The Linux Kernel versions 2.6.38 through 4.14 have a problematic use of pmd_mkdirty() in the touch_pmd() function inside the THP implementation. touch_pmd() can be reached by get_user_pages(). In such case, the pmd will become dirty. This scenario breaks the new can_follow_write_pmd()'s logic - pmd can become dirty without going through a COW cycle. This bug is not as severe as the original "Dirty cow" because an ext4 file (or any other regular file) cannot be mapped using THP. Nevertheless, it does allow us to overwrite read-only huge pages. For example, the zero huge page and sealed shmem files can be overwritten (since their mapping can be populated using THP). Note that after the first write page-fault to the zero page, it will be replaced with a new fresh (and zeroed) thp.
CVSS Details
- CVSS 3.1 Base Score: 7
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade python-perf-debuginfoUpgrade perf-debuginfoUpgrade python-perfUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-headersUpgrade kernelUpgrade kernel-tools-debuginfoUpgrade perfUpgrade kernel-develUpgrade kernel-toolsUpgrade kernel-docUpgrade kernel-tools-develUpgrade kernel-debuginfo | Apr 27, 2020 | Nov 30, 2017 |
| Amazon_linux | — | Upgrade kernel | Dec 22, 2017 | Nov 30, 2017 |
| Debian | — | Upgrade linux | Jul 30, 2024 | Nov 30, 2017 |
| Oracle_linux | — | Upgrade kernel-uek | Dec 8, 2017 | Nov 30, 2017 |
| Suse | — | Upgrade kernel-ec2-develUpgrade kernel-docsUpgrade kernel-livepatch-4_12_14-150_41-defaultUpgrade kernel-livepatch-4_12_14-197_26-defaultUpgrade kernel-ec2Upgrade cluster-md-kmp-defaultUpgrade kernel-obs-buildUpgrade dlm-kmp-defaultUpgrade cluster-network-kmp-defaultUpgrade ocfs2-kmp-defaultUpgrade gfs2-kmp-defaultUpgrade kernel-ec2-extraUpgrade kernel-default | Dec 5, 2017 | Nov 30, 2017 |
| Ubuntu | — | Upgrade linux-image-powerpc-smpUpgrade linux-image-powerpc64-embUpgrade linux-image-4.11.0-1016-azureUpgrade linux-image-4.4.0-103-powerpc64-smpUpgrade linux-image-4.4.0-103-powerpc-e500mcUpgrade linux-image-4.13.0-1008-raspi2Upgrade linux-image-4.4.0-1079-raspi2Upgrade linux-image-powerpc-e500mcUpgrade linux-image-4.10.0-42-genericUpgrade linux-image-generic-lpaeUpgrade linux-image-lowlatency-lts-xenialUpgrade linux-image-4.13.0-1002-gcpUpgrade linux-image-kvmUpgrade linux-image-4.4.0-103-genericUpgrade linux-image-4.10.0-42-generic-lpaeUpgrade linux-image-3.13.0-137-powerpc-smpUpgrade linux-image-3.13.0-137-generic-lpaeUpgrade linux-image-gcpUpgrade linux-image-4.13.0-19-generic-lpaeUpgrade linux-image-3.13.0-137-powerpc64-smpUpgrade linux-image-gkeUpgrade linux-image-4.10.0-1023-raspi2Upgrade linux-image-powerpc-smp-lts-xenialUpgrade linux-image-generic-lpae-hwe-16.04Upgrade linux-image-generic-hwe-16.04Upgrade linux-image-4.4.0-1012-kvmUpgrade linux-image-powerpc64-emb-lts-xenialUpgrade linux-image-lowlatencyUpgrade linux-image-4.4.0-103-powerpc-smpUpgrade linux-image-generic-lts-xenialUpgrade linux-image-4.10.0-42-lowlatencyUpgrade linux-image-raspi2Upgrade linux-image-generic-lpae-lts-xenialUpgrade linux-image-4.4.0-103-powerpc64-embUpgrade linux-image-powerpc-e500Upgrade linux-image-azureUpgrade linux-image-snapdragonUpgrade linux-image-powerpc-e500mc-lts-xenialUpgrade linux-image-generic-lts-trustyUpgrade linux-image-3.13.0-137-powerpc64-embUpgrade linux-image-3.13.0-137-powerpc-e500mcUpgrade linux-image-4.4.0-103-lowlatencyUpgrade linux-image-4.4.0-1043-awsUpgrade linux-image-4.13.0-19-lowlatencyUpgrade linux-image-lowlatency-hwe-16.04Upgrade linux-image-generic-lpae-lts-trustyUpgrade linux-image-4.4.0-103-generic-lpaeUpgrade linux-image-3.13.0-137-genericUpgrade linux-image-3.13.0-137-powerpc-e500Upgrade linux-image-4.13.0-19-genericUpgrade linux-image-4.4.0-1005-awsUpgrade linux-image-awsUpgrade linux-image-genericUpgrade linux-image-powerpc64-smpUpgrade linux-image-3.13.0-137-lowlatencyUpgrade linux-image-4.4.0-1081-snapdragonUpgrade linux-image-powerpc64-smp-lts-xenial | Dec 8, 2017 | Nov 30, 2017 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Nov 30, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub