Red Hat: CVE-2024-39497: kernel: drm/shmem-helper: Fix BUG_ON() on mmap(PROT_WRITE, MAP_PRIVATE) (Multiple Advisories)

Red Hat: CVE-2024-39497: kernel: drm/shmem-helper: Fix BUG_ON() on mmap(PROT_WRITE, MAP_PRIVATE) (Multiple Advisories)

Severity

4

CVSS

(AV:L/AC:L/Au:M/C:N/I:N/A:C)

Published

07/12/2024

Created

12/06/2024

Added

12/05/2024

Modified

12/05/2024

Description

In the Linux kernel, the following vulnerability has been resolved: drm/shmem-helper: Fix BUG_ON() on mmap(PROT_WRITE, MAP_PRIVATE) Lack of check for copy-on-write (COW) mapping in drm_gem_shmem_mmap allows users to call mmap with PROT_WRITE and MAP_PRIVATE flag causing a kernel panic due to BUG_ON in vmf_insert_pfn_prot: BUG_ON((vma->vm_flags & VM_PFNMAP) && is_cow_mapping(vma->vm_flags)); Return -EINVAL early if COW mapping is detected. This bug affects all drm drivers using default shmem helpers. It can be reproduced by this simple example: void *ptr = mmap(0, size, PROT_WRITE, MAP_PRIVATE, fd, mmap_offset); ptr[0] = 0;

Solution(s)

• redhat-upgrade-kernel
• redhat-upgrade-kernel-rt

References

• CVE-2024-39497
• RHSA-2024:9315