From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mx0a-00069f02.pphosted.com (mx0a-00069f02.pphosted.com [205.220.165.32]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 01D4221148E; Wed, 22 Jan 2025 11:51:58 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=205.220.165.32 ARC-Seal:i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1737546720; cv=fail; b=LBBxFYAmCyhDRgUygXlVjIgG7jicbsYuYe26F/ua2LuSZT+VLUPfYs7PzZf9e5o1YZt8l5bhRQ0Eiq4pYoMNKOpvqOkb500/hnahJVyEDUGS6GsTuXnTrt7JDJgcrsZH/VfAbxZjD1IakdI/Qx0WvSQ6xs8aLUaH22fkHLgxJjI= ARC-Message-Signature:i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1737546720; c=relaxed/simple; bh=m3bdUc1w5BEyA4F8mUOHHf+LE5b1S7UnCy9pPzv+XQ4=; h=Date:From:To:Cc:Subject:Message-ID:Content-Type: Content-Disposition:MIME-Version; b=HOx7RMsBwzWH6q7U2XT1owkAS1zrStp9/PBFaj7MYmK4tztOGibOryVuNNBpGV8mOTU1SMOdLMvOEi4EHKTC3LDxrSDkG5VUWC15rXUPBGJqWFeMI55s/91vc3iriZk09/ngHrmngYAn6+jJW8jZL6Nzk3FaWHXQaqp4jR5BYQw= ARC-Authentication-Results:i=2; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oracle.com; spf=pass smtp.mailfrom=oracle.com; dkim=pass (2048-bit key) header.d=oracle.com header.i=@oracle.com header.b=ba8yZlaM; dkim=pass (1024-bit key) header.d=oracle.onmicrosoft.com header.i=@oracle.onmicrosoft.com header.b=QE5iOgmz; arc=fail smtp.client-ip=205.220.165.32 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oracle.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oracle.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=oracle.com header.i=@oracle.com header.b="ba8yZlaM"; dkim=pass (1024-bit key) header.d=oracle.onmicrosoft.com header.i=@oracle.onmicrosoft.com header.b="QE5iOgmz" Received: from pps.filterd (m0246617.ppops.net [127.0.0.1]) by mx0b-00069f02.pphosted.com (8.18.1.2/8.18.1.2) with ESMTP id 50M92uVE014141; Wed, 22 Jan 2025 11:51:56 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=cc :content-type:date:from:message-id:mime-version:subject:to; s= corp-2023-11-20; bh=+KvARK61FaoNWhEyfM322Ms1/3A9lToXGec7uzmSBWY=; b= ba8yZlaMmguPIi17kcLQQLa2sxfzkZOSYhkGYSMHYQUbwR08CPelZYSRwhpocWnU Bi18RiK/CFjbpTvMECqlR/oP9LGnataWxkyWrktw+if2MATu4WJOPocFpp2UrUBr F/k97JfNAgPqO95lmpw3n/gM8covVqDTQlzWooT9TYhkKR4/Kr4Zd7QDHMqX2IHK 09YmvMWzupT+VgPmlfTWLwqAeR1mR6LUJqpIvdzQH9Ou2RPp0UOdmPVok1lUwuu9 LM/HTILleUuCy1wYkOhoTuKtrHNpq5eOVYn8KObRUOYLFmxoGwloz88B/8XGoY2T yD/sFWa01Lj3bPZ8unBsdg== Received: from iadpaimrmta01.imrmtpd1.prodappiadaev1.oraclevcn.com (iadpaimrmta01.appoci.oracle.com [130.35.100.223]) by mx0b-00069f02.pphosted.com (PPS) with ESMTPS id 44awpx08em-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 22 Jan 2025 11:51:55 +0000 (GMT) Received: from pps.filterd (iadpaimrmta01.imrmtpd1.prodappiadaev1.oraclevcn.com [127.0.0.1]) by iadpaimrmta01.imrmtpd1.prodappiadaev1.oraclevcn.com (8.18.1.2/8.18.1.2) with ESMTP id 50MAna1A018758; Wed, 22 Jan 2025 11:51:20 GMT Received: from nam10-dm6-obe.outbound.protection.outlook.com (mail-dm6nam10lp2043.outbound.protection.outlook.com [104.47.58.43]) by iadpaimrmta01.imrmtpd1.prodappiadaev1.oraclevcn.com (PPS) with ESMTPS id 4491c3hfhv-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 22 Jan 2025 11:51:20 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=KULVPWHtjqFKlOJKyQPB9r5ZKgeUfLZmF33qnAxiHQNVGf6ibrbGvBpcpEwHYH0asZsJ5+En2ZYFqxgW23zCc7rQT9Y6BpL1PQNsuqv1F1UH8/jalLVUI2veFOGIZpn79gNR4Iu8sYRgRl7pa+Lbxcb1FGRMkhJqlnWed1Lbo5I+jzcyoo3NV6P8Yzcnn8uAVF1xwamOpquMk51AHijukR28JA0HVfVNWPEmQCiHVN6zt84CTt2lskOY5O8VEEuz0KwUp4NmaeePcJ1PtDzzoYeer55uGfLciCwV764Sy6RgUOAeBGtKhpTHpgdptY6wnipw9YWi/xTKs9P9G+WDcw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=+KvARK61FaoNWhEyfM322Ms1/3A9lToXGec7uzmSBWY=; b=t0dgZ17n5av/JelD77iwgsNyUlWOO5rhbD0imrhmY0fh6ReMMEe2XXqjgAQj7L2rr9082uaoNSTwV4hgOUr85iV2Z6kY9xfEwmv+2gSvC3wf09apAx8D5+vrxw2xCHMUo9RbLM+uR7FULFA32zYPDNDkRlsDcmmbt9wYmeId31yCUk44QLeyCe5MRNC74ODa/LO4r/Or9GWES0HSr2/bXNqT3cbzlYRGpW+1PbmGTAqDDPM9WhM/jiTBTU1b70taBB4gxZG3Jj/CdbPtl5Pc3xiEs1bDtsJfuijJXWjXk++ocFpBBjlJtXrRTjHsxmXXuKBntpASRNvy4U2sRwU1ug== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=oracle.com; dmarc=pass action=none header.from=oracle.com; dkim=pass header.d=oracle.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.onmicrosoft.com; s=selector2-oracle-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=+KvARK61FaoNWhEyfM322Ms1/3A9lToXGec7uzmSBWY=; b=QE5iOgmzZVhOnz+PmswlW4FrSD9XaRJPWraHdqwZzV3KQSQAAe3jdElYVPZ87w7d1YO4Qjy13yvXOFD3s9aawjdEvJmLoLcNHSUy8iIWAXOcVNSCB12ZdKMv+l0VJDWMAL27R4g7u1kQX2mCmnhrQ0VI4sRxz1Bzb2WX4AwilFU= Received: from BYAPR10MB3366.namprd10.prod.outlook.com (2603:10b6:a03:14f::25) by PH0PR10MB5869.namprd10.prod.outlook.com (2603:10b6:510:14b::6) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.8356.22; Wed, 22 Jan 2025 11:51:17 +0000 Received: from BYAPR10MB3366.namprd10.prod.outlook.com ([fe80::baf2:dff1:d471:1c9]) by BYAPR10MB3366.namprd10.prod.outlook.com ([fe80::baf2:dff1:d471:1c9%4]) with mapi id 15.20.8356.020; Wed, 22 Jan 2025 11:51:17 +0000 Date: Wed, 22 Jan 2025 11:51:10 +0000 From: Lorenzo Stoakes To: cve@kernel.org, linux-kernel@vger.kernel.org Cc: linux-cve-announce@vger.kernel.org Subject: Re: CVE-2024-57937: mm: reinstate ability to map write-sealed memfd mappings read-only Message-ID: <9bf44136-e6a5-4275-b7ea-5022c3cfd543@lucifer.local> Content-Type: text/plain; charset=us-ascii Content-Disposition: inline X-ClientProxiedBy: LO2P265CA0451.GBRP265.PROD.OUTLOOK.COM (2603:10a6:600:e::31) To BYAPR10MB3366.namprd10.prod.outlook.com (2603:10b6:a03:14f::25) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: BYAPR10MB3366:EE_|PH0PR10MB5869:EE_ X-MS-Office365-Filtering-Correlation-Id: da77a4ad-701f-4475-566f-08dd3adb1469 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|366016|1800799024|376014; X-Microsoft-Antispam-Message-Info: =?us-ascii?Q?a65voy0XFSBDgr3jxQ6Jg4HhDuogCqm3q7mpY2xEFSDeeSOpoySiHtVtPVAD?= =?us-ascii?Q?Nuf2vGAKt2cqxGfoguGJOCRsJoBd0qwf6NMisfxLEGXjQecOFHmahfFzCMw4?= =?us-ascii?Q?KwQSXhvMtuMC/ZGgKFZtemX1ktRgrtcK1feuFdDf3t/EEuqerI+77+8Vs03u?= =?us-ascii?Q?UFPi81Hx6hzNfS7/q4XPbB2qL8mXnU6N3Draiq980wepwBoRsipz7JfBOpPP?= =?us-ascii?Q?qXmR9uDoGyiyCNilNMDERvSqCVhya0GkcBQKo9JByy05n4mku24PF5GWsSZq?= =?us-ascii?Q?zG8qP4046UrzrN9L4FN3tS0OUvFL7JbWqBgdM3PyKw4ZBeJlSorv3JVpmmbh?= =?us-ascii?Q?TacVsP3iF6Ddtzz6WZg/d9D2g20Nccolp4HGKdm951DInaJPdjLHKKShTSz+?= =?us-ascii?Q?ORAJQ0vlR8hbSTwjtBp5Xr3/btSAXq668IuVPI5KQJFUDmZ/+U/d9QZttecm?= =?us-ascii?Q?BcvbfoGJn0c/wzMDTwIud5mGLRQB/M1JJ4ZZqiXWLWW9pimvvkjdJpu+6Vfp?= =?us-ascii?Q?SwRAhfKxfg7ZQfYuFZvlfHgFIKCufnQN1eS+pwW6p1kxj7NpitlR2G9dQiiL?= =?us-ascii?Q?8UNZdc0wIhjNhX7Lkn0S/hJx6EDN3Qdf8lxF0KWNyQYYET3FbLLXCnjK+ngP?= =?us-ascii?Q?PaWLl2nXYSCwGWI+AG9DUD8mRDCnRw4iLnVdG9k6xSXk4sDhb4htuhr1M0bg?= =?us-ascii?Q?k8Ky4eHokmbHbq5qF4QpqwLnJpcuHh/wWdQCw31OekoyvvFRG7gBDlrkZq/j?= =?us-ascii?Q?1VVnx0550oxeltyL1kpbsJbz9bdcUMaOklwM5UlFGXgq83F6hJSx+Kq9wjdk?= =?us-ascii?Q?96V4ObUO1RLTSyL8xf7+ictRiUdkF3W2Zcp7vE7Weba21IfM7rUEcONqmyy5?= =?us-ascii?Q?L/7rKXogINLdkwfnrIkYrTBoQlMOjGd8aEN9cBwPgazdwGcxv0ThpeVHUCdg?= =?us-ascii?Q?8HGhpXTRxaD6tzgE6y7VyTbaL6y2X9449GbUw+vTiJNX31dFYsPFPpbiVw2c?= =?us-ascii?Q?zNG5ll6xvmiFzYgckoNch95Unqx1uBzRjgfDrw/JxGS54Y1DEayctpaGoAaS?= =?us-ascii?Q?fsWBnkj38846gf/v8EbqiG1sNgjzmtGEvVsVGzalR+Z78cHQdTppR1HNgQiz?= =?us-ascii?Q?gD7SK/MyqhLqPhqlWKrdSxEVMCtefqZEKaRgFdjw8Zm3bNM5mwvQCq1VSHUs?= =?us-ascii?Q?0W6uTiA94szhOEgNsGEYi+4ZFSB2cXF9+uC+V7kPpX/bF27BiQLZCXQE5VXs?= =?us-ascii?Q?MVK0Fyzc0wnxExvVKIcZJrBaHyTeAYTOZwaI5GmKT3A4C2SNSNcjhupDPAYM?= =?us-ascii?Q?jMG4rSQ0x6nApc73JgJspRDyoYSFrdsFoqO+wtDModktfQ=3D=3D?= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:BYAPR10MB3366.namprd10.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(366016)(1800799024)(376014);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?jQ+0MBOF3NWvCO9sr9BgeZnk+UN4txdC/Bn8DdLO/PNs3Cvw7b5Nw18sfhHh?= =?us-ascii?Q?j54QI6qeoTmM02222JdTgecvFQ8mNzKJG6vO9iEraELW2fLbs9WJ8KTPejyw?= =?us-ascii?Q?XGu0zpi7nt7xg2g0GLtDs/Up1Az1BKRj+ku1QcBkUm4QyNUNF36K+qE4kLvA?= =?us-ascii?Q?TQ+IsyFz1S0TeLXPoedwcNp4/vx9RP12ieXA6XKEpLqfxlUPEqQwSgvCmb7K?= =?us-ascii?Q?1HjvmaDTTNxsg409sS1LeAfitiOtZShDW27oEzr/7OyiSr3T5UqYwihFwEe0?= =?us-ascii?Q?RVNHC6as9u0Kb81zELt+b719K5fcQNhq+mPZ21QJ7dyFsWkFAH3ZiWl3peIQ?= =?us-ascii?Q?+dtwTVdKhV+Cp6OYoenJd7WNQVUEPaQE7sKJLmCoJb/uCZHwXdISztZTJr+K?= =?us-ascii?Q?MpuPNDdbSpJMsxafIbRzj6E+Px+Fr4VpYVKXBdtX6pHjXsEp+nIKN+L2giM0?= =?us-ascii?Q?CLV37yHbY3F32EIVPMykwFjw91crnxJIcAb5taEp6EqsByDo4tbuE0Zp9rPq?= =?us-ascii?Q?wqKOJGm69KAya7OAJCec8Fr++oaaKIJ1GRmamXfyxEbPGRkH2w4eVga0t1l4?= =?us-ascii?Q?8TmVLJP1JSTvhkmYzse7br7A61Flc+Thl8QspkSjV/98PrAzN7xMbAgTcijg?= =?us-ascii?Q?Dq3pSKwFF1pk7xAYRUfvf8WGjWSzsV9VR4mhK4cZkeiPyQvPDksK9xmKNR9/?= =?us-ascii?Q?JA1C17/DWFOG4bfrI4PQbk8lOxp980LQvQaM5Uy875WFQ8JYkLJG7rf9hCJc?= =?us-ascii?Q?YgIyVeJJZSAnEafaHdih+5HB743g/OZr/WFrdIPrxHFL4xe13sjo8KmCLsFM?= =?us-ascii?Q?nukdOr2RnYTaEg2ucCla8F49STQJKiuP726gwkLxwdzzLeE8SzQlXDnR2e5F?= =?us-ascii?Q?4Ka0kVDcbfJcmqlJj5do1qxaEAmsehuKajFv44wzmFlZ0nydCYLu19PKAOlx?= =?us-ascii?Q?my+oSz35AvnNNtm5Zff6Lu5Onk04UC4zbeP3awDeQW7cuCBtSqKWpgBxWwmI?= =?us-ascii?Q?VDn0A/gBL3lNTugdQf8y7qerSAKdpsmcBoWsq5pVA7On+GXCPRXfYFXARz3T?= =?us-ascii?Q?zFSHUQ26Ej9hgP3yoCb0YpKgZtu3IhA5m2Nk481tyitmI480fgerCnzBGxhg?= =?us-ascii?Q?LXvpmHgDehVWWDMKA4D2XkCbDoHwpJn2m94e37YtCPKU57wtE7sXvfdlc7RH?= =?us-ascii?Q?0r0FmEcebKc5wUkb31WR4llXOs41m8ChQKMiULdwyz1QecRhM+R093vrPVHR?= =?us-ascii?Q?z0cr74VO7fB809HifdQbhtlqwD+sQbtAMXZiyE4aBKCBEunsd2vNPJW4nktX?= =?us-ascii?Q?pHfLYhpyBVdmajj04wrWt0gTGY/qAN0p29OygNcZb7rw63okIlWIRPO0cwcp?= =?us-ascii?Q?2oC+16YXXHPN+GkO5dbg5RISwTZDm6yCoYZK7+up508lxb2T+cpFIEOm7Crv?= =?us-ascii?Q?h87a7tNngajLcDh/6fTOg7coUIYCfkeCsoxxQP+tTyT8SAX8dHbFDLpoOTML?= =?us-ascii?Q?VEcFWmuJgA/XHbJUJvKi5GFpqfeWsF5YXdn39X8v3mo7OhiRWTsqrswVDmmw?= =?us-ascii?Q?Izt5s1PE6nwF96PAhnt66bI1cK5jd5Spgb73R/cPjTPG7Pu4uVAmNhzRAo9/?= =?us-ascii?Q?RA=3D=3D?= X-MS-Exchange-AntiSpam-ExternalHop-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-ExternalHop-MessageData-0: EY3xubIvKUXOFssMfk5El3xyXjZYVUjSzHBaKLgBIAmq+C5Oe8cax5hNtSRi78cz+fqAAVQLPnwKep9DduW5iWMYIiOELI/xTyuzvAMTi9HwCxeT30fayXiOsHHb5Zl/sLrbrRbY3Ukn6Y8MAnyMKnUTlm8+e3tKJvJeIt9qEV287/fS8kGisCLlPoUBtNndxLCx/SDq/GEl2ZC/pyRqibPv6MgjwTmOF6zwVhIJ6KCslJf5YGu6Be4yVHmzVKYdWLUxsgWZRkRvrE3kw9M4NjzqerpnW3SS24sLLDj720Ssjd5g993fKAdPhyMHQUwv8YsR2Q3MvzeQC1OzGAXeRa6hCQSjGvHv0LfSQfNxV54cua/wsJKcXg+1EILITu7e+yTOjW4oYuXWrsSExPMXbNzflG49IfOeR7KYf1YIG7qg9lk1gGDBA8MJpE+Y0s4gGfcrRyLZ8GQAvklOYtABLteg96elkPq/I2jRb5ACkDRysEPLquZ8CVJeqcZccA+wmRQf4r4nCcxKL4HCJNuPYoMOaI9f0RY3/HSS6jK6rnzY2KZBMiOsriKweGRYTOqav1XmKCV/yumcq40rSYpeLFkdN2PArC6w5iI4HlKJxwM= X-OriginatorOrg: oracle.com X-MS-Exchange-CrossTenant-Network-Message-Id: da77a4ad-701f-4475-566f-08dd3adb1469 X-MS-Exchange-CrossTenant-AuthSource: BYAPR10MB3366.namprd10.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 22 Jan 2025 11:51:17.4377 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: jywECzhKWB3LTvfpfq/RM/C8ylSBzHak+3FfZpBi5Fnl4a4s848qqYTyY0a4u9v3bAe2YvIp8N6amgMQwa1IuotNnIR3gLgyj2+tyT2eKTk= X-MS-Exchange-Transport-CrossTenantHeadersStamped: PH0PR10MB5869 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1057,Hydra:6.0.680,FMLib:17.12.68.34 definitions=2025-01-22_05,2025-01-22_02,2024-11-22_01 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 malwarescore=0 spamscore=0 phishscore=0 adultscore=0 bulkscore=0 mlxscore=0 mlxlogscore=999 suspectscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2411120000 definitions=main-2501220087 X-Proofpoint-ORIG-GUID: S0dXZklOcWDjuuhfcLbpCWWAYRCEkPns X-Proofpoint-GUID: S0dXZklOcWDjuuhfcLbpCWWAYRCEkPns On Sun, Sep 16, 2001 at 11:00:00PM +0000, Greg Kroah-Hartman wrote: > Description > =========== > > In the Linux kernel, the following vulnerability has been resolved: > > mm: reinstate ability to map write-sealed memfd mappings read-only Hi Greg, This is not a vulnerability and I don't see how it could possibly be exploited. So unless somebody can suggest a means by which it could be, I suggest this CVE should be dropped. Thanks, Lorenzo > > Patch series "mm: reinstate ability to map write-sealed memfd mappings > read-only". > > In commit 158978945f31 ("mm: perform the mapping_map_writable() check > after call_mmap()") (and preceding changes in the same series) it became > possible to mmap() F_SEAL_WRITE sealed memfd mappings read-only. > > Commit 5de195060b2e ("mm: resolve faulty mmap_region() error path > behaviour") unintentionally undid this logic by moving the > mapping_map_writable() check before the shmem_mmap() hook is invoked, > thereby regressing this change. > > This series reworks how we both permit write-sealed mappings being mapped > read-only and disallow mprotect() from undoing the write-seal, fixing this > regression. > > We also add a regression test to ensure that we do not accidentally > regress this in future. > > Thanks to Julian Orth for reporting this regression. > > > This patch (of 2): > > In commit 158978945f31 ("mm: perform the mapping_map_writable() check > after call_mmap()") (and preceding changes in the same series) it became > possible to mmap() F_SEAL_WRITE sealed memfd mappings read-only. > > This was previously unnecessarily disallowed, despite the man page > documentation indicating that it would be, thereby limiting the usefulness > of F_SEAL_WRITE logic. > > We fixed this by adapting logic that existed for the F_SEAL_FUTURE_WRITE > seal (one which disallows future writes to the memfd) to also be used for > F_SEAL_WRITE. > > For background - the F_SEAL_FUTURE_WRITE seal clears VM_MAYWRITE for a > read-only mapping to disallow mprotect() from overriding the seal - an > operation performed by seal_check_write(), invoked from shmem_mmap(), the > f_op->mmap() hook used by shmem mappings. > > By extending this to F_SEAL_WRITE and critically - checking > mapping_map_writable() to determine if we may map the memfd AFTER we > invoke shmem_mmap() - the desired logic becomes possible. This is because > mapping_map_writable() explicitly checks for VM_MAYWRITE, which we will > have cleared. > > Commit 5de195060b2e ("mm: resolve faulty mmap_region() error path > behaviour") unintentionally undid this logic by moving the > mapping_map_writable() check before the shmem_mmap() hook is invoked, > thereby regressing this change. > > We reinstate this functionality by moving the check out of shmem_mmap() > and instead performing it in do_mmap() at the point at which VMA flags are > being determined, which seems in any case to be a more appropriate place > in which to make this determination. > > In order to achieve this we rework memfd seal logic to allow us access to > this information using existing logic and eliminate the clearing of > VM_MAYWRITE from seal_check_write() which we are performing in do_mmap() > instead. > > The Linux kernel CVE team has assigned CVE-2024-57937 to this issue. > > > Affected and fixed versions > =========================== > > Issue introduced in 6.12 with commit 5de195060b2e251a835f622759550e6202167641 and fixed in 6.12.9 with commit 464770df46095e6967334d77113972960f7ef1fa > Issue introduced in 6.12 with commit 5de195060b2e251a835f622759550e6202167641 and fixed in 6.13 with commit 8ec396d05d1b737c87311fb7311f753b02c2a6b1 > Issue introduced in 5.10.231 with commit 43323a4e5b3f8ccc08e2f835abfdc7ee9da8f6ed > Issue introduced in 5.15.174 with commit 44f48eb9a6051826227bbd375446064fb2a43c6c > Issue introduced in 6.1.119 with commit 52c81fd0f5a8bf8032687b94ccf00d13b44cc5c8 > Issue introduced in 6.6.63 with commit bdc136e2b05fabcd780fe5f165d154eb779dfcb0 > > Please see https://www.kernel.org for a full list of currently supported > kernel versions by the kernel community. > > Unaffected versions might change over time as fixes are backported to > older supported kernel versions. The official CVE entry at > https://cve.org/CVERecord/?id=CVE-2024-57937 > will be updated if fixes are backported, please check that for the most > up to date information about this issue. > > > Affected files > ============== > > The file(s) affected by this issue are: > include/linux/memfd.h > include/linux/mm.h > mm/memfd.c > mm/mmap.c > > > Mitigation > ========== > > The Linux kernel CVE team recommends that you update to the latest > stable kernel version for this, and many other bugfixes. Individual > changes are never tested alone, but rather are part of a larger kernel > release. Cherry-picking individual commits is not recommended or > supported by the Linux kernel community at all. If however, updating to > the latest release is impossible, the individual changes to resolve this > issue can be found at these commits: > https://git.kernel.org/stable/c/464770df46095e6967334d77113972960f7ef1fa > https://git.kernel.org/stable/c/8ec396d05d1b737c87311fb7311f753b02c2a6b1