CVE-2024-42233 (GCVE-0-2024-42233)

Vulnerability from cvelistv5 – Published: 2024-08-07 15:14 – Updated: 2026-08-05 11:35
VLAI
Title
filemap: replace pte_offset_map() with pte_offset_map_nolock()
Summary
In the Linux kernel, the following vulnerability has been resolved: filemap: replace pte_offset_map() with pte_offset_map_nolock() The vmf->ptl in filemap_fault_recheck_pte_none() is still set from handle_pte_fault(). But at the same time, we did a pte_unmap(vmf->pte). After a pte_unmap(vmf->pte) unmap and rcu_read_unlock(), the page table may be racily changed and vmf->ptl maybe fails to protect the actual page table. Fix this by replacing pte_offset_map() with pte_offset_map_nolock(). As David said, the PTL pointer might be stale so if we continue to use it infilemap_fault_recheck_pte_none(), it might trigger UAF. Also, if the PTL fails, the issue fixed by commit 58f327f2ce80 ("filemap: avoid unnecessary major faults in filemap_fault()") might reappear.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-10 16:14 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 58f327f2ce80f9c7b4a70e9cf017ae8810d44a20 , < 6a6c2aec1a89506595801b4cf7e8eef035f33748 (git)
Affected: 58f327f2ce80f9c7b4a70e9cf017ae8810d44a20 , < 24be02a42181f0707be0498045c4c4b13273b16d (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.9
Unaffected: 0 , < 6.9 (semver)
Unaffected: 6.9.10 , ≤ 6.9.* (semver)
Unaffected: 6.10 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-42233",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T16:14:13.816205Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:34:32.513Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "mm/filemap.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6a6c2aec1a89506595801b4cf7e8eef035f33748",
              "status": "affected",
              "version": "58f327f2ce80f9c7b4a70e9cf017ae8810d44a20",
              "versionType": "git"
            },
            {
              "lessThan": "24be02a42181f0707be0498045c4c4b13273b16d",
              "status": "affected",
              "version": "58f327f2ce80f9c7b4a70e9cf017ae8810d44a20",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "mm/filemap.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.9"
            },
            {
              "lessThan": "6.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.9.*",
              "status": "unaffected",
              "version": "6.9.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.10",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9.10",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfilemap: replace pte_offset_map() with pte_offset_map_nolock()\n\nThe vmf-\u003eptl in filemap_fault_recheck_pte_none() is still set from\nhandle_pte_fault().  But at the same time, we did a pte_unmap(vmf-\u003epte). \nAfter a pte_unmap(vmf-\u003epte) unmap and rcu_read_unlock(), the page table\nmay be racily changed and vmf-\u003eptl maybe fails to protect the actual page\ntable.  Fix this by replacing pte_offset_map() with\npte_offset_map_nolock().\n\nAs David said, the PTL pointer might be stale so if we continue to use\nit infilemap_fault_recheck_pte_none(), it might trigger UAF.  Also, if\nthe PTL fails, the issue fixed by commit 58f327f2ce80 (\"filemap: avoid\nunnecessary major faults in filemap_fault()\") might reappear."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is triggered by a normal page fault on a locally mmap\u0027ed file, reached through mmap/mlock2/madvise syscalls by a process on the machine. There is no network-facing path to `filemap_fault()`.\nAC:L - Although a race is involved, the attacker owns both sides of it: one thread faults on its own mlocked, page-cache-cold file mapping while another unprivileged thread issues `MADV_COLLAPSE`, and both only need `mmap_lock` read so they run concurrently. All preconditions (VM_LOCKED, pte_none, page-cache miss, page-table collapse) are set up deterministically by the attacker and the attempt can be retried in a tight loop.\nPR:L - Only an ordinary unprivileged local user account is required \u2014 `can_do_mlock()` passes on the default nonzero RLIMIT_MEMLOCK with no capability, and `MADV_COLLAPSE` requires no privilege. No root, no CAP_* and no namespace tricks are needed.\nUI:N - The attacker\u0027s own threads perform every step \u2014 mapping and locking a file, faulting on it, and collapsing the page table. No victim action or interaction is involved.\nS:U - The use-after-free corrupts kernel memory within the same kernel security authority; there is no crossing of a VM, IOMMU, or other security-authority boundary.\nC:H - This is a use-after-free on the split page-table lock: `spin_lock()`/`spin_unlock()` read a freed object that the attacker can have reallocated with sprayed content, and the resulting slab/`struct page` metadata corruption (overlapping allocations) is a well-known route to arbitrary kernel memory disclosure.\nI:H - Taking the stale lock writes into freed memory \u2014 either a reallocated `kmem_cache` object (ALLOC_SPLIT_PTLOCKS) or word 5 of a reused `struct page`, which aliases `struct slab::counters` (inuse/objects/frozen) and `page-\u003eprivate`. Corrupting slab metadata yields overlapping object allocations and a path to arbitrary write and control-flow hijack.\nA:H - A use-after-free on a spinlock reliably produces oopses, slab corruption panics, and deadlocks/hangs when the freed lock word is reused and never released. Any unprivileged user can trigger it repeatedly to crash the system."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:35:58.248Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/6a6c2aec1a89506595801b4cf7e8eef035f33748"
        },
        {
          "url": "https://git.kernel.org/stable/c/24be02a42181f0707be0498045c4c4b13273b16d"
        }
      ],
      "title": "filemap: replace pte_offset_map() with pte_offset_map_nolock()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-42233",
    "datePublished": "2024-08-07T15:14:23.858Z",
    "dateReserved": "2024-07-30T07:40:12.251Z",
    "dateUpdated": "2026-08-05T11:35:58.248Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-42233",
      "date": "2026-09-29",
      "epss": "0.00192",
      "percentile": "0.07943"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "mm/filemap.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "6a6c2aec1a89506595801b4cf7e8eef035f33748",
                    "status": "affected",
                    "version": "58f327f2ce80f9c7b4a70e9cf017ae8810d44a20",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "24be02a42181f0707be0498045c4c4b13273b16d",
                    "status": "affected",
                    "version": "58f327f2ce80f9c7b4a70e9cf017ae8810d44a20",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "mm/filemap.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.9"
                  },
                  {
                    "lessThan": "6.9",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.9.*",
                    "status": "unaffected",
                    "version": "6.9.10",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.10",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "0F5C3789-472B-40EC-9D2A-48169EDB592B",
                    "versionEndExcluding": "6.9.10",
                    "versionStartIncluding": "6.9",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfilemap: replace pte_offset_map() with pte_offset_map_nolock()\n\nThe vmf-\u003eptl in filemap_fault_recheck_pte_none() is still set from\nhandle_pte_fault().  But at the same time, we did a pte_unmap(vmf-\u003epte). \nAfter a pte_unmap(vmf-\u003epte) unmap and rcu_read_unlock(), the page table\nmay be racily changed and vmf-\u003eptl maybe fails to protect the actual page\ntable.  Fix this by replacing pte_offset_map() with\npte_offset_map_nolock().\n\nAs David said, the PTL pointer might be stale so if we continue to use\nit infilemap_fault_recheck_pte_none(), it might trigger UAF.  Also, if\nthe PTL fails, the issue fixed by commit 58f327f2ce80 (\"filemap: avoid\nunnecessary major faults in filemap_fault()\") might reappear."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: filemap: reemplace pte_offset_map() con pte_offset_map_nolock() El vmf-\u0026gt;ptl en filemap_fault_recheck_pte_none() todav\u00eda est\u00e1 configurado desde handle_pte_fault(). Pero al mismo tiempo, hicimos un pte_unmap(vmf-\u0026gt;pte). Despu\u00e9s de desasignar pte_unmap(vmf-\u0026gt;pte) y rcu_read_unlock(), la tabla de p\u00e1ginas puede cambiarse r\u00e1pidamente y vmf-\u0026gt;ptl tal vez no pueda proteger la tabla de p\u00e1ginas real. Solucione este problema reemplazando pte_offset_map() con pte_offset_map_nolock(). Como dijo David, el puntero PTL puede estar obsoleto, por lo que si continuamos us\u00e1ndolo en filemap_fault_recheck_pte_none(), podr\u00eda activar UAF. Adem\u00e1s, si el PTL falla, el problema solucionado mediante el commit 58f327f2ce80 (\"filemap: evite errores importantes innecesarios en filemap_fault()\") podr\u00eda reaparecer."
          }
        ],
        "id": "CVE-2024-42233",
        "lastModified": "2026-08-04T11:19:40.180",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "NONE",
                "baseScore": 3.3,
                "baseSeverity": "LOW",
                "confidentialityImpact": "NONE",
                "integrityImpact": "LOW",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 1.4,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2024-42233",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T16:14:13.816205Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-08-07T16:15:46.313",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/24be02a42181f0707be0498045c4c4b13273b16d"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/6a6c2aec1a89506595801b4cf7e8eef035f33748"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "NVD-CWE-noinfo"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T18:28:32+00:00",
      "cve": "CVE-2024-42233",
      "id": "CVE-2024-42233",
      "initial_release_date": "2024-08-07T00:00:00+00:00",
      "product_status:known_affected": "42",
      "product_status:known_not_affected": "156",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: filemap: replace pte_offset_map() with pte_offset_map_nolock()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-42233.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2024-42233",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-09-10T16:14:13.816205Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-09-11T12:42:24.316Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "mm/filemap.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "6a6c2aec1a89506595801b4cf7e8eef035f33748",
                  "status": "affected",
                  "version": "58f327f2ce80f9c7b4a70e9cf017ae8810d44a20",
                  "versionType": "git"
                },
                {
                  "lessThan": "24be02a42181f0707be0498045c4c4b13273b16d",
                  "status": "affected",
                  "version": "58f327f2ce80f9c7b4a70e9cf017ae8810d44a20",
                  "versionType": "git"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "mm/filemap.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "6.9"
                },
                {
                  "lessThan": "6.9",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.9.*",
                  "status": "unaffected",
                  "version": "6.9.10",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "6.10",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.9.10",
                      "versionStartIncluding": "6.9",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.10",
                      "versionStartIncluding": "6.9",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfilemap: replace pte_offset_map() with pte_offset_map_nolock()\n\nThe vmf-\u003eptl in filemap_fault_recheck_pte_none() is still set from\nhandle_pte_fault().  But at the same time, we did a pte_unmap(vmf-\u003epte). \nAfter a pte_unmap(vmf-\u003epte) unmap and rcu_read_unlock(), the page table\nmay be racily changed and vmf-\u003eptl maybe fails to protect the actual page\ntable.  Fix this by replacing pte_offset_map() with\npte_offset_map_nolock().\n\nAs David said, the PTL pointer might be stale so if we continue to use\nit infilemap_fault_recheck_pte_none(), it might trigger UAF.  Also, if\nthe PTL fails, the issue fixed by commit 58f327f2ce80 (\"filemap: avoid\nunnecessary major faults in filemap_fault()\") might reappear."
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2025-05-04T09:24:42.605Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/6a6c2aec1a89506595801b4cf7e8eef035f33748"
            },
            {
              "url": "https://git.kernel.org/stable/c/24be02a42181f0707be0498045c4c4b13273b16d"
            }
          ],
          "title": "filemap: replace pte_offset_map() with pte_offset_map_nolock()",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2024-42233",
        "datePublished": "2024-08-07T15:14:23.858Z",
        "dateReserved": "2024-07-30T07:40:12.251Z",
        "dateUpdated": "2025-05-04T09:24:42.605Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.