CVE-2024-26617CWE-362

CVE-2024-26617

High · published March 11, 2024

CVSS v3.1
7.8
EPSS
0%
Percentile
5.5
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

fs/proc/task_mmu: move mmu notification mechanism inside mm lock

Move mmu notification mechanism inside mm lock to prevent race condition

in other components which depend on it. The notifier will invalidate

memory range. Depending upon the number of iterations, different memory

ranges would be invalidated.

The following warning would be removed by this patch:

WARNING: CPU: 0 PID: 5067 at arch/x86/kvm/../../../virt/kvm/kvm_main.c:734 kvm_mmu_notifier_change_pte+0x860/0x960 arch/x86/kvm/../../../virt/kvm/kvm_main.c:734

There is no behavioural and performance change with this patch when

there is no component registered with the mmu notifier.

[[email protected]: narrow the scope of `range', per Sean]

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00165 · 5.5th percentile
Weakness
CWE-362 · Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Published
2024-03-11T22:15Z
Affected products (1)
ProductVersionsFixed in
linux/linux_kernel≥ 6.7, < 6.7.36.7.3
References (4)
EPSS history
Timeline
  • 29 FEB 15:52Z
    fs/proc/task_mmu: move mmu notification mechanism inside mm lock
    cvelistv5