\n                    ring_fd, IORING_OFF_SQ_RING);\\n         if (map == MAP_FAILED) {\\n                 perror(\\\"mmap\\\");\\n                 return 1;\\n         }\\n\\n         /* We have at least one page. Let\u0027s COW it. */\\n         *map = 0;\\n         pause();\\n         return 0;\\n }\\n\u003c--- C reproducer ---\u003e\\n\\nOn a system with 16 GiB RAM and swap configured:\\n # ./iouring \u0026\\n # memhog 16G\\n # killall iouring\\n[  301.552930] ------------[ cut here ]------------\\n[  301.553285] WARNING: CPU: 7 PID: 1402 at arch/x86/mm/pat/memtype.c:1060 untrack_pfn+0xf4/0x100\\n[  301.553989] Modules linked in: binfmt_misc nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_g\\n[  301.558232] CPU: 7 PID: 1402 Comm: iouring Not tainted 6.7.5-100.fc38.x86_64 #1\\n[  301.558772] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebu4\\n[  301.559569] RIP: 0010:untrack_pfn+0xf4/0x100\\n[  301.559893] Code: 75 c4 eb cf 48 8b 43 10 8b a8 e8 00 00 00 3b 6b 28 74 b8 48 8b 7b 30 e8 ea 1a f7 000\\n[  301.561189] RSP: 0018:ffffba2c0377fab8 EFLAGS: 00010282\\n[  301.561590] RAX: 00000000ffffffea RBX: ffff9208c8ce9cc0 RCX: 000000010455e047\\n[  301.562105] RDX: 07fffffff0eb1e0a RSI: 0000000000000000 RDI: ffff9208c391d200\\n[  301.562628] RBP: 0000000000000000 R08: ffffba2c0377fab8 R09: 0000000000000000\\n[  301.563145] R10: ffff9208d2292d50 R11: 0000000000000002 R12: 00007fea890e0000\\n[  301.563669] R13: 0000000000000000 R14: ffffba2c0377fc08 R15: 0000000000000000\\n[  301.564186] FS:  0000000000000000(0000) GS:ffff920c2fbc0000(0000) knlGS:0000000000000000\\n[  301.564773] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\n[  301.565197] CR2: 00007fea88ee8a20 CR3: 00000001033a8000 CR4: 0000000000750ef0\\n[  301.565725] PKRU: 55555554\\n[  301.565944] Call Trace:\\n[  301.566148]  \u003cTASK\u003e\\n[  301.566325]  ? untrack_pfn+0xf4/0x100\\n[  301.566618]  ? __warn+0x81/0x130\\n[  301.566876]  ? untrack_pfn+0xf4/0x100\\n[  3\\n---truncated---\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: x86/mm/pat: corrige el manejo de VM_PAT en asignaciones COW El manejo de PAT no funcionar\\u00e1 correctamente en las asignaciones COW: la primera PTE (o, de hecho, todas las PTE) pueden ser reemplazado durante fallos de escritura para se\\u00f1alar folios an\\u00f3nimos. Recuperar de manera confiable el PFN y el modo de cach\\u00e9 correctos usando follow_phys() de las PTE no funcionar\\u00e1 en las asignaciones COW. Usando follow_phys(), podr\\u00edamos obtener la direcci\\u00f3n+protecci\\u00f3n de la publicaci\\u00f3n an\\u00f3nima (lo cual es muy incorrecto), o fallar en las entradas de intercambio/no intercambio, fallando en follow_phys() y activando un WARN_ON_ONCE() en untrack_pfn() y track_pfn_copy() , no llamando correctamente a free_pfn_range(). En free_pfn_range(), no llamar\\u00edamos a memtype_free() o lo llamar\\u00edamos con el rango incorrecto, posiblemente perdiendo memoria. Para solucionarlo, actualicemos follow_phys() para rechazar la devoluci\\u00f3n de publicaciones an\\u00f3nimas y recurramos al uso del PFN almacenado dentro de vma-\u0026gt;vm_pgoff para asignaciones COW si nos encontramos con eso. Ahora manejaremos adecuadamente untrack_pfn() con asignaciones COW, donde no necesitamos el modo cach\\u00e9. Sin embargo, tendremos que fallar fork()-\u0026gt;track_pfn_copy() si la primera p\\u00e1gina fue reemplazada por una publicaci\\u00f3n an\\u00f3nima: tendr\\u00edamos que almacenar el modo de cach\\u00e9 en el VMA para que esto funcione, probablemente aumentando el tama\\u00f1o del VMA. Por ahora, manteng\\u00e1moslo simple y dejemos que track_pfn_copy() simplemente falle en ese caso: ya habr\\u00eda fallado en el pasado con entradas de intercambio/no intercambio, y habr\\u00eda hecho algo incorrecto con folios an\\u00f3nimos. Reproductor simple para activar WARN_ON_ONCE() en untrack_pfn(): \u0026lt;--- Reproductor C ---\u0026gt; #include  #include  #include  #include  int main(void) { struct io_uring_params p = {}; int anillo_fd; tama\\u00f1o_t tama\\u00f1o; carb\\u00f3n *mapa; ring_fd = io_uring_setup(1, \u0026amp;p); if (ring_fd \u0026lt; 0) { perror(\\\"io_uring_setup\\\"); devolver 1; } tama\\u00f1o = p.sq_off.array + p.sq_entries * tama\\u00f1o de (sin firmar); /* Asigna el anillo de cola de env\\u00edo MAP_PRIVATE */ map = mmap(0, size, PROT_READ | PROT_WRITE, MAP_PRIVATE, ring_fd, IORING_OFF_SQ_RING); if (mapa == MAP_FAILED) { perror(\\\"mmap\\\"); devolver 1; } /* Tenemos al menos una p\\u00e1gina. Vamos a acobardarnos. */ *mapa = 0; pausa(); devolver 0; } \u0026lt;--- Reproductor C ---\u0026gt; En un sistema con 16 GiB de RAM y swap configurado: # ./iouring \u0026amp; # memhog 16G # killall iouring [ 301.552930] ------------[ cut aqu\\u00ed ]------------ [ 301.553285] ADVERTENCIA: CPU: 7 PID: 1402 en arch/x86/mm/pat/memtype.c:1060 untrack_pfn+0xf4/0x100 [ 301.553989] M\\u00f3dulos vinculados en : binfmt_misc nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_g [ 301.558232] CPU: 7 PID: 1402 Comm: iouring No contaminado 6.7.5-100.fc38.x86_64 #1 [ 301.558772] Nombre del hardware: PC est\\u00e1ndar QEMU (Q35 + ICH9, 2009), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebu4 [ 301.559569] RIP: 0010:untrack_pfn+0xf4/0x100 [ 301.559893] C\\u00f3digo: 75 c4 eb cf 48 8b 43 10 8b a8 e8 00 00 00 3b b 28 74 b8 48 8b 7b 30 e8 ea 1a f7 000 [ 301.561189] RSP: 0018:ffffba2c0377fab8 EFLAGS: 00010282 [ 301.561590] RAX: 00000000ffffffea RBX: ffff9208c8ce9cc0 RCX: 455e047 [301.562105] RDX: 07fffffff0eb1e0a RSI: 0000000000000000 RDI: ffff9208c391d200 [301.562628] RBP: 0000000000000000 R08: 8 R09: 0000000000000000 [ 301.563145] R10: ffff9208d2292d50 R11: 0000000000000002 R12: 00007fea890e0000 [ 301.563669] R13: 00000 R14: ffffba2c0377fc08 R15: 00000000000000000 [ 301.564186] FS: 0000000000000000(0000) GS:ffff920c2fbc0000(0000) knlGS:0000000000000000 0 [301.564773] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 301.565197] CR2: 00007fea88ee8a20 CR3: 00000001033a8000 CR4: 0000000000750ef0 [ 301.565725] KRU: 55555554 [ 301.565944] Seguimiento de llamadas: [ 301.566148]  [ 301.566325] ? untrack_pfn+0xf4/0x100 [301.566618]? __advertir+0x81/0x130 [ 301.566876] ? untrack_pfn+0xf4/0x100 [ 3 ---truncado---\"}]",
      "id": "CVE-2024-35877",
      "lastModified": "2024-11-21T09:21:06.417",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 5.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 3.6}]}",
      "published": "2024-05-19T09:15:08.990",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/04c35ab3bdae7fefbd7c7a7355f29fa03a035221\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/09e6bb53217bf388a0d2fd7fb21e74ab9dffc173\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/1341e4b32e1fb1b0acd002ccd56f07bd32f2abc6\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/51b7841f3fe84606ec0bd8da859d22e05e5419ec\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/7cfee26d1950250b14c5cb0a37b142f3fcc6396a\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/97e93367e82752e475a33839a80b33bdbef1209f\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/c2b2430b48f3c9eaccd2c3d2ad75bb540d4952f4\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/f18681daaec9665a15c5e7e0f591aad5d0ac622b\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/04c35ab3bdae7fefbd7c7a7355f29fa03a035221\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/09e6bb53217bf388a0d2fd7fb21e74ab9dffc173\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/1341e4b32e1fb1b0acd002ccd56f07bd32f2abc6\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/51b7841f3fe84606ec0bd8da859d22e05e5419ec\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/7cfee26d1950250b14c5cb0a37b142f3fcc6396a\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/97e93367e82752e475a33839a80b33bdbef1209f\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/c2b2430b48f3c9eaccd2c3d2ad75bb540d4952f4\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/f18681daaec9665a15c5e7e0f591aad5d0ac622b\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-35877\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-19T09:15:08.990\",\"lastModified\":\"2026-06-17T07:35:36.967\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nx86/mm/pat: fix VM_PAT handling in COW mappings\\n\\nPAT handling won\u0027t do the right thing in COW mappings: the first PTE (or,\\nin fact, all PTEs) can be replaced during write faults to point at anon\\nfolios.  Reliably recovering the correct PFN and cachemode using\\nfollow_phys() from PTEs will not work in COW mappings.\\n\\nUsing follow_phys(), we might just get the address+protection of the anon\\nfolio (which is very wrong), or fail on swap/nonswap entries, failing\\nfollow_phys() and triggering a WARN_ON_ONCE() in untrack_pfn() and\\ntrack_pfn_copy(), not properly calling free_pfn_range().\\n\\nIn free_pfn_range(), we either wouldn\u0027t call memtype_free() or would call\\nit with the wrong range, possibly leaking memory.\\n\\nTo fix that, let\u0027s update follow_phys() to refuse returning anon folios,\\nand fallback to using the stored PFN inside vma-\u003evm_pgoff for COW mappings\\nif we run into that.\\n\\nWe will now properly handle untrack_pfn() with COW mappings, where we\\ndon\u0027t need the cachemode.  We\u0027ll have to fail fork()-\u003etrack_pfn_copy() if\\nthe first page was replaced by an anon folio, though: we\u0027d have to store\\nthe cachemode in the VMA to make this work, likely growing the VMA size.\\n\\nFor now, lets keep it simple and let track_pfn_copy() just fail in that\\ncase: it would have failed in the past with swap/nonswap entries already,\\nand it would have done the wrong thing with anon folios.\\n\\nSimple reproducer to trigger the WARN_ON_ONCE() in untrack_pfn():\\n\\n\u003c--- C reproducer ---\u003e\\n #include \u003cstdio.h\u003e\\n #include \u003csys/mman.h\u003e\\n #include \u003cunistd.h\u003e\\n #include \u003cliburing.h\u003e\\n\\n int main(void)\\n {\\n         struct io_uring_params p = {};\\n         int ring_fd;\\n         size_t size;\\n         char *map;\\n\\n         ring_fd = io_uring_setup(1, \u0026p);\\n         if (ring_fd \u003c 0) {\\n                 perror(\\\"io_uring_setup\\\");\\n                 return 1;\\n         }\\n         size = p.sq_off.array + p.sq_entries * sizeof(unsigned);\\n\\n         /* Map the submission queue ring MAP_PRIVATE */\\n         map = mmap(0, size, PROT_READ | PROT_WRITE, MAP_PRIVATE,\\n                    ring_fd, IORING_OFF_SQ_RING);\\n         if (map == MAP_FAILED) {\\n                 perror(\\\"mmap\\\");\\n                 return 1;\\n         }\\n\\n         /* We have at least one page. Let\u0027s COW it. */\\n         *map = 0;\\n         pause();\\n         return 0;\\n }\\n\u003c--- C reproducer ---\u003e\\n\\nOn a system with 16 GiB RAM and swap configured:\\n # ./iouring \u0026\\n # memhog 16G\\n # killall iouring\\n[  301.552930] ------------[ cut here ]------------\\n[  301.553285] WARNING: CPU: 7 PID: 1402 at arch/x86/mm/pat/memtype.c:1060 untrack_pfn+0xf4/0x100\\n[  301.553989] Modules linked in: binfmt_misc nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_g\\n[  301.558232] CPU: 7 PID: 1402 Comm: iouring Not tainted 6.7.5-100.fc38.x86_64 #1\\n[  301.558772] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebu4\\n[  301.559569] RIP: 0010:untrack_pfn+0xf4/0x100\\n[  301.559893] Code: 75 c4 eb cf 48 8b 43 10 8b a8 e8 00 00 00 3b 6b 28 74 b8 48 8b 7b 30 e8 ea 1a f7 000\\n[  301.561189] RSP: 0018:ffffba2c0377fab8 EFLAGS: 00010282\\n[  301.561590] RAX: 00000000ffffffea RBX: ffff9208c8ce9cc0 RCX: 000000010455e047\\n[  301.562105] RDX: 07fffffff0eb1e0a RSI: 0000000000000000 RDI: ffff9208c391d200\\n[  301.562628] RBP: 0000000000000000 R08: ffffba2c0377fab8 R09: 0000000000000000\\n[  301.563145] R10: ffff9208d2292d50 R11: 0000000000000002 R12: 00007fea890e0000\\n[  301.563669] R13: 0000000000000000 R14: ffffba2c0377fc08 R15: 0000000000000000\\n[  301.564186] FS:  0000000000000000(0000) GS:ffff920c2fbc0000(0000) knlGS:0000000000000000\\n[  301.564773] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\n[  301.565197] CR2: 00007fea88ee8a20 CR3: 00000001033a8000 CR4: 0000000000750ef0\\n[  301.565725] PKRU: 55555554\\n[  301.565944] Call Trace:\\n[  301.566148]  \u003cTASK\u003e\\n[  301.566325]  ? untrack_pfn+0xf4/0x100\\n[  301.566618]  ? __warn+0x81/0x130\\n[  301.566876]  ? untrack_pfn+0xf4/0x100\\n[  3\\n---truncated---\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: x86/mm/pat: corrige el manejo de VM_PAT en asignaciones COW El manejo de PAT no funcionar\u00e1 correctamente en las asignaciones COW: la primera PTE (o, de hecho, todas las PTE) pueden ser reemplazado durante fallos de escritura para se\u00f1alar folios an\u00f3nimos. Recuperar de manera confiable el PFN y el modo de cach\u00e9 correctos usando follow_phys() de las PTE no funcionar\u00e1 en las asignaciones COW. Usando follow_phys(), podr\u00edamos obtener la direcci\u00f3n+protecci\u00f3n de la publicaci\u00f3n an\u00f3nima (lo cual es muy incorrecto), o fallar en las entradas de intercambio/no intercambio, fallando en follow_phys() y activando un WARN_ON_ONCE() en untrack_pfn() y track_pfn_copy() , no llamando correctamente a free_pfn_range(). En free_pfn_range(), no llamar\u00edamos a memtype_free() o lo llamar\u00edamos con el rango incorrecto, posiblemente perdiendo memoria. Para solucionarlo, actualicemos follow_phys() para rechazar la devoluci\u00f3n de publicaciones an\u00f3nimas y recurramos al uso del PFN almacenado dentro de vma-\u0026gt;vm_pgoff para asignaciones COW si nos encontramos con eso. Ahora manejaremos adecuadamente untrack_pfn() con asignaciones COW, donde no necesitamos el modo cach\u00e9. Sin embargo, tendremos que fallar fork()-\u0026gt;track_pfn_copy() si la primera p\u00e1gina fue reemplazada por una publicaci\u00f3n an\u00f3nima: tendr\u00edamos que almacenar el modo de cach\u00e9 en el VMA para que esto funcione, probablemente aumentando el tama\u00f1o del VMA. Por ahora, manteng\u00e1moslo simple y dejemos que track_pfn_copy() simplemente falle en ese caso: ya habr\u00eda fallado en el pasado con entradas de intercambio/no intercambio, y habr\u00eda hecho algo incorrecto con folios an\u00f3nimos. Reproductor simple para activar WARN_ON_ONCE() en untrack_pfn(): \u0026lt;--- Reproductor C ---\u0026gt; #include  #include  #include  #include  int main(void) { struct io_uring_params p = {}; int anillo_fd; tama\u00f1o_t tama\u00f1o; carb\u00f3n *mapa; ring_fd = io_uring_setup(1, \u0026amp;p); if (ring_fd \u0026lt; 0) { perror(\\\"io_uring_setup\\\"); devolver 1; } tama\u00f1o = p.sq_off.array + p.sq_entries * tama\u00f1o de (sin firmar); /* Asigna el anillo de cola de env\u00edo MAP_PRIVATE */ map = mmap(0, size, PROT_READ | PROT_WRITE, MAP_PRIVATE, ring_fd, IORING_OFF_SQ_RING); if (mapa == MAP_FAILED) { perror(\\\"mmap\\\"); devolver 1; } /* Tenemos al menos una p\u00e1gina. Vamos a acobardarnos. */ *mapa = 0; pausa(); devolver 0; } \u0026lt;--- Reproductor C ---\u0026gt; En un sistema con 16 GiB de RAM y swap configurado: # ./iouring \u0026amp; # memhog 16G # killall iouring [ 301.552930] ------------[ cut aqu\u00ed ]------------ [ 301.553285] ADVERTENCIA: CPU: 7 PID: 1402 en arch/x86/mm/pat/memtype.c:1060 untrack_pfn+0xf4/0x100 [ 301.553989] M\u00f3dulos vinculados en : binfmt_misc nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_g [ 301.558232] CPU: 7 PID: 1402 Comm: iouring No contaminado 6.7.5-100.fc38.x86_64 #1 [ 301.558772] Nombre del hardware: PC est\u00e1ndar QEMU (Q35 + ICH9, 2009), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebu4 [ 301.559569] RIP: 0010:untrack_pfn+0xf4/0x100 [ 301.559893] C\u00f3digo: 75 c4 eb cf 48 8b 43 10 8b a8 e8 00 00 00 3b b 28 74 b8 48 8b 7b 30 e8 ea 1a f7 000 [ 301.561189] RSP: 0018:ffffba2c0377fab8 EFLAGS: 00010282 [ 301.561590] RAX: 00000000ffffffea RBX: ffff9208c8ce9cc0 RCX: 455e047 [301.562105] RDX: 07fffffff0eb1e0a RSI: 0000000000000000 RDI: ffff9208c391d200 [301.562628] RBP: 0000000000000000 R08: 8 R09: 0000000000000000 [ 301.563145] R10: ffff9208d2292d50 R11: 0000000000000002 R12: 00007fea890e0000 [ 301.563669] R13: 00000 R14: ffffba2c0377fc08 R15: 00000000000000000 [ 301.564186] FS: 0000000000000000(0000) GS:ffff920c2fbc0000(0000) knlGS:0000000000000000 0 [301.564773] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 301.565197] CR2: 00007fea88ee8a20 CR3: 00000001033a8000 CR4: 0000000000750ef0 [ 301.565725] KRU: 55555554 [ 301.565944] Seguimiento de llamadas: [ 301.566148]  [ 301.566325] ? untrack_pfn+0xf4/0x100 [301.566618]? __advertir+0x81/0x130 [ 301.566876] ? untrack_pfn+0xf4/0x100 [ 3 ---truncado---\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"arch/x86/mm/pat/memtype.c\",\"mm/memory.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5899329b19100c0b82dc78e9b21ed8b920c9ffb3\",\"lessThan\":\"f18681daaec9665a15c5e7e0f591aad5d0ac622b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5899329b19100c0b82dc78e9b21ed8b920c9ffb3\",\"lessThan\":\"09e6bb53217bf388a0d2fd7fb21e74ab9dffc173\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5899329b19100c0b82dc78e9b21ed8b920c9ffb3\",\"lessThan\":\"c2b2430b48f3c9eaccd2c3d2ad75bb540d4952f4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5899329b19100c0b82dc78e9b21ed8b920c9ffb3\",\"lessThan\":\"7cfee26d1950250b14c5cb0a37b142f3fcc6396a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5899329b19100c0b82dc78e9b21ed8b920c9ffb3\",\"lessThan\":\"97e93367e82752e475a33839a80b33bdbef1209f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5899329b19100c0b82dc78e9b21ed8b920c9ffb3\",\"lessThan\":\"51b7841f3fe84606ec0bd8da859d22e05e5419ec\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5899329b19100c0b82dc78e9b21ed8b920c9ffb3\",\"lessThan\":\"1341e4b32e1fb1b0acd002ccd56f07bd32f2abc6\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5899329b19100c0b82dc78e9b21ed8b920c9ffb3\",\"lessThan\":\"04c35ab3bdae7fefbd7c7a7355f29fa03a035221\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"arch/x86/mm/pat/memtype.c\",\"mm/memory.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2.6.29\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"2.6.29\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.19.312\",\"lessThanOrEqual\":\"4.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.274\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.215\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.155\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.85\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.26\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.8.5\",\"lessThanOrEqual\":\"6.8.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.9\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]},{\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\",\"affectedData\":[{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-01-16T21:13:41.454834Z\",\"id\":\"CVE-2024-35877\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-401\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.6.29\",\"versionEndExcluding\":\"4.19.312\",\"matchCriteriaId\":\"FC6D429D-BBC0-45CE-BDD8-A62B2EF8F67A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.20\",\"versionEndExcluding\":\"5.4.274\",\"matchCriteriaId\":\"F45A0F3C-C16D-49C4-86D6-D021C3D4B834\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.215\",\"matchCriteriaId\":\"9CD5894E-58E9-4B4A-B0F4-3E6BC134B8F5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.155\",\"matchCriteriaId\":\"F11B6314-A852-4FBD-AD84-ECE23F5C092B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.85\",\"matchCriteriaId\":\"325665BF-2409-49D9-B391-39AD4566FDBD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.26\",\"matchCriteriaId\":\"C520696A-A594-4FFC-A32D-12DA535CE911\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.8.5\",\"matchCriteriaId\":\"DBD6C99E-4250-4DFE-8447-FF2075939D10\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"22BEDD49-2C6D-402D-9DBF-6646F6ECD10B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"DF73CB2A-DFFD-46FB-9BFE-AA394F27EA37\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"07B237A9-69A3-4A9C-9DA0-4E06BD37AE73\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/04c35ab3bdae7fefbd7c7a7355f29fa03a035221\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/09e6bb53217bf388a0d2fd7fb21e74ab9dffc173\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/1341e4b32e1fb1b0acd002ccd56f07bd32f2abc6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/51b7841f3fe84606ec0bd8da859d22e05e5419ec\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7cfee26d1950250b14c5cb0a37b142f3fcc6396a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/97e93367e82752e475a33839a80b33bdbef1209f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c2b2430b48f3c9eaccd2c3d2ad75bb540d4952f4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f18681daaec9665a15c5e7e0f591aad5d0ac622b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/04c35ab3bdae7fefbd7c7a7355f29fa03a035221\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/09e6bb53217bf388a0d2fd7fb21e74ab9dffc173\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/1341e4b32e1fb1b0acd002ccd56f07bd32f2abc6\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/51b7841f3fe84606ec0bd8da859d22e05e5419ec\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7cfee26d1950250b14c5cb0a37b142f3fcc6396a\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/97e93367e82752e475a33839a80b33bdbef1209f\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c2b2430b48f3c9eaccd2c3d2ad75bb540d4952f4\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f18681daaec9665a15c5e7e0f591aad5d0ac622b\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://cert-portal.siemens.com/productcert/html/ssa-265688.html\",\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-06-28T11:09:10+00:00",
      "cve": "CVE-2024-35877",
      "id": "CVE-2024-35877",
      "initial_release_date": "2024-05-19T00:00:00+00:00",
      "product_status:fixed": "709",
      "product_status:known_affected": "64",
      "product_status:known_not_affected": "8",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: x86/mm/pat: fix VM_PAT handling in COW mappings",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-35877.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-03T16:42:19Z",
      "cve": "CVE-2024-35877",
      "id": "CVE-2024-35877",
      "initial_release_date": "2024-05-21T01:59:35Z",
      "product_status:known_affected": "583",
      "product_status:recommended": "770",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-35877",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-35877.json",
      "version": "95"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/f18681daaec9665a15c5e7e0f591aad5d0ac622b\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/09e6bb53217bf388a0d2fd7fb21e74ab9dffc173\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/c2b2430b48f3c9eaccd2c3d2ad75bb540d4952f4\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/7cfee26d1950250b14c5cb0a37b142f3fcc6396a\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/97e93367e82752e475a33839a80b33bdbef1209f\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/51b7841f3fe84606ec0bd8da859d22e05e5419ec\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/1341e4b32e1fb1b0acd002ccd56f07bd32f2abc6\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/04c35ab3bdae7fefbd7c7a7355f29fa03a035221\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T03:21:48.797Z\"}}, {\"affected\": [{\"vendor\": \"Siemens\", \"product\": \"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}], \"x_adpType\": \"supplier\", \"references\": [{\"url\": \"https://cert-portal.siemens.com/productcert/html/ssa-265688.html\"}], \"providerMetadata\": {\"orgId\": \"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\", \"shortName\": \"siemens-SADP\", \"dateUpdated\": \"2026-05-12T11:52:17.843Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-35877\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-01-16T21:13:41.454834Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"description\": \"CWE-noinfo Not enough information\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-06-18T16:56:41.421Z\"}}], \"cna\": {\"title\": \"x86/mm/pat: fix VM_PAT handling in COW mappings\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5899329b19100c0b82dc78e9b21ed8b920c9ffb3\", \"lessThan\": \"f18681daaec9665a15c5e7e0f591aad5d0ac622b\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"5899329b19100c0b82dc78e9b21ed8b920c9ffb3\", \"lessThan\": \"09e6bb53217bf388a0d2fd7fb21e74ab9dffc173\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"5899329b19100c0b82dc78e9b21ed8b920c9ffb3\", \"lessThan\": \"c2b2430b48f3c9eaccd2c3d2ad75bb540d4952f4\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"5899329b19100c0b82dc78e9b21ed8b920c9ffb3\", \"lessThan\": \"7cfee26d1950250b14c5cb0a37b142f3fcc6396a\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"5899329b19100c0b82dc78e9b21ed8b920c9ffb3\", \"lessThan\": \"97e93367e82752e475a33839a80b33bdbef1209f\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"5899329b19100c0b82dc78e9b21ed8b920c9ffb3\", \"lessThan\": \"51b7841f3fe84606ec0bd8da859d22e05e5419ec\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"5899329b19100c0b82dc78e9b21ed8b920c9ffb3\", \"lessThan\": \"1341e4b32e1fb1b0acd002ccd56f07bd32f2abc6\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"5899329b19100c0b82dc78e9b21ed8b920c9ffb3\", \"lessThan\": \"04c35ab3bdae7fefbd7c7a7355f29fa03a035221\", \"versionType\": \"git\"}], \"programFiles\": [\"arch/x86/mm/pat/memtype.c\", \"mm/memory.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"2.6.29\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"2.6.29\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"4.19.312\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.19.*\"}, {\"status\": \"unaffected\", \"version\": \"5.4.274\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.215\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.155\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.85\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.26\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8.5\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.8.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"arch/x86/mm/pat/memtype.c\", \"mm/memory.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/f18681daaec9665a15c5e7e0f591aad5d0ac622b\"}, {\"url\": \"https://git.kernel.org/stable/c/09e6bb53217bf388a0d2fd7fb21e74ab9dffc173\"}, {\"url\": \"https://git.kernel.org/stable/c/c2b2430b48f3c9eaccd2c3d2ad75bb540d4952f4\"}, {\"url\": \"https://git.kernel.org/stable/c/7cfee26d1950250b14c5cb0a37b142f3fcc6396a\"}, {\"url\": \"https://git.kernel.org/stable/c/97e93367e82752e475a33839a80b33bdbef1209f\"}, {\"url\": \"https://git.kernel.org/stable/c/51b7841f3fe84606ec0bd8da859d22e05e5419ec\"}, {\"url\": \"https://git.kernel.org/stable/c/1341e4b32e1fb1b0acd002ccd56f07bd32f2abc6\"}, {\"url\": \"https://git.kernel.org/stable/c/04c35ab3bdae7fefbd7c7a7355f29fa03a035221\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nx86/mm/pat: fix VM_PAT handling in COW mappings\\n\\nPAT handling won\u0027t do the right thing in COW mappings: the first PTE (or,\\nin fact, all PTEs) can be replaced during write faults to point at anon\\nfolios.  Reliably recovering the correct PFN and cachemode using\\nfollow_phys() from PTEs will not work in COW mappings.\\n\\nUsing follow_phys(), we might just get the address+protection of the anon\\nfolio (which is very wrong), or fail on swap/nonswap entries, failing\\nfollow_phys() and triggering a WARN_ON_ONCE() in untrack_pfn() and\\ntrack_pfn_copy(), not properly calling free_pfn_range().\\n\\nIn free_pfn_range(), we either wouldn\u0027t call memtype_free() or would call\\nit with the wrong range, possibly leaking memory.\\n\\nTo fix that, let\u0027s update follow_phys() to refuse returning anon folios,\\nand fallback to using the stored PFN inside vma-\u003evm_pgoff for COW mappings\\nif we run into that.\\n\\nWe will now properly handle untrack_pfn() with COW mappings, where we\\ndon\u0027t need the cachemode.  We\u0027ll have to fail fork()-\u003etrack_pfn_copy() if\\nthe first page was replaced by an anon folio, though: we\u0027d have to store\\nthe cachemode in the VMA to make this work, likely growing the VMA size.\\n\\nFor now, lets keep it simple and let track_pfn_copy() just fail in that\\ncase: it would have failed in the past with swap/nonswap entries already,\\nand it would have done the wrong thing with anon folios.\\n\\nSimple reproducer to trigger the WARN_ON_ONCE() in untrack_pfn():\\n\\n\u003c--- C reproducer ---\u003e\\n #include \u003cstdio.h\u003e\\n #include \u003csys/mman.h\u003e\\n #include \u003cunistd.h\u003e\\n #include \u003cliburing.h\u003e\\n\\n int main(void)\\n {\\n         struct io_uring_params p = {};\\n         int ring_fd;\\n         size_t size;\\n         char *map;\\n\\n         ring_fd = io_uring_setup(1, \u0026p);\\n         if (ring_fd \u003c 0) {\\n                 perror(\\\"io_uring_setup\\\");\\n                 return 1;\\n         }\\n         size = p.sq_off.array + p.sq_entries * sizeof(unsigned);\\n\\n         /* Map the submission queue ring MAP_PRIVATE */\\n         map = mmap(0, size, PROT_READ | PROT_WRITE, MAP_PRIVATE,\\n                    ring_fd, IORING_OFF_SQ_RING);\\n         if (map == MAP_FAILED) {\\n                 perror(\\\"mmap\\\");\\n                 return 1;\\n         }\\n\\n         /* We have at least one page. Let\u0027s COW it. */\\n         *map = 0;\\n         pause();\\n         return 0;\\n }\\n\u003c--- C reproducer ---\u003e\\n\\nOn a system with 16 GiB RAM and swap configured:\\n # ./iouring \u0026\\n # memhog 16G\\n # killall iouring\\n[  301.552930] ------------[ cut here ]------------\\n[  301.553285] WARNING: CPU: 7 PID: 1402 at arch/x86/mm/pat/memtype.c:1060 untrack_pfn+0xf4/0x100\\n[  301.553989] Modules linked in: binfmt_misc nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_g\\n[  301.558232] CPU: 7 PID: 1402 Comm: iouring Not tainted 6.7.5-100.fc38.x86_64 #1\\n[  301.558772] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebu4\\n[  301.559569] RIP: 0010:untrack_pfn+0xf4/0x100\\n[  301.559893] Code: 75 c4 eb cf 48 8b 43 10 8b a8 e8 00 00 00 3b 6b 28 74 b8 48 8b 7b 30 e8 ea 1a f7 000\\n[  301.561189] RSP: 0018:ffffba2c0377fab8 EFLAGS: 00010282\\n[  301.561590] RAX: 00000000ffffffea RBX: ffff9208c8ce9cc0 RCX: 000000010455e047\\n[  301.562105] RDX: 07fffffff0eb1e0a RSI: 0000000000000000 RDI: ffff9208c391d200\\n[  301.562628] RBP: 0000000000000000 R08: ffffba2c0377fab8 R09: 0000000000000000\\n[  301.563145] R10: ffff9208d2292d50 R11: 0000000000000002 R12: 00007fea890e0000\\n[  301.563669] R13: 0000000000000000 R14: ffffba2c0377fc08 R15: 0000000000000000\\n[  301.564186] FS:  0000000000000000(0000) GS:ffff920c2fbc0000(0000) knlGS:0000000000000000\\n[  301.564773] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\n[  301.565197] CR2: 00007fea88ee8a20 CR3: 00000001033a8000 CR4: 0000000000750ef0\\n[  301.565725] PKRU: 55555554\\n[  301.565944] Call Trace:\\n[  301.566148]  \u003cTASK\u003e\\n[  301.566325]  ? untrack_pfn+0xf4/0x100\\n[  301.566618]  ? __warn+0x81/0x130\\n[  301.566876]  ? untrack_pfn+0xf4/0x100\\n[  3\\n---truncated---\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.19.312\", \"versionStartIncluding\": \"2.6.29\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.274\", \"versionStartIncluding\": \"2.6.29\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.215\", \"versionStartIncluding\": \"2.6.29\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.155\", \"versionStartIncluding\": \"2.6.29\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.85\", \"versionStartIncluding\": \"2.6.29\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.26\", \"versionStartIncluding\": \"2.6.29\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8.5\", \"versionStartIncluding\": \"2.6.29\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9\", \"versionStartIncluding\": \"2.6.29\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-11T20:12:58.539Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-35877\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-12T11:52:17.843Z\", \"dateReserved\": \"2024-05-17T13:50:33.110Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-05-19T08:34:34.604Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.