CVE-2024-27007 - Vulnerability Details - OpenCVE

In the Linux kernel, the following vulnerability has been resolved: userfaultfd: change src_folio after ensuring it's unpinned in UFFDIO_MOVE Commit d7a08838ab74 ("mm: userfaultfd: fix unexpected change to src_folio when UFFDIO_MOVE fails") moved the src_folio->{mapping, index} changing to after clearing the page-table and ensuring that it's not pinned. This avoids failure of swapout+migration and possibly memory corruption. However, the commit missed fixing it in the huge-page case.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Linux	Linux Kernel

No data.

No data.

References

Link	Providers
https://git.kernel.org/stable/c/c0205eaf3af9f5db14d4b5ee4abacf4a583c3c50
https://git.kernel.org/stable/c/df5f6e683e7f21a15d8be6e7a0c7a46436963ebe
https://lore.kernel.org/linux-cve-announce/2024050147-CVE-2024-27007-686b@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2024-27007
https://www.cve.org/CVERecord?id=CVE-2024-27007

History

Wed, 06 Nov 2024 20:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2024-05-01T05:29:08.528Z

Updated: 2025-05-04T09:02:01.913Z

Reserved: 2024-02-19T14:20:24.208Z

Link: CVE-2024-27007

Vulnrichment

Updated: 2024-08-02T00:21:05.906Z

NVD

Status : Awaiting Analysis

Published: 2024-05-01T06:15:19.180

Modified: 2024-11-21T09:03:36.437

Link: CVE-2024-27007

Redhat

Severity : Moderate

Publid Date: 2024-05-01T00:00:00Z

Links: CVE-2024-27007 - Bugzilla

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-27007", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-02-19T14:20:24.208Z", "datePublished": "2024-05-01T05:29:08.528Z", "dateUpdated": "2025-05-04T09:02:01.913Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2025-05-04T09:02:01.913Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nuserfaultfd: change src_folio after ensuring it's unpinned in UFFDIO_MOVE\n\nCommit d7a08838ab74 (\"mm: userfaultfd: fix unexpected change to src_folio\nwhen UFFDIO_MOVE fails\") moved the src_folio->{mapping, index} changing to\nafter clearing the page-table and ensuring that it's not pinned. This\navoids failure of swapout+migration and possibly memory corruption.\n\nHowever, the commit missed fixing it in the huge-page case."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["mm/huge_memory.c"], "versions": [{"version": "adef440691bab824e39c1b17382322d195e1fab0", "lessThan": "df5f6e683e7f21a15d8be6e7a0c7a46436963ebe", "status": "affected", "versionType": "git"}, {"version": "adef440691bab824e39c1b17382322d195e1fab0", "lessThan": "c0205eaf3af9f5db14d4b5ee4abacf4a583c3c50", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["mm/huge_memory.c"], "versions": [{"version": "6.8", "status": "affected"}, {"version": "0", "lessThan": "6.8", "status": "unaffected", "versionType": "semver"}, {"version": "6.8.8", "lessThanOrEqual": "6.8.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.9", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "6.8.8"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "6.9"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/df5f6e683e7f21a15d8be6e7a0c7a46436963ebe"}, {"url": "https://git.kernel.org/stable/c/c0205eaf3af9f5db14d4b5ee4abacf4a583c3c50"}], "title": "userfaultfd: change src_folio after ensuring it's unpinned in UFFDIO_MOVE", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-06-17T17:40:30.411881Z", "id": "CVE-2024-27007", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-17T17:46:11.249Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:21:05.906Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/df5f6e683e7f21a15d8be6e7a0c7a46436963ebe", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/c0205eaf3af9f5db14d4b5ee4abacf4a583c3c50", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/df5f6e683e7f21a15d8be6e7a0c7a46436963ebe", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/c0205eaf3af9f5db14d4b5ee4abacf4a583c3c50", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:21:05.906Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-27007", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-06-17T17:40:30.411881Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-17T17:40:31.480Z"}}], "cna": {"title": "userfaultfd: change src_folio after ensuring it's unpinned in UFFDIO_MOVE", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "adef440691bab824e39c1b17382322d195e1fab0", "lessThan": "df5f6e683e7f21a15d8be6e7a0c7a46436963ebe", "versionType": "git"}, {"status": "affected", "version": "adef440691bab824e39c1b17382322d195e1fab0", "lessThan": "c0205eaf3af9f5db14d4b5ee4abacf4a583c3c50", "versionType": "git"}], "programFiles": ["mm/huge_memory.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.8"}, {"status": "unaffected", "version": "0", "lessThan": "6.8", "versionType": "semver"}, {"status": "unaffected", "version": "6.8.8", "versionType": "semver", "lessThanOrEqual": "6.8.*"}, {"status": "unaffected", "version": "6.9", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["mm/huge_memory.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/df5f6e683e7f21a15d8be6e7a0c7a46436963ebe"}, {"url": "https://git.kernel.org/stable/c/c0205eaf3af9f5db14d4b5ee4abacf4a583c3c50"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nuserfaultfd: change src_folio after ensuring it's unpinned in UFFDIO_MOVE\n\nCommit d7a08838ab74 (\"mm: userfaultfd: fix unexpected change to src_folio\nwhen UFFDIO_MOVE fails\") moved the src_folio->{mapping, index} changing to\nafter clearing the page-table and ensuring that it's not pinned. This\navoids failure of swapout+migration and possibly memory corruption.\n\nHowever, the commit missed fixing it in the huge-page case."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.8.8", "versionStartIncluding": "6.8"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.9", "versionStartIncluding": "6.8"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2025-05-04T09:02:01.913Z"}}}, "cveMetadata": {"cveId": "CVE-2024-27007", "state": "PUBLISHED", "dateUpdated": "2025-05-04T09:02:01.913Z", "dateReserved": "2024-02-19T14:20:24.208Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-05-01T05:29:08.528Z", "assignerShortName": "Linux"}, "dataVersion": "5.1"}