CVE-2022-2590

Published: 8 August 2022

A race condition was found in the way the Linux kernel's memory subsystem handled the copy-on-write (COW) breakage of private read-only shared memory mappings. This flaw allows an unprivileged, local user to gain write access to read-only memory mappings, increasing their privileges on the system.

From the Ubuntu Security Team

David Hildenbrand discovered that a race condition existed in the memory manager of the Linux kernel when handling copy-on-write with shared memory pages. A local attacker could use this to cause a denial of service (system crash) or execute arbitrary code.

Notes

introduced in 9ae0f87d009c ("mm/shmem: unconditionally set
pte dirty in mfill_atomic_install_pte") (v5.16)
from reporter: "Kernels before extended uffd-wp support and
before PageAnonExclusive (< 5.19) can simply revert 9ae0f87d009c
instead and be safe regarding UFFDIO_CONTINUE.

Status

Severity score breakdown

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2590
• https://lore.kernel.org/linux-mm/20220808073232.8808-1-david@redhat.com/
• https://www.openwall.com/lists/oss-security/2022/08/08/1
• NVD
• Launchpad
• Debian