CVE-2024-45024 is a vulnerability in the Linux kernel's memory management subsystem, specifically related to the handling of huge pages (hugetlb) and page table locking mechanisms. The issue arises from a mismatch in locking protocols when the kernel walks page tables for huge pages that span multiple page table entries (PTEs), particularly on architectures like arm64 with 64 KiB hugetlb folios and 4 KiB base page sizes. The vulnerability is rooted in the fact that the Get User Pages (GUP) code, which walks page tables to pin user pages in memory, uses a different locking approach (pte_offset_map_lock) compared to the locking used when modifying these page tables (mm->page_table_lock) under certain kernel configurations such as USE_SPLIT_PTE_PTLOCKS or USE_SPLIT_PMD_PTLOCKS. This discrepancy can lead to race conditions or inconsistent locking states, potentially causing kernel warnings, crashes, or memory corruption. The vulnerability was demonstrated with a kernel warning and call trace indicating a failure in try_grab_folio(), a function involved in acquiring locks on folios during page table walking. The fix involves harmonizing the locking strategy by making huge_pte_lockptr() use the same page table locks as the core memory management code, adding a ptep_lockptr() function to obtain the correct PTE lock, and handling various kernel configurations and architectures correctly. This patch ensures consistent locking across different page table levels and huge page mappings, preventing race conditions and instability. The vulnerability affects Linux kernel versions prior to the patch and is relevant for systems using huge pages, especially on ARM64 and other architectures with complex page table layouts. No known exploits are reported in the wild as of the publication date.

For European organizations, this vulnerability poses a risk primarily to servers and systems running Linux kernels with huge page support enabled, particularly those on ARM64 architectures or other affected platforms. Huge pages are commonly used in high-performance computing, database servers, and virtualization environments to improve memory management efficiency. Exploitation could lead to kernel crashes or memory corruption, resulting in denial of service (DoS) conditions that disrupt critical services. While there is no evidence of remote code execution or privilege escalation directly linked to this flaw, the instability caused by inconsistent locking could be leveraged as part of a broader attack chain or cause operational disruptions. Organizations relying on Linux-based infrastructure for cloud services, container orchestration, or virtualization may experience service interruptions or degraded performance. The impact is heightened in environments where uptime and reliability are critical, such as financial institutions, telecommunications, and public sector services. Additionally, debugging and recovery from kernel crashes can incur operational costs and potential data loss if not properly managed.

European organizations should prioritize updating their Linux kernel to the patched versions that address CVE-2024-45024 as soon as they become available from their distribution vendors. Given the complexity of the issue, relying on vendor patches is the most reliable mitigation. For environments where immediate patching is not feasible, administrators should consider disabling huge page support if it is not essential, thereby reducing exposure. Monitoring kernel logs for warnings related to try_grab_folio or page table locking anomalies can help detect attempts to trigger the vulnerability. Additionally, organizations should ensure that their kernel configurations avoid split page table locks unless necessary, as this configuration contributes to the vulnerability. For critical systems, implementing robust kernel crash recovery and memory integrity monitoring can mitigate operational impacts. Finally, maintaining strict access controls and limiting untrusted code execution on affected systems reduces the risk of exploitation attempts.