Bug 1202013 (CVE-2022-2590) - VUL-0: CVE-2022-2590: kernel-source: fix FOLL_FORCE COW security issue and remove FOLL_COW
Summary: VUL-0: CVE-2022-2590: kernel-source: fix FOLL_FORCE COW security issue and re...
Status: RESOLVED FIXED
Alias: CVE-2022-2590
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Assignee: Security Team bot
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/338547/
Whiteboard: CVSSv3.1:SUSE:CVE-2022-2590:7.8:(AV:L...
Keywords:
Depends on:
Blocks: 1202089
  Show dependency tree / graph
 
Reported: 2022-08-01 08:28 UTC by Robert Frohl
Modified: 2024-04-19 11:32 UTC (History)
5 users (show)

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Comment 8 Thomas Leroy 2022-08-08 10:03:39 UTC 
Public on oss-security ML:

"
Hi,

I found a security issue (CVE-2022-2590) in the Linux kernel similar to
Dirty COW (CVE-2016-5195), however, restricted to shared memory (shmem /
tmpfs). I notified distributions one week ago and the embargo ended today.

An unprivileged user can modify file content of a shmem (tmpfs) file,
even if that user does not have write permissions to the file. The file
could be an executable.

The introducing upstream commit ID is:
  9ae0f87d009c ("mm/shmem: unconditionally set pte dirty in
  mfill_atomic_install_pte")

Linux >= v5.16 is affected on x86-64 and aarch64 if the kernel is
compiled with CONFIG_USERFAULTFD=y. For Linux < v5.19 it's sufficient to
revert the problematic commit, which is possible with minor contextual
conflicts. For Linux >= v5.19 I'll send a proposal fix today.

I have a working reproducer that I will post as reply to this mail in
one week (August 15).

-- 
Thanks,

David / dhildenb
"
Comment 9 Robert Frohl 2022-08-08 11:32:35 UTC 
closing, as we are not affected
Comment 12 Jiri Slaby 2022-08-11 08:48:52 UTC 
Pushed to stable, feel free to close as you wish.
Comment 18 Robert Frohl 2024-04-19 11:32:49 UTC 
done