Bug 2300385 (CVE-2024-41027)

Summary:	CVE-2024-41027 kernel: Fix userfaultfd_api to return EINVAL as expected
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	dfreiber, drow, jburrell, vkumar
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	kernel 5.15.163, kernel 6.1.100, kernel 6.6.41, kernel 6.9.10, kernel 6.10	Doc Type:	If docs needed, set a value
Doc Text:	A vulnerability was found in the Linux kernel in the userfaultfd_api() function where improper error handling means that if a user requests a feature that is not supported by the kernel config it will fail silently and return all available features, a behavior which differs with what the man pages indicates should be done (return an EINVAL).	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2301520
Bug Blocks:

Description OSIDB Bzimport 2024-07-29 15:21:34 UTC

In the Linux kernel, the following vulnerability has been resolved:

Fix userfaultfd_api to return EINVAL as expected

Currently if we request a feature that is not set in the Kernel config we
fail silently and return all the available features.  However, the man
page indicates we should return an EINVAL.

We need to fix this issue since we can end up with a Kernel warning should
a program request the feature UFFD_FEATURE_WP_UNPOPULATED on a kernel with
the config not set with this feature.

 [  200.812896] WARNING: CPU: 91 PID: 13634 at mm/memory.c:1660 zap_pte_range+0x43d/0x660
 [  200.820738] Modules linked in:
 [  200.869387] CPU: 91 PID: 13634 Comm: userfaultfd Kdump: loaded Not tainted 6.9.0-rc5+ #8
 [  200.877477] Hardware name: Dell Inc. PowerEdge R6525/0N7YGH, BIOS 2.7.3 03/30/2022
 [  200.885052] RIP: 0010:zap_pte_range+0x43d/0x660

Comment 1 Mauro Matteo Cascella 2024-07-30 08:40:33 UTC

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024072920-CVE-2024-41027-24c4@gregkh/T

Comment 2 Mauro Matteo Cascella 2024-07-30 08:40:53 UTC

Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 2301520]