{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-27022", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-02-19T14:20:24.210Z", "datePublished": "2024-05-01T05:35:39.627Z", "dateUpdated": "2026-08-05T11:29:04.523Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:29:04.523Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfork: defer linking file vma until vma is fully initialized\n\nThorvald reported a WARNING [1]. And the root cause is below race:\n\n CPU 1\t\t\t\t\tCPU 2\n fork\t\t\t\t\thugetlbfs_fallocate\n dup_mmap\t\t\t\t hugetlbfs_punch_hole\n i_mmap_lock_write(mapping);\n vma_interval_tree_insert_after -- Child vma is visible through i_mmap tree.\n i_mmap_unlock_write(mapping);\n hugetlb_dup_vma_private -- Clear vma_lock outside i_mmap_rwsem!\n\t\t\t\t\t i_mmap_lock_write(mapping);\n \t\t\t\t\t hugetlb_vmdelete_list\n\t\t\t\t\t vma_interval_tree_foreach\n\t\t\t\t\t hugetlb_vma_trylock_write -- Vma_lock is cleared.\n tmp->vm_ops->open -- Alloc new vma_lock outside i_mmap_rwsem!\n\t\t\t\t\t hugetlb_vma_unlock_write -- Vma_lock is assigned!!!\n\t\t\t\t\t i_mmap_unlock_write(mapping);\n\nhugetlb_dup_vma_private() and hugetlb_vm_op_open() are called outside\ni_mmap_rwsem lock while vma lock can be used in the same time. Fix this\nby deferring linking file vma until vma is fully initialized. Those vmas\nshould be initialized first before they can be used." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The race is driven entirely through local syscalls — `memfd_create(MFD_HUGETLB)`/`ftruncate`/`mmap`, `fork()`, and `fallocate(FALLOC_FL_PUNCH_HOLE)` — on the attacker's own process. There is no network or remote-peer input path into `dup_mmap()` or `hugetlbfs_punch_hole()`.\nAC:L - The attacker controls both sides of the race, looping `fork()` in one thread while another loops hole-punch/truncate on the same hugetlbfs fd, and the vulnerable window spans `hugetlb_dup_vma_private()` through `copy_page_range()` to `vm_ops->open()`, which is widened to milliseconds simply by using a multi-GB mapping. No condition outside the attacker's influence is required.\nPR:L - Any unprivileged local user can reach this: `memfd_create(name, MFD_HUGETLB)` uses `HUGETLB_ANONHUGE_INODE`, which bypasses the `can_do_hugetlb_shm()`/`CAP_IPC_LOCK` check, and `MAP_NORESERVE` lets the mapping succeed even with no huge pages configured. No hugetlbfs mount, capability, or namespace privilege is needed.\nUI:N - The attacker's own process performs both the `fork()` and the `fallocate()`/`ftruncate()` that collide; no victim action, mount, or file open by another user is involved.\nS:U - The corruption is confined to kernel memory-management state (rwsem counters and hugetlb page tables) within the same kernel security authority, with no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - Running `huge_pmd_unshare()` without the VMA lock reintroduces the shared-PMD page-table use-after-free that lock was added to prevent, letting a freed page-table page remain installed in another mm's PUD and be reallocated — yielding arbitrary physical memory read. Per kernel guidance, memory corruption of this class scores High.\nI:H - The same PMD page-table UAF gives an arbitrary-write primitive (attacker-controlled PTEs written into freed-and-reallocated memory map arbitrary physical frames), and the unbalanced `up_write()` underflows `sem->count`, destroying mutual exclusion on the lock that guards hugetlb page-table teardown.\nA:H - The mismatched lock/unlock leaves the parent's `hugetlb_vma_lock->rw_sema` permanently write-held, so every subsequent hugetlb fault, unmap, or `exit_mmap()` on that VMA blocks forever in D state — unkillable tasks and hung-task panic — in addition to the reported WARNING and UAF-induced oopses." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "kernel/fork.c" ], "versions": [ { "version": "8d9bfb2608145cf3e408428c224099e1585471af", "lessThan": "2e5cbab8ccbfc7d4a3d8a21d3c2a1f2c1aa29b5b", "status": "affected", "versionType": "git" }, { "version": "8d9bfb2608145cf3e408428c224099e1585471af", "lessThan": "abdb88dd272bbeb93efe01d8e0b7b17e24af3a34", "status": "affected", "versionType": "git" }, { "version": "8d9bfb2608145cf3e408428c224099e1585471af", "lessThan": "35e351780fa9d8240dd6f7e4f245f9ea37e96c19", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "kernel/fork.c" ], "versions": [ { "version": "6.1", "status": "affected" }, { "version": "0", "lessThan": "6.1", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.134", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.8.8", "lessThanOrEqual": "6.8.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.9", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1", "versionEndExcluding": "6.6.134" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1", "versionEndExcluding": "6.8.8" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1", "versionEndExcluding": "6.9" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/2e5cbab8ccbfc7d4a3d8a21d3c2a1f2c1aa29b5b" }, { "url": "https://git.kernel.org/stable/c/abdb88dd272bbeb93efe01d8e0b7b17e24af3a34" }, { "url": "https://git.kernel.org/stable/c/35e351780fa9d8240dd6f7e4f245f9ea37e96c19" } ], "title": "fork: defer linking file vma until vma is fully initialized", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "title": "CVE Program Container", "references": [ { "url": "https://git.kernel.org/stable/c/0c42f7e039aba3de6d7dbf92da708e2b2ecba557", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/04b0c41912349aff11a1bbaef6a722bd7fbb90ac", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/cec11fa2eb512ebe3a459c185f4aca1d44059bbf", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/dd782da470761077f4d1120e191f1a35787cda6e", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/abdb88dd272bbeb93efe01d8e0b7b17e24af3a34", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/35e351780fa9d8240dd6f7e4f245f9ea37e96c19", "tags": [ "x_transferred" ] }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DAMSOZXJEPUOXW33WZYWCVAY7Z5S7OOY/" }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4EZ6PJW7VOZ224TD7N4JZNU6KV32ZJ53/" }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GCBZZEC7L7KTWWAS2NLJK6SO3IZIL4WW/" } ], "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-04T17:17:44.767Z" } }, { "metrics": [ { "other": { "type": "ssvc", "content": { "id": "CVE-2024-27022", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "version": "2.0.3", "timestamp": "2024-09-10T15:44:40.515074Z" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T17:33:37.775Z" } } ] } }