From 5.19.6: ``` commit 9def52eb10baab3b700858003d462fcf17d62873 Author: David Hildenbrand <david@redhat.com> Date: Wed Aug 24 21:23:33 2022 +0200 mm/gup: fix FOLL_FORCE COW security issue and remove FOLL_COW commit 5535be3099717646781ce1540cf725965d680e7b upstream. Ever since the Dirty COW (CVE-2016-5195) security issue happened, we know that FOLL_FORCE can be possibly dangerous, especially if there are races that can be exploited by user space. Right now, it would be sufficient to have some code that sets a PTE of a R/O-mapped shared page dirty, in order for it to erroneously become writable by FOLL_FORCE. The implications of setting a write-protected PTE dirty might not be immediately obvious to everyone. And in fact ever since commit 9ae0f87d009c ("mm/shmem: unconditionally set pte dirty in mfill_atomic_install_pte"), we can use UFFDIO_CONTINUE to map a shmem page R/O while marking the pte dirty. This can be used by unprivileged user space to modify tmpfs/shmem file content even if the user does not have write permissions to the file, and to bypass memfd write sealing -- Dirty COW restricted to tmpfs/shmem (CVE-2022-2590). To fix such security issues for good, the insight is that we really only need that fancy retry logic (FOLL_COW) for COW mappings that are not writable (!VM_WRITE). And in a COW mapping, we really only broke COW if we have an exclusive anonymous page mapped. If we have something else mapped, or the mapped anonymous page might be shared (!PageAnonExclusive), we have to trigger a write fault to break COW. If we don't find an exclusive anonymous page when we retry, we have to trigger COW breaking once again because something intervened. Let's move away from this mandatory-retry + dirty handling and rely on our PageAnonExclusive() flag for making a similar decision, to use the same COW logic as in other kernel parts here as well. In case we stumble over a PTE in a COW mapping that does not map an exclusive anonymous page, COW was not properly broken and we have to trigger a fake write-fault to break COW. Just like we do in can_change_pte_writable() added via commit 64fe24a3e05e ("mm/mprotect: try avoiding write faults for exclusive anonymous pages when changing protection") and commit 76aefad628aa ("mm/mprotect: fix soft-dirty check in can_change_pte_writable()"), take care of softdirty and uffd-wp manually. For example, a write() via /proc/self/mem to a uffd-wp-protected range has to fail instead of silently granting write access and bypassing the userspace fault handler. Note that FOLL_FORCE is not only used for debug access, but also triggered by applications without debug intentions, for example, when pinning pages via RDMA. This fixes CVE-2022-2590. Note that only x86_64 and aarch64 are affected, because only those support CONFIG_HAVE_ARCH_USERFAULTFD_MINOR. Fortunately, FOLL_COW is no longer required to handle FOLL_FORCE. So let's just get rid of it. Thanks to Nadav Amit for pointing out that the pte_dirty() check in FOLL_FORCE code is problematic and might be exploitable. Note 1: We don't check for the PTE being dirty because it doesn't matter for making a "was COWed" decision anymore, and whoever modifies the page has to set the page dirty either way. Note 2: Kernels before extended uffd-wp support and before PageAnonExclusive (< 5.19) can simply revert the problematic commit instead and be safe regarding UFFDIO_CONTINUE. A backport to v5.19 requires minor adjustments due to lack of vma_soft_dirty_enabled(). Link: https://lkml.kernel.org/r/20220809205640.70916-1-david@redhat.com Fixes: 9ae0f87d009c ("mm/shmem: unconditionally set pte dirty in mfill_atomic_install_pte") Signed-off-by: David Hildenbrand <david@redhat.com> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Cc: Axel Rasmussen <axelrasmussen@google.com> Cc: Nadav Amit <nadav.amit@gmail.com> Cc: Peter Xu <peterx@redhat.com> Cc: Hugh Dickins <hughd@google.com> Cc: Andrea Arcangeli <aarcange@redhat.com> Cc: Matthew Wilcox <willy@infradead.org> Cc: Vlastimil Babka <vbabka@suse.cz> Cc: John Hubbard <jhubbard@nvidia.com> Cc: Jason Gunthorpe <jgg@nvidia.com> Cc: David Laight <David.Laight@ACULAB.COM> Cc: <stable@vger.kernel.org> [5.16] Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: David Hildenbrand <david@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ```
A race condition was found in the way the Linux kernel's memory subsystem handled the copy-on-write (COW) breakage of private read-only shared memory mappings. This flaw allows an unprivileged, local user to gain write access to read-only memory mappings, increasing their privileges on the system. https://www.openwall.com/lists/oss-security/2022/08/08/1 """ An unprivileged user can modify file content of a shmem (tmpfs) file, even if that user does not have write permissions to the file. The file could be an executable. The introducing upstream commit ID is: 9ae0f87d009c ("mm/shmem: unconditionally set pte dirty in mfill_atomic_install_pte") Linux >= v5.16 is affected on x86-64 and aarch64 if the kernel is compiled with CONFIG_USERFAULTFD=y. For Linux < v5.19 it's sufficient to revert the problematic commit, which is possible with minor contextual conflicts. For Linux >= v5.19 I'll send a proposal fix today. """
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=d4475f09a8b9d986f7b131ad011f06774c1a1193 commit d4475f09a8b9d986f7b131ad011f06774c1a1193 Author: Michał Górny <mgorny@gentoo.org> AuthorDate: 2022-09-01 06:21:13 +0000 Commit: Michał Górny <mgorny@gentoo.org> CommitDate: 2022-09-01 06:21:41 +0000 sys-kernel/vanilla-kernel: Remove vulnerable versions Bug: https://bugs.gentoo.org/867781 Signed-off-by: Michał Górny <mgorny@gentoo.org> sys-kernel/vanilla-kernel/Manifest | 8 -- .../vanilla-kernel/vanilla-kernel-5.18.19.ebuild | 134 --------------------- .../vanilla-kernel/vanilla-kernel-5.19.4.ebuild | 134 --------------------- 3 files changed, 276 deletions(-) https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=a0f1865b0440057621bd73fe2232a12835aab2a8 commit a0f1865b0440057621bd73fe2232a12835aab2a8 Author: Michał Górny <mgorny@gentoo.org> AuthorDate: 2022-09-01 06:20:59 +0000 Commit: Michał Górny <mgorny@gentoo.org> CommitDate: 2022-09-01 06:21:40 +0000 sys-kernel/gentoo-kernel: Remove vulnerable versions Bug: https://bugs.gentoo.org/867781 Signed-off-by: Michał Górny <mgorny@gentoo.org> sys-kernel/gentoo-kernel/Manifest | 9 -- .../gentoo-kernel/gentoo-kernel-5.18.19.ebuild | 137 --------------------- .../gentoo-kernel/gentoo-kernel-5.19.4.ebuild | 137 --------------------- 3 files changed, 283 deletions(-) https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=81e08bdf0f3be24c248d7ff14bba1df4afdac1c8 commit 81e08bdf0f3be24c248d7ff14bba1df4afdac1c8 Author: Michał Górny <mgorny@gentoo.org> AuthorDate: 2022-09-01 06:20:42 +0000 Commit: Michał Górny <mgorny@gentoo.org> CommitDate: 2022-09-01 06:20:42 +0000 sys-kernel/gentoo-kernel-bin: Remove vulnerable versions Bug: https://bugs.gentoo.org/867781 Signed-off-by: Michał Górny <mgorny@gentoo.org> sys-kernel/gentoo-kernel-bin/Manifest | 13 -- .../gentoo-kernel-bin-5.18.19.ebuild | 135 --------------------- .../gentoo-kernel-bin-5.19.4.ebuild | 135 --------------------- 3 files changed, 283 deletions(-) https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=a0121a21342b31d13eb0aa24a392ee2d5f04f05c commit a0121a21342b31d13eb0aa24a392ee2d5f04f05c Author: Michał Górny <mgorny@gentoo.org> AuthorDate: 2022-09-01 06:20:24 +0000 Commit: Michał Górny <mgorny@gentoo.org> CommitDate: 2022-09-01 06:20:24 +0000 virtual/dist-kernel: Remove vulnerable versions Bug: https://bugs.gentoo.org/867781 Signed-off-by: Michał Górny <mgorny@gentoo.org> virtual/dist-kernel/dist-kernel-5.18.19.ebuild | 19 ------------------- virtual/dist-kernel/dist-kernel-5.19.4.ebuild | 19 ------------------- 2 files changed, 38 deletions(-)
The first appearance of the patch reference can be found in kernel versions: 5.19.6 6.0 This bug can safely be closed.
Indeed, thanks!
