Summaryinfo

A vulnerability was found in Linux Kernel up to 6.7.2. It has been declared as critical. This affects an unknown function of the file fs/proc/task_mmu of the component MMU Notifications Handler. Such manipulation leads to race condition. This vulnerability is documented as CVE-2024-26617. There is not any exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Linux Kernel up to 6.7.2 (Operating System). Affected by this issue is some unknown processing of the file fs/proc/task_mmu of the component MMU Notifications Handler. The manipulation with an unknown input leads to a race condition vulnerability. Using CWE to declare the problem leads to CWE-362. The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently. Impacted is availability. CVE summarizes:

In the Linux kernel, the following vulnerability has been resolved: fs/proc/task_mmu: move mmu notification mechanism inside mm lock Move mmu notification mechanism inside mm lock to prevent race condition in other components which depend on it. The notifier will invalidate memory range. Depending upon the number of iterations, different memory ranges would be invalidated. The following warning would be removed by this patch: WARNING: CPU: 0 PID: 5067 at arch/x86/kvm/../../../virt/kvm/kvm_main.c:734 kvm_mmu_notifier_change_pte+0x860/0x960 arch/x86/kvm/../../../virt/kvm/kvm_main.c:734 There is no behavioural and performance change with this patch when there is no component registered with the mmu notifier. [[email protected]: narrow the scope of `range', per Sean]

The weakness was released 02/29/2024. The advisory is shared for download at git.kernel.org. This vulnerability is handled as CVE-2024-26617 since 02/19/2024. There are known technical details, but no exploit is available.

Upgrading to version 6.7.3 or 6.8-rc1 eliminates this vulnerability. Applying the patch 05509adf2979/4cccb6221cae is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 6.7.0
• 6.7.1
• 6.7.2

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion