Vulnerability in Linux Kernel: mm: filemap: check if THP has hwpoisoned subpage for PMD page fault
Summary
GSD-2021-1002193: mm: filemap: check if THP has hwpoisoned subpage for PMD page fault. Affects Kernel versions >= 800d8c63b2e989c2e349632d1648119bf5862f01, < eac96c3efdb593df1a57bb5b95dbe037bfa9a522. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux Kernel is the core component of the Linux operating system, responsible for managing system resources and providing an interface for applications to interact with the hardware. It is a critical piece of software that is constantly being developed and maintained by a large community of contributors. This vulnerability specifically affects the filemap subsystem of the kernel, which is responsible for managing file-backed memory mappings.
The vulnerability arises from a lack of proper checks when handling Transparent Huge Pages (THP) during a Page Middle Directory (PMD) page fault. If a THP has a hwpoisoned subpage, it can lead to memory corruption or other security issues.
Vulnerability Detail
The vulnerability occurs in the filemap subsystem of the Linux Kernel when handling PMD page faults for Transparent Huge Pages (THP). When a PMD page fault is triggered, the kernel should check if the THP has any hwpoisoned subpages. However, due to a coding error, this check is not performed, potentially allowing memory corruption or other security issues to occur.
An attacker could exploit this vulnerability by triggering a PMD page fault on a THP with a hwpoisoned subpage. This could lead to memory corruption, privilege escalation, or other security exploits.
The vulnerability was introduced in version v4.8 of the Linux Kernel and has been fixed in version v5.15 by commit eac96c3efdb593df1a57bb5b95dbe037bfa9a522.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can disable Transparent Huge Pages (THP) by setting the 'transparent_hugepage' kernel parameter to 'never' in the bootloader configuration. This can be done by adding the following line to the bootloader configuration file (e.g., /etc/default/grub):
GRUB_CMDLINE_LINUX_DEFAULT="transparent_hugepage=never"
After making the change, the bootloader configuration should be updated by running the appropriate command (e.g., 'update-grub' for GRUB). This workaround will prevent the vulnerability from being triggered, but it may have performance implications for applications that rely on THP.
Conclusion
The vulnerability in the Linux Kernel's filemap subsystem can lead to memory corruption or other security issues when handling Transparent Huge Pages (THP) during a Page Middle Directory (PMD) page fault. It is recommended to update the kernel to version v5.15 or later to fix this vulnerability. Alternatively, users can disable THP as a workaround, but this may impact performance. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The Linux Kernel is the core component of the Linux operating system, responsible for managing system resources and providing an interface for applications to interact with the hardware.
The filemap subsystem is responsible for managing file-backed memory mappings in the Linux Kernel. It handles operations such as reading from and writing to files, caching file data in memory, and managing the mapping between virtual addresses and physical pages.
Transparent Huge Pages (THP) is a feature in the Linux Kernel that allows for the efficient management of large memory pages. It can improve performance by reducing the overhead of managing individual small pages.
A Page Middle Directory (PMD) page fault occurs when the kernel needs to access a page that is not currently mapped in the Page Table. The kernel will handle the fault by allocating a new page and updating the Page Table to map the virtual address to the physical page.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file and Vulert will analyze it for any open-source vulnerabilities, including this one.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
