Описание
In the Linux kernel, the following vulnerability has been resolved:
futex: Also allocate private hash on vfork()
As Jann demonstrated, it is entirely feasible to access the mm through vfork().
Therefore we need to allocate a private hash on vfork() as well as any other
CLONE_VM user.
Specifically, it must be avoided to have (private) futex waiters before
allocating the private hash.
A flaw was found in the Linux kernel's Fast Userspace Mutex (futex) subsystem. A local user could trigger this flaw by creating a process using the vfork system call, which shares virtual memory with the parent process without properly initializing a private futex hash table. This issue can cause inconsistent state in futex wait queues, potentially leading to a Denial of Service (DoS) or kernel memory corruption.
Отчет
A race and initialization ordering flaw can allow a private futex waiter to exist before the shared mm receives its private futex hash when vfork is used. This may make waiter insertion and later wake or removal operations select inconsistent hash state, potentially leaving tasks blocked and causing a local denial of service. For the CVSS the PR:L is selected because an unprivileged local process context is required to invoke vfork and futex operations. AC:H is selected because reliable triggering appears to depend on reaching a timing window while the shared mm is accessible and before hash allocation completes. The issue is not network reachable. The available change does not establish a UAF, an out of bounds access, an information leak, or an arbitrary write primitive, so the supported impact is availability rather than confidentiality or integrity. The paranoid assessment allows A:H if repeated triggering can reliably stall multiple tasks or a critical local service.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | kernel | Affected | ||
| Red Hat Enterprise Linux 6 | kernel | Out of support scope | ||
| Red Hat Enterprise Linux 7 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 9 | kernel | Affected | ||
| Red Hat Enterprise Linux 9 | kernel-rt | Not affected | ||
| Red Hat OpenShift Container Platform 4 | openshift/ose-rhel-coreos-8 | Not affected | ||
| Red Hat OpenShift Container Platform 4 | openshift/ose-rhel-coreos-9 | Affected |
Показывать по
Дополнительная информация
Статус:
4.7 Medium
CVSS3
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: futex: Also allocate private hash on vfork() As Jann demonstrated, it is entirely feasible to access the mm through vfork(). Therefore we need to allocate a private hash on vfork() as well as any other CLONE_VM user. Specifically, it must be avoided to have (private) futex waiters before allocating the private hash.
In the Linux kernel, the following vulnerability has been resolved: futex: Also allocate private hash on vfork() As Jann demonstrated, it is entirely feasible to access the mm through vfork(). Therefore we need to allocate a private hash on vfork() as well as any other CLONE_VM user. Specifically, it must be avoided to have (private) futex waiters before allocating the private hash.
In the Linux kernel, the following vulnerability has been resolved: f ...
In the Linux kernel, the following vulnerability has been resolved: futex: Also allocate private hash on vfork() As Jann demonstrated, it is entirely feasible to access the mm through vfork(). Therefore we need to allocate a private hash on vfork() as well as any other CLONE_VM user. Specifically, it must be avoided to have (private) futex waiters before allocating the private hash.
4.7 Medium
CVSS3