CVE-2024-42251: Vulnerability in Linux Linux

Severity: highType: vulnerabilityCVE-2024-42251

In the Linux kernel, the following vulnerability has been resolved: mm: page_ref: remove folio_try_get_rcu() The below bug was reported on a non-SMP kernel: [ 275.267158][ T4335] ------------[ cut here ]------------ [ 275.267949][ T4335] kernel BUG at include/linux/page_ref.h:275! [ 275.268526][ T4335] invalid opcode: 0000 [#1] KASAN PTI [ 275.269001][ T4335] CPU: 0 PID: 4335 Comm: trinity-c3 Not tainted 6.7.0-rc4-00061-gefa7df3e3bb5 #1 [ 275.269787][ T4335] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 [ 275.270679][ T4335] RIP: 0010:try_get_folio (include/linux/page_ref.h:275 (discriminator 3) mm/gup.c:79 (discriminator 3)) [ 275.272813][ T4335] RSP: 0018:ffffc90005dcf650 EFLAGS: 00010202 [ 275.273346][ T4335] RAX: 0000000000000246 RBX: ffffea00066e0000 RCX: 0000000000000000 [ 275.274032][ T4335] RDX: fffff94000cdc007 RSI: 0000000000000004 RDI: ffffea00066e0034 [ 275.274719][ T4335] RBP: ffffea00066e0000 R08: 0000000000000000 R09: fffff94000cdc006 [ 275.275404][ T4335] R10: ffffea00066e0037 R11: 0000000000000000 R12: 0000000000000136 [ 275.276106][ T4335] R13: ffffea00066e0034 R14: dffffc0000000000 R15: ffffea00066e0008 [ 275.276790][ T4335] FS: 00007fa2f9b61740(0000) GS:ffffffff89d0d000(0000) knlGS:0000000000000000 [ 275.277570][ T4335] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 275.278143][ T4335] CR2: 00007fa2f6c00000 CR3: 0000000134b04000 CR4: 00000000000406f0 [ 275.278833][ T4335] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 275.279521][ T4335] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 275.280201][ T4335] Call Trace: [ 275.280499][ T4335] <TASK> [ 275.280751][ T4335] ? die (arch/x86/kernel/dumpstack.c:421 arch/x86/kernel/dumpstack.c:434 arch/x86/kernel/dumpstack.c:447) [ 275.281087][ T4335] ? do_trap (arch/x86/kernel/traps.c:112 arch/x86/kernel/traps.c:153) [ 275.281463][ T4335] ? try_get_folio (include/linux/page_ref.h:275 (discriminator 3) mm/gup.c:79 (discriminator 3)) [ 275.281884][ T4335] ? try_get_folio (include/linux/page_ref.h:275 (discriminator 3) mm/gup.c:79 (discriminator 3)) [ 275.282300][ T4335] ? do_error_trap (arch/x86/kernel/traps.c:174) [ 275.282711][ T4335] ? try_get_folio (include/linux/page_ref.h:275 (discriminator 3) mm/gup.c:79 (discriminator 3)) [ 275.283129][ T4335] ? handle_invalid_op (arch/x86/kernel/traps.c:212) [ 275.283561][ T4335] ? try_get_folio (include/linux/page_ref.h:275 (discriminator 3) mm/gup.c:79 (discriminator 3)) [ 275.283990][ T4335] ? exc_invalid_op (arch/x86/kernel/traps.c:264) [ 275.284415][ T4335] ? asm_exc_invalid_op (arch/x86/include/asm/idtentry.h:568) [ 275.284859][ T4335] ? try_get_folio (include/linux/page_ref.h:275 (discriminator 3) mm/gup.c:79 (discriminator 3)) [ 275.285278][ T4335] try_grab_folio (mm/gup.c:148) [ 275.285684][ T4335] __get_user_pages (mm/gup.c:1297 (discriminator 1)) [ 275.286111][ T4335] ? __pfx___get_user_pages (mm/gup.c:1188) [ 275.286579][ T4335] ? __pfx_validate_chain (kernel/locking/lockdep.c:3825) [ 275.287034][ T4335] ? mark_lock (kernel/locking/lockdep.c:4656 (discriminator 1)) [ 275.287416][ T4335] __gup_longterm_locked (mm/gup.c:1509 mm/gup.c:2209) [ 275.288192][ T4335] ? __pfx___gup_longterm_locked (mm/gup.c:2204) [ 275.288697][ T4335] ? __pfx_lock_acquire (kernel/locking/lockdep.c:5722) [ 275.289135][ T4335] ? __pfx___might_resched (kernel/sched/core.c:10106) [ 275.289595][ T4335] pin_user_pages_remote (mm/gup.c:3350) [ 275.290041][ T4335] ? __pfx_pin_user_pages_remote (mm/gup.c:3350) [ 275.290545][ T4335] ? find_held_lock (kernel/locking/lockdep.c:5244 (discriminator 1)) [ 275.290961][ T4335] ? mm_access (kernel/fork.c:1573) [ 275.291353][ T4335] process_vm_rw_single_vec+0x142/0x360 [ 275.291900][ T4335] ? __pfx_process_vm_rw_single_vec+0x10/0x10 [ 275.292471][ T4335] ? mm_access (kernel/fork.c:1573) [ 275.292859][ T4335] process_vm_rw_core+0x272/0x4e0 [ 275.293384][ T4335] ? hlock_class (a ---truncated---

AI Analysis

Technical Summary

CVE-2024-42251 is a vulnerability identified in the Linux kernel, specifically related to the memory management subsystem. The issue arises from the removal of the function folio_try_get_rcu() in the page reference handling code, which led to a kernel bug manifesting as an invalid opcode exception and kernel crash (BUG) in the try_get_folio() function. The vulnerability was observed on a non-SMP (single processor) kernel version 6.7.0-rc4, with kernel address sanitizer (KASAN) and page table isolation (PTI) enabled, indicating a memory reference counting or page handling flaw. The bug trace shows that the kernel attempts to get a reference to a memory folio but encounters an invalid operation, causing a kernel panic. The root cause is a race or logic error in the page reference counting mechanism, which can lead to kernel crashes or undefined behavior when user-space processes invoke certain memory operations such as process_vm_rw_core or pin_user_pages_remote. Although no known exploits are currently reported in the wild, the vulnerability could be triggered by local processes with permissions to interact with memory management syscalls or kernel interfaces. The vulnerability affects Linux kernel versions prior to the patch that removed the problematic function and fixed the page_ref.h implementation. No CVSS score has been assigned yet, but the technical details indicate a serious kernel stability and potential denial-of-service issue. The vulnerability does not appear to allow direct privilege escalation or code execution but can cause system crashes and instability.

Potential Impact

For European organizations, this vulnerability poses a significant risk to the stability and availability of Linux-based systems, which are widely used in servers, cloud infrastructure, and embedded devices. A successful exploitation could lead to kernel panics and system reboots, causing denial of service (DoS) conditions. This is particularly critical for data centers, cloud service providers, and enterprises relying on Linux for critical infrastructure, as unexpected downtime can disrupt business operations and service availability. While no direct remote exploitation vector is indicated, local attackers or compromised accounts could trigger the flaw to escalate disruption. The impact on confidentiality and integrity is limited as the vulnerability primarily causes crashes rather than arbitrary code execution or data leakage. However, repeated crashes could be leveraged as part of a broader attack chain to weaken system defenses or cause cascading failures in distributed systems. The lack of known exploits reduces immediate threat but does not eliminate risk, especially in environments with untrusted users or multi-tenant cloud platforms common in Europe.

Mitigation Recommendations

European organizations should prioritize updating their Linux kernels to the latest stable versions that include the patch for CVE-2024-42251. Kernel upgrades should be tested and deployed promptly, especially on production servers and critical infrastructure. For environments where immediate patching is not feasible, restricting access to kernel interfaces related to memory management syscalls (such as process_vm_rw_core and pin_user_pages_remote) can reduce exploitation risk. Implementing strict user privilege separation and minimizing the number of users with local shell or root access will limit the ability to trigger the vulnerability. Monitoring kernel logs for unusual crashes or BUG messages referencing page_ref.h or try_get_folio can help detect exploitation attempts. Additionally, employing kernel hardening features such as KASAN and PTI, as well as using security modules like SELinux or AppArmor to confine processes, can mitigate impact. For cloud providers and multi-tenant environments, isolating workloads and applying kernel live patching where supported can reduce downtime and exposure. Finally, maintaining an incident response plan for kernel-level DoS events will improve resilience.