In the Linux kernel, the following vulnerability has been resolved:
mm/hugetlb: fix missing hugetlb_lock for resv uncharge
There is a recent report on UFFDIO_COPY over hugetlb:
https://lore.kernel.org/all/000000000000ee06de0616177560@google.com/
350: lockdepassertheld(&hugetlb_lock);
Should be an issue in hugetlb but triggered in an userfault context, where it goes into the unlikely path where two threads modifying the resv map together. Mike has a fix in that path for resv uncharge but it looks like the locking criteria was overlooked: hugetlbcgroupunchargefoliorsvd() will update the cgroup pointer, so it requires to be called with the lock held.
[
{
"digest": {
"length": 1866.0,
"function_hash": "325739822129164253692856992496426418818"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4c806333efea1000a2a9620926f560ad2e1ca7cc",
"signature_version": "v1",
"target": {
"function": "alloc_huge_page",
"file": "mm/hugetlb.c"
},
"deprecated": false,
"id": "CVE-2024-36000-18d2d4d4",
"signature_type": "Function"
},
{
"digest": {
"length": 1838.0,
"function_hash": "213139158964525205062957735504861041992"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f6c5d21db16a0910152ec8aa9d5a7aed72694505",
"signature_version": "v1",
"target": {
"function": "alloc_hugetlb_folio",
"file": "mm/hugetlb.c"
},
"deprecated": false,
"id": "CVE-2024-36000-5464768f",
"signature_type": "Function"
},
{
"digest": {
"line_hashes": [
"44658392075739321432911822150038086854",
"203252930955310692966047532930339114114",
"270687282463260768589715137671224055046",
"133585617090580495022069449005144613665",
"59584724654044227546051219758449742139",
"284797177730935485593110384241748734616"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4c806333efea1000a2a9620926f560ad2e1ca7cc",
"signature_version": "v1",
"target": {
"file": "mm/hugetlb.c"
},
"deprecated": false,
"id": "CVE-2024-36000-800b84ca",
"signature_type": "Line"
},
{
"digest": {
"line_hashes": [
"44658392075739321432911822150038086854",
"203252930955310692966047532930339114114",
"270687282463260768589715137671224055046",
"133585617090580495022069449005144613665",
"263968866789984571162417205340631200699",
"255849068980868836307893278951451654221"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b76b46902c2d0395488c8412e1116c2486cdfcb2",
"signature_version": "v1",
"target": {
"file": "mm/hugetlb.c"
},
"deprecated": false,
"id": "CVE-2024-36000-a5533233",
"signature_type": "Line"
},
{
"digest": {
"length": 2225.0,
"function_hash": "157960011210886002407838639621001095827"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b76b46902c2d0395488c8412e1116c2486cdfcb2",
"signature_version": "v1",
"target": {
"function": "alloc_hugetlb_folio",
"file": "mm/hugetlb.c"
},
"deprecated": false,
"id": "CVE-2024-36000-e85ae7b0",
"signature_type": "Function"
},
{
"digest": {
"line_hashes": [
"44658392075739321432911822150038086854",
"203252930955310692966047532930339114114",
"270687282463260768589715137671224055046",
"133585617090580495022069449005144613665",
"298782859647529647222968981550994169199",
"82562848269826016502592094480883753969"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f6c5d21db16a0910152ec8aa9d5a7aed72694505",
"signature_version": "v1",
"target": {
"file": "mm/hugetlb.c"
},
"deprecated": false,
"id": "CVE-2024-36000-fcaf5cb4",
"signature_type": "Line"
}
]