From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id F02A9157E97 for ; Thu, 29 Feb 2024 15:53:38 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1709222019; cv=none; b=Dr3+0uIry5+I3B9cEieIhMudwkj9b4NMh1lIzfY7u0Z3ey5UieKmFp/GdP8vWUS7ArldRsjavXMlZiVUZfEcW4mVvDnYjgeWk3PeVpOiu+8f/Gm0ypJKnQwJm7H0lwJ32w1nUL71OQMz43EKEHe4QzTbklMjICUxlwfardLH/N8= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1709222019; c=relaxed/simple; bh=GCsn1+fuKMfHYvFbsIdEEddx7PBnjJfLeD+tphSuy7Q=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=t2xJKXGZNm6V2+CrOPdPpmDuyLB1KKnMIGN9/2Du2n1D8kEQoACqiYJ4XP0ZekV35GIWUnhd3clxUv3QwrT85F3grpAy7PC2iXD3/BhznE+tmAJ8qYW+aujNBsr7ggob5e5PtBQ8+bEgrRwK49tMeNFZgb0s3LxtEePRlb8LMLQ= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=DNlj3Lll; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="DNlj3Lll" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2ED83C433F1; Thu, 29 Feb 2024 15:53:38 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1709222018; bh=GCsn1+fuKMfHYvFbsIdEEddx7PBnjJfLeD+tphSuy7Q=; h=From:To:Cc:Subject:Date:Reply-to:From; b=DNlj3Lll2NOOokFeeMflyGsVGuztqEdVPQ/l4mIpBnbUHvYuAsIObtkLit2QLugiR LB28Wow0NSLExvgw66S6zZaColI6EsFf2slHHYINHa6itbJB6JkaW8v4qzhCALwri4 8PNYxkB/UJhIwKQuTyoR5FM8MUQqYX07e6/ZOWHW8O7Fg7sC8EU6LIPyHUE3KFJrcu EoVeXc6HY51hT+BIrSuzeeqYUr0JI98Zbu22SoRhfFvg14Pl+rCfGBnx/FfdFJNzaH 04kqauMqT7fLQuz/0j2x2XSytZhsOK3pHimAq3mAdsb/GANZKnHywmBAXGqfXzG7KI yj7a/5/tvJvsA== From: Lee Jones To: linux-cve-announce@vger.kernel.org Cc: Lee Jones Subject: CVE-2024-26617: fs/proc/task_mmu: move mmu notification mechanism inside mm lock Date: Thu, 29 Feb 2024 15:53:08 +0000 Message-ID: <20240229155245.1571576-49-lee@kernel.org> X-Mailer: git-send-email 2.44.0.rc1.240.g4c46232300-goog Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Reply-to: , X-Developer-Signature: v=1; a=openpgp-sha256; l=2317; i=lee@kernel.org; h=from:subject; bh=GCsn1+fuKMfHYvFbsIdEEddx7PBnjJfLeD+tphSuy7Q=; b=owEBbQKS/ZANAwAKAVGvii+H/HdhAcsmYgBl4KhQgcpv1eytiOeAXOEjpCe+3xeeR6sWanyWu RwdSAIUpS2JAjMEAAEKAB0WIQR2tsk1o74gmpTwh0hRr4ovh/x3YQUCZeCoUAAKCRBRr4ovh/x3 Ya7iD/9zAgmqjbG9vgmU9pIAXZodaHnCubntFSkNWffVcjwO5nS7kmnGE3E/+FtPUmvCu9M38CL QF9GHuQnlAemkry66gRL2F3zKrMyWEuLQDjTR0VWH9hWB4FQlZ4rkXsrnGN4d9zhcfm8lv2yg4i 2g5WurECJc8OO/kFG8mzOWld1kywX57Z5iI1AinGvAAp6KpBwoeYu/+ToloCJj7xKF+KEiIEc3c LIqIiR8nnvRfBbS3d8/5d/7ux6vY9rsPQIDNRky+d4Fx9TWWVLCmHqHVbzPAJ6y7Q1KSJ1vxl7P 6RASXBBMpGX8K2150dwUumgD24xOIw8aQ2YEhQx3CJkJTCHaHBYg770u1kn2Zl5o0n5PNw1IwAE ua0IoQFqnthf1Hy4rtCFf7I5VZIDUDQUvlvZWHV0FaRBa31z8ocbPzq213Yy9YrxAhxKvp04odK lnMpISiUl9AxEr+aw700HnHYwW0hPvTKbObH966JNhcSA6o+TsQJW+ucVrRMn4B0eChjKqCZicR DvIJE2F+Sm+xz0NxjzWN3MRyv1tufDmjVuoDZSSj/AjCmJeujnShbWYLz6TkBG/wuth2gEb4juB Clmwe69Y5VpHHk2x6HVJ7fknlQAIopeM9Y950iqXcCToDcQWIQG8gpN7AAJ27+mmuqXI3gq/rCN 9V2N0RET9C0P17g== X-Developer-Key: i=lee@kernel.org; a=openpgp; fpr=76B6C935A3BE209A94F0874851AF8A2F87FC7761 Content-Transfer-Encoding: 8bit Description =========== In the Linux kernel, the following vulnerability has been resolved: fs/proc/task_mmu: move mmu notification mechanism inside mm lock Move mmu notification mechanism inside mm lock to prevent race condition in other components which depend on it. The notifier will invalidate memory range. Depending upon the number of iterations, different memory ranges would be invalidated. The following warning would be removed by this patch: WARNING: CPU: 0 PID: 5067 at arch/x86/kvm/../../../virt/kvm/kvm_main.c:734 kvm_mmu_notifier_change_pte+0x860/0x960 arch/x86/kvm/../../../virt/kvm/kvm_main.c:734 There is no behavioural and performance change with this patch when there is no component registered with the mmu notifier. [akpm@linux-foundation.org: narrow the scope of `range', per Sean] The Linux kernel CVE team has assigned CVE-2024-26617 to this issue. Affected and fixed versions =========================== Issue introduced in 6.7 with commit 52526ca7fdb9 and fixed in 6.7.3 with commit 05509adf2979 Issue introduced in 6.7 with commit 52526ca7fdb9 and fixed in 6.8-rc1 with commit 4cccb6221cae Please see https://www.kernel.org or a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2024-26617 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: fs/proc/task_mmu.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/05509adf297924f51e1493aa86f9fcde1433ed80 https://git.kernel.org/stable/c/4cccb6221cae6d020270606b9e52b1678fc8b71a