From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 97DFD211A33; Wed, 22 Jan 2025 12:51:14 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1737550274; cv=none; b=LYBU2+o0m56YbExp3GzsnuzdLuS3h0zitB71xS3RbQtk9hp/ldNKjs5FeP3MFA4MMPuI49OWei/D2M7R6fXOdzahKwcKpAE3Bh3jh4U8GKHcBNEhegYLTpTFsXYZYdaYT7g4Hn6k1bgmuK1S+G4I6GN6UBIMh+Hnkb2HiFWCwhE= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1737550274; c=relaxed/simple; bh=dNQvIUwsp3u9iRKAoPD3+p/l/wIuXcw8DDIexGoxR/A=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=R9gqZAiI+OYQIF3RpKD9DtRmHWocjR3aGLpTDrKyVs1xUHsF/DPMd/5QfKFAbtxOCWNWBQ1uNN/zwq9xBxyuwGL45gKSPbIj0ntswLahfxyTDaH6FKTzhkkAhJutGPc6xHpg3rfUAHysi0AdtsFGjUyNvepeJuL9DJjDMoEwZ6g= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=tLPkhhdQ; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="tLPkhhdQ" Received: by smtp.kernel.org (Postfix) with ESMTPSA id A47EBC4CED6; Wed, 22 Jan 2025 12:51:13 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1737550274; bh=dNQvIUwsp3u9iRKAoPD3+p/l/wIuXcw8DDIexGoxR/A=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=tLPkhhdQp2wtNfb+qixRMub0UsMw4KEMR9/F1BGe1SSa/caBnMzH/CskpBpNgaWkv nxeK+XRkDwboNfJ4zmrROS4DaLxosQZ7ec5EXCvuuWiyuD0+XtzW9hDPHl8C0UR+H1 AsN7SZOgrBPjVuPSiK1K6hOZQdyuEzRvjd1YtUmU= Date: Wed, 22 Jan 2025 13:51:11 +0100 From: Greg KH To: Lorenzo Stoakes Cc: cve@kernel.org, linux-kernel@vger.kernel.org, linux-cve-announce@vger.kernel.org Subject: Re: CVE-2024-57937: mm: reinstate ability to map write-sealed memfd mappings read-only Message-ID: <2025012255-worshiper-doorframe-ba19@gregkh> References: <9bf44136-e6a5-4275-b7ea-5022c3cfd543@lucifer.local> <2025012228-tarot-garland-80c1@gregkh> <33d0f861-496e-4baa-9034-b0a356e6a720@lucifer.local> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <33d0f861-496e-4baa-9034-b0a356e6a720@lucifer.local> On Wed, Jan 22, 2025 at 12:47:31PM +0000, Lorenzo Stoakes wrote: > On Wed, Jan 22, 2025 at 01:36:32PM +0100, Greg KH wrote: > > On Wed, Jan 22, 2025 at 11:51:10AM +0000, Lorenzo Stoakes wrote: > > > On Sun, Sep 16, 2001 at 11:00:00PM +0000, Greg Kroah-Hartman wrote: > > > > Description > > > > =========== > > > > > > > > In the Linux kernel, the following vulnerability has been resolved: > > > > > > > > mm: reinstate ability to map write-sealed memfd mappings read-only > > > > > > Hi Greg, > > > > > > This is not a vulnerability and I don't see how it could possibly be > > > exploited. So unless somebody can suggest a means by which it could be, I > > > suggest this CVE should be dropped. > > > > > > Thanks, Lorenzo > > > > > > > > > > > Patch series "mm: reinstate ability to map write-sealed memfd mappings > > > > read-only". > > > > > > > > In commit 158978945f31 ("mm: perform the mapping_map_writable() check > > > > after call_mmap()") (and preceding changes in the same series) it became > > > > possible to mmap() F_SEAL_WRITE sealed memfd mappings read-only. > > > > I thought the ability to mmap a sealed memfd mapping as read-only that > > didn't want to be mmaped that way was a "vulnerability fix". > > The TL;DR is it's not security-related, the 'TL' is below :P > > Yeah perhaps I wasn't clear enough in the commit message - for the longest > time the man page described the ability to mmap() PROT_READ a F_SEAL_WRITE > memfd (or at least - implied - you could do this) - but due to the > mechanism by which these write seals operate, you weren actually't able to. > > The reason for this is the VM_MAYWRITE flag will naturally still be set (as > you could mprotect() PROT_WRITE the region). > > My solution was to explicitly drop VM_MAYWRITE in this scenario, which > explicitly disallows this, so it is then fine to mmap() PROT_READ the > region and get the desired semantics - at no point are you able to do > anything not permitted by the write seal. > > However, when applying the various mmap_region() security features, we had > to move a bunch of these checks around, which accidentally again prevented > the PROT_READ mmap() of these write sealed memfd's (simply due to _where_ > things happened). > > So this patch was just me finding a different way to achieve the same thing > to account for the new way in which we do mmap() basically. > > At no time was a user able to work around these seals (or, in the spirit of > security I should say - at no time was able to work around these seals > _this way_, nor _to my knowledge_ any other way :) > > > > > If you don't think so, then that's fine, we'll be glad to revoke this, > > just let us know. > > Indeed yeah, I think in this case it's not a security thing so I think it's > appropriate to revoke. Thanks for the "TL" that makes more sense :) Now revoked. greg k-h