{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-47674", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-09-30T16:00:12.937Z", "datePublished": "2024-10-15T10:48:33.481Z", "dateUpdated": "2026-08-05T11:39:20.802Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:39:20.802Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm: avoid leaving partial pfn mappings around in error case\n\nAs Jann points out, PFN mappings are special, because unlike normal\nmemory mappings, there is no lifetime information associated with the\nmapping - it is just a raw mapping of PFNs with no reference counting of\na 'struct page'.\n\nThat's all very much intentional, but it does mean that it's easy to\nmess up the cleanup in case of errors. Yes, a failed mmap() will always\neventually clean up any partial mappings, but without any explicit\nlifetime in the page table mapping itself, it's very easy to do the\nerror handling in the wrong order.\n\nIn particular, it's easy to mistakenly free the physical backing store\nbefore the page tables are actually cleaned up and (temporarily) have\nstale dangling PTE entries.\n\nTo make this situation less error-prone, just make sure that any partial\npfn mapping is torn down early, before any other error handling." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerability is reached through the mmap(2) syscall on a local device file whose driver pfn-maps a buffer (/dev/dri/renderD*, /dev/snd/pcm*, /dev/video*, /dev/dma_heap/*, /dev/comedi*). There is no network-facing path into remap_pfn_range().\nAC:L - User page tables are allocated with GFP_PGTABLE_USER (__GFP_ACCOUNT), so an attacker holding a memcg limit can force pte_alloc/pmd_alloc to return -ENOMEM deterministically after the first PTEs are installed, choosing exactly where the walk fails. The subsequent window is exercised by a second attacker thread, so the attacker controls both sides of the race.\nPR:L - Only an open file descriptor on an ordinary unprivileged device node is needed — DRM render nodes, ALSA PCM, V4L2 and dma-heap devices are accessible to normal desktop users and to every sandboxed Android app. No capability or root is required.\nUI:N - The attacker performs the mmap(), induces the allocation failure and touches the stale mapping entirely from its own threads. No victim action is involved.\nS:U - The dangling PFN mappings and the corrupted memory are both within the kernel's own security authority; there is no VM, IOMMU or sandbox boundary crossed.\nC:H - The stale PTEs remain user-readable after the driver returns the backing pages to the page allocator, so userspace can read physical pages recycled into page tables, slab objects and other tasks' memory — an effectively arbitrary physical-memory read primitive.\nI:H - The same dangling mapping is writable (PAGE_SHARED / vm_page_prot on a PROT_WRITE mapping), giving userspace arbitrary writes into recycled kernel memory such as page tables or cred structures, which is a direct route to privilege escalation and code execution.\nA:H - Writing through PTEs pointing at freed and reallocated physical memory corrupts arbitrary kernel state, reliably producing oopses, page-table corruption and full system panic." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "mm/memory.c" ], "versions": [ { "version": "b97a50adb37e98b940a30c4656565ff609aa8f94", "lessThan": "3213fdcab961026203dd587a4533600c70b3336b", "status": "affected", "versionType": "git" }, { "version": "69d4e1ce9087c8767f2fe9b9426fa2755c8e9072", "lessThan": "35770ca6180caa24a2b258c99a87bd437a1ee10f", "status": "affected", "versionType": "git" }, { "version": "74ffa5a3e68504dd289135b1cf0422c19ffb3f2e", "lessThan": "5b2c8b34f6d76bfbd1dd4936eb8a0fbfb9af3959", "status": "affected", "versionType": "git" }, { "version": "74ffa5a3e68504dd289135b1cf0422c19ffb3f2e", "lessThan": "65d0db500d7c07f0f76fc24a4d837791c4862cd2", "status": "affected", "versionType": "git" }, { "version": "74ffa5a3e68504dd289135b1cf0422c19ffb3f2e", "lessThan": "a95a24fcaee1b892e47d5e6dcc403f713874ee80", "status": "affected", "versionType": "git" }, { "version": "74ffa5a3e68504dd289135b1cf0422c19ffb3f2e", "lessThan": "954fd4c81f22c4b6ba65379a81fd252971bf4ef3", "status": "affected", "versionType": "git" }, { "version": "74ffa5a3e68504dd289135b1cf0422c19ffb3f2e", "lessThan": "79a61cc3fc0466ad2b7b89618a6157785f0293b3", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "mm/memory.c" ], "versions": [ { "version": "5.13", "status": "affected" }, { "version": "0", "lessThan": "5.13", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.168", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.111", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.52", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.10.11", "lessThanOrEqual": "6.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.11", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "5.15.168" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "6.1.111" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "6.6.52" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "6.10.11" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "6.11" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/3213fdcab961026203dd587a4533600c70b3336b" }, { "url": "https://git.kernel.org/stable/c/35770ca6180caa24a2b258c99a87bd437a1ee10f" }, { "url": "https://git.kernel.org/stable/c/5b2c8b34f6d76bfbd1dd4936eb8a0fbfb9af3959" }, { "url": "https://git.kernel.org/stable/c/65d0db500d7c07f0f76fc24a4d837791c4862cd2" }, { "url": "https://git.kernel.org/stable/c/a95a24fcaee1b892e47d5e6dcc403f713874ee80" }, { "url": "https://git.kernel.org/stable/c/954fd4c81f22c4b6ba65379a81fd252971bf4ef3" }, { "url": "https://git.kernel.org/stable/c/79a61cc3fc0466ad2b7b89618a6157785f0293b3" }, { "url": "https://project-zero.issues.chromium.org/issues/366053091" } ], "title": "mm: avoid leaving partial pfn mappings around in error case", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "metrics": [ { "other": { "type": "ssvc", "content": { "timestamp": "2024-10-15T12:44:14.464782Z", "id": "CVE-2024-47674", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "version": "2.0.3" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-15T12:44:33.228Z" } }, { "title": "CVE Program Container", "references": [ { "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html" }, { "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html" } ], "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T22:20:42.071Z" } } ] } }