Executive Summary

This vulnerability exists in the Linux kernel's memfd_luo component, specifically in the put_folios cleanup path of the memfd_luo_retrieve_folios() function.

The issue arises because the function kho_restore_folio() expects a physical address (phys_addr_t) but instead receives a raw page frame number (PFN). This causes the subsequent function kho_restore_page() to check an incorrect physical address.

Additionally, a loop in the code lacks a check for pfolio->pfn being zero, which can lead to incorrect processing of sparse file holes.

The fix involves properly converting the PFN to a physical address using PFN_PHYS() and adding the missing check for pfolio->pfn being zero, aligning with the correct pattern used elsewhere in the code.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability in the Linux kernel involves incorrect handling of physical address conversion during memory cleanup in memfd_luo_retrieve_folios(). Specifically, the function kho_restore_folio() receives a raw PFN instead of a physical address, causing it to check the wrong physical address. Additionally, the cleanup loop may incorrectly process sparse file holes where the PFN is zero. These issues could lead to improper memory management or data corruption during cleanup operations.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability has been fixed in the Linux kernel by correcting the physical address conversion in the memfd_luo module's put_folios cleanup path.

To mitigate this vulnerability, you should update your Linux kernel to a version that includes this fix.

Useful 0 Not Useful 0