David Hildenbrand

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 6.10.0-64.eln141.aarch64 **Description** The issue is related to page table locking for hugetlb folios that are not mapped using a single PMD/PUD. GUP's common page table walking code will perform a pte offset map lock() to grab the PTE table lock, but hugetlb that concurrently modifies these page tables would actually grab the mm->page table lock, resulting in differing locks when USE SPLIT PTE PTLOCKS is used. This can be reproduced by triggering a warning at mm/gup.c:142 try grab folio+0x11c/0x188. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Linux kernel (affected versions not specified) Description: The issue is related to the function `filemap fault recheck pte none()` in the Linux kernel's memory management subsystem. It involves a race condition that may lead to the reuse of previously freed memory, potentially allowing an attacker to impact the integrity of protected information. The problem arises because the `vmf->ptl` is still set from `handle pte fault()`, but at the same time, `pte unmap(vmf->pte)` is performed, which can cause the page table to be changed, making `vmf->ptl` fail to protect the actual page table. This might trigger a Use After Free (UAF) condition. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 6.6.43 **Description** The Linux kernel has a vulnerability related to the creation of PMD-sized page cache. On ARM64 systems, when the base page size is 64KB, HPAGE PMD ORDER is 13, which cannot be supported by xarray. This results in error messages indicating a problem with the `xas split alloc` function. The issue arises when the size of the PMD-sized page cache exceeds MAX PAGECACHE ORDER. To resolve this, the kernel will skip allocating PMD-sized page cache when its size is larger than MAX PAGECACHE ORDER and fall back to the regular path, where the readahead window is determined by BDI's sysfs file (`read ahead kb`). **Recommendations** To resolve the issue, update the Linux kernel to version 6.6.43 or later. If updating is not possible, consider temporarily disabling the `xas split alloc` function or restricting the use of PMD-sized page cache until a patch is available. Additionally, ensure that BDI's sysfs file (`read ahead kb`) is properly configured to determine the readahead window.

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 5.15.0 Description: The vulnerability is related to the proc/vmcore component of the Linux kernel. It is caused by a buffer overflow when clearing a user buffer, which can lead to a permissions violation. The issue can be triggered by copying the vmcore via "cp" with a virtio-mem device that registers a vmcore cb and has some logically unplugged memory inside an added Linux memory block. Some x86-64 CPUs have a CPU feature called "Supervisor Mode Access Prevention (SMAP)" that can detect wrong access from the kernel to user buffers, triggering a permissions violation on wrong access. The vulnerability can cause a BUG and a page fault, leading to a crash. Recommendations: To resolve the issue, properly use the clear user() function when dealing with a user buffer, instead of memset. This can be achieved by updating the Linux kernel to a version that includes the fix for the proc/vmcore vulnerability. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Linux kernel (affected versions not specified) Description: The vulnerability is related to the Linux kernel, specifically in the drivers/virt/acrn component. It involves issues with PFNMAP PTE checks in the acrn vm ram map() function. The problem arises from missing handling of various cases, resulting in dangerous usage of the follow pte() function. This includes not checking PTE write permissions, not rejecting refcounted pages, and only looking at the first PTE of a bigger range. Exploitation of this vulnerability could potentially allow an attacker to elevate privileges in the system. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Linux kernel (affected versions not specified) Description: The issue is related to a race condition between the `free swap and cache()` function and the `swapoff()` function in the Linux kernel's memory management subsystem. This could potentially allow an attacker to cause a denial of service by accessing freed memory. The problem is theoretical and has not been proven with a test case, but it has been agreed upon through code review that it is possible. The fix involves using `get swap device()` and `put swap device()` to stall `swapoff()`. Technical details about exploitation include: - **Function Names:** `free swap and cache()`, `swapoff()`, `swap page trans huge swapped()`, ` try to reclaim swap()`, `folio free swap()`, `delete from swap cache()`, `put swap folio()`, `free swap slot()`, `swapcache free entries()`, `swap entry free()`, and `swap range free()`. - **Variables:** `si->inuse pages`, `count`, `nr entries`. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** A race condition was found in the Linux kernel's memory subsystem, related to the copy-on-write (COW) breakage of private read-only shared memory mappings. This issue allows an unprivileged, local user to gain write access to read-only memory mappings, increasing their privileges on the system. The problem is similar to the Dirty COW vulnerability but is limited to affecting data in shared memory (shmem / tmpfs). Exploitation of this issue can be used to modify running executable files that use shared memory. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 4.8.13 **Description** The issue is related to a use-after-free vulnerability in the `kvm ioctl create device` function. This vulnerability can be exploited by host OS users to cause a denial of service, resulting in a host OS crash, or possibly gain privileges via crafted ioctl calls on the `/dev/kvm` device. **Recommendations** For Linux kernel versions prior to 4.8.13, update to version 4.8.13 or later to resolve the issue. As a temporary workaround, consider restricting access to the `/dev/kvm` device to minimize the risk of exploitation.