CVE-2025-22090 (GCVE-0-2025-22090)
Vulnerability from cvelistv5
Published
2025-04-16 14:12
Modified
2025-05-26 05:18
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: x86/mm/pat: Fix VM_PAT handling when fork() fails in copy_page_range() If track_pfn_copy() fails, we already added the dst VMA to the maple tree. As fork() fails, we'll cleanup the maple tree, and stumble over the dst VMA for which we neither performed any reservation nor copied any page tables. Consequently untrack_pfn() will see VM_PAT and try obtaining the PAT information from the page table -- which fails because the page table was not copied. The easiest fix would be to simply clear the VM_PAT flag of the dst VMA if track_pfn_copy() fails. However, the whole thing is about "simply" clearing the VM_PAT flag is shaky as well: if we passed track_pfn_copy() and performed a reservation, but copying the page tables fails, we'll simply clear the VM_PAT flag, not properly undoing the reservation ... which is also wrong. So let's fix it properly: set the VM_PAT flag only if the reservation succeeded (leaving it clear initially), and undo the reservation if anything goes wrong while copying the page tables: clearing the VM_PAT flag after undoing the reservation. Note that any copied page table entries will get zapped when the VMA will get removed later, after copy_page_range() succeeded; as VM_PAT is not set then, we won't try cleaning VM_PAT up once more and untrack_pfn() will be happy. Note that leaving these page tables in place without a reservation is not a problem, as we are aborting fork(); this process will never run. A reproducer can trigger this usually at the first try: https://gitlab.com/davidhildenbrand/scratchspace/-/raw/main/reproducers/pat_fork.c WARNING: CPU: 26 PID: 11650 at arch/x86/mm/pat/memtype.c:983 get_pat_info+0xf6/0x110 Modules linked in: ... CPU: 26 UID: 0 PID: 11650 Comm: repro3 Not tainted 6.12.0-rc5+ #92 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-2.fc40 04/01/2014 RIP: 0010:get_pat_info+0xf6/0x110 ... Call Trace: <TASK> ... untrack_pfn+0x52/0x110 unmap_single_vma+0xa6/0xe0 unmap_vmas+0x105/0x1f0 exit_mmap+0xf6/0x460 __mmput+0x4b/0x120 copy_process+0x1bf6/0x2aa0 kernel_clone+0xab/0x440 __do_sys_clone+0x66/0x90 do_syscall_64+0x95/0x180 Likely this case was missed in: d155df53f310 ("x86/mm/pat: clear VM_PAT if copy_p4d_range failed") ... and instead of undoing the reservation we simply cleared the VM_PAT flag. Keep the documentation of these functions in include/linux/pgtable.h, one place is more than sufficient -- we should clean that up for the other functions like track_pfn_remap/untrack_pfn separately.
References
Impacted products
Vendor Product Version
Linux Linux Version: 2ab640379a0ab4cef746ced1d7e04a0941774bcb
Version: 2ab640379a0ab4cef746ced1d7e04a0941774bcb
Version: 2ab640379a0ab4cef746ced1d7e04a0941774bcb
Version: 2ab640379a0ab4cef746ced1d7e04a0941774bcb
Version: 2ab640379a0ab4cef746ced1d7e04a0941774bcb
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/mm/pat/memtype.c",
            "include/linux/pgtable.h",
            "kernel/fork.c",
            "mm/memory.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b07398e8a5da517083f5c3f2daa8f6681b48ab28",
              "status": "affected",
              "version": "2ab640379a0ab4cef746ced1d7e04a0941774bcb",
              "versionType": "git"
            },
            {
              "lessThan": "8d6373f83f367dbed316ddeb178130a3a64b5b67",
              "status": "affected",
              "version": "2ab640379a0ab4cef746ced1d7e04a0941774bcb",
              "versionType": "git"
            },
            {
              "lessThan": "da381c33f3aa6406406c9fdf07b8b0b63e0ce722",
              "status": "affected",
              "version": "2ab640379a0ab4cef746ced1d7e04a0941774bcb",
              "versionType": "git"
            },
            {
              "lessThan": "de6185b8892d88142ef69768fe4077cbf40109c0",
              "status": "affected",
              "version": "2ab640379a0ab4cef746ced1d7e04a0941774bcb",
              "versionType": "git"
            },
            {
              "lessThan": "dc84bc2aba85a1508f04a936f9f9a15f64ebfb31",
              "status": "affected",
              "version": "2ab640379a0ab4cef746ced1d7e04a0941774bcb",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/mm/pat/memtype.c",
            "include/linux/pgtable.h",
            "kernel/fork.c",
            "mm/memory.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.29"
            },
            {
              "lessThan": "2.6.29",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.87",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.23",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.14.*",
              "status": "unaffected",
              "version": "6.14.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.87",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.23",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.11",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14.2",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/mm/pat: Fix VM_PAT handling when fork() fails in copy_page_range()\n\nIf track_pfn_copy() fails, we already added the dst VMA to the maple\ntree. As fork() fails, we\u0027ll cleanup the maple tree, and stumble over\nthe dst VMA for which we neither performed any reservation nor copied\nany page tables.\n\nConsequently untrack_pfn() will see VM_PAT and try obtaining the\nPAT information from the page table -- which fails because the page\ntable was not copied.\n\nThe easiest fix would be to simply clear the VM_PAT flag of the dst VMA\nif track_pfn_copy() fails. However, the whole thing is about \"simply\"\nclearing the VM_PAT flag is shaky as well: if we passed track_pfn_copy()\nand performed a reservation, but copying the page tables fails, we\u0027ll\nsimply clear the VM_PAT flag, not properly undoing the reservation ...\nwhich is also wrong.\n\nSo let\u0027s fix it properly: set the VM_PAT flag only if the reservation\nsucceeded (leaving it clear initially), and undo the reservation if\nanything goes wrong while copying the page tables: clearing the VM_PAT\nflag after undoing the reservation.\n\nNote that any copied page table entries will get zapped when the VMA will\nget removed later, after copy_page_range() succeeded; as VM_PAT is not set\nthen, we won\u0027t try cleaning VM_PAT up once more and untrack_pfn() will be\nhappy. Note that leaving these page tables in place without a reservation\nis not a problem, as we are aborting fork(); this process will never run.\n\nA reproducer can trigger this usually at the first try:\n\n  https://gitlab.com/davidhildenbrand/scratchspace/-/raw/main/reproducers/pat_fork.c\n\n  WARNING: CPU: 26 PID: 11650 at arch/x86/mm/pat/memtype.c:983 get_pat_info+0xf6/0x110\n  Modules linked in: ...\n  CPU: 26 UID: 0 PID: 11650 Comm: repro3 Not tainted 6.12.0-rc5+ #92\n  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-2.fc40 04/01/2014\n  RIP: 0010:get_pat_info+0xf6/0x110\n  ...\n  Call Trace:\n   \u003cTASK\u003e\n   ...\n   untrack_pfn+0x52/0x110\n   unmap_single_vma+0xa6/0xe0\n   unmap_vmas+0x105/0x1f0\n   exit_mmap+0xf6/0x460\n   __mmput+0x4b/0x120\n   copy_process+0x1bf6/0x2aa0\n   kernel_clone+0xab/0x440\n   __do_sys_clone+0x66/0x90\n   do_syscall_64+0x95/0x180\n\nLikely this case was missed in:\n\n  d155df53f310 (\"x86/mm/pat: clear VM_PAT if copy_p4d_range failed\")\n\n... and instead of undoing the reservation we simply cleared the VM_PAT flag.\n\nKeep the documentation of these functions in include/linux/pgtable.h,\none place is more than sufficient -- we should clean that up for the other\nfunctions like track_pfn_remap/untrack_pfn separately."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-26T05:18:15.399Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b07398e8a5da517083f5c3f2daa8f6681b48ab28"
        },
        {
          "url": "https://git.kernel.org/stable/c/8d6373f83f367dbed316ddeb178130a3a64b5b67"
        },
        {
          "url": "https://git.kernel.org/stable/c/da381c33f3aa6406406c9fdf07b8b0b63e0ce722"
        },
        {
          "url": "https://git.kernel.org/stable/c/de6185b8892d88142ef69768fe4077cbf40109c0"
        },
        {
          "url": "https://git.kernel.org/stable/c/dc84bc2aba85a1508f04a936f9f9a15f64ebfb31"
        }
      ],
      "title": "x86/mm/pat: Fix VM_PAT handling when fork() fails in copy_page_range()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-22090",
    "datePublished": "2025-04-16T14:12:42.561Z",
    "dateReserved": "2024-12-29T08:45:45.817Z",
    "dateUpdated": "2025-05-26T05:18:15.399Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-22090\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-04-16T15:16:03.213\",\"lastModified\":\"2025-04-17T20:22:16.240\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nx86/mm/pat: Fix VM_PAT handling when fork() fails in copy_page_range()\\n\\nIf track_pfn_copy() fails, we already added the dst VMA to the maple\\ntree. As fork() fails, we\u0027ll cleanup the maple tree, and stumble over\\nthe dst VMA for which we neither performed any reservation nor copied\\nany page tables.\\n\\nConsequently untrack_pfn() will see VM_PAT and try obtaining the\\nPAT information from the page table -- which fails because the page\\ntable was not copied.\\n\\nThe easiest fix would be to simply clear the VM_PAT flag of the dst VMA\\nif track_pfn_copy() fails. However, the whole thing is about \\\"simply\\\"\\nclearing the VM_PAT flag is shaky as well: if we passed track_pfn_copy()\\nand performed a reservation, but copying the page tables fails, we\u0027ll\\nsimply clear the VM_PAT flag, not properly undoing the reservation ...\\nwhich is also wrong.\\n\\nSo let\u0027s fix it properly: set the VM_PAT flag only if the reservation\\nsucceeded (leaving it clear initially), and undo the reservation if\\nanything goes wrong while copying the page tables: clearing the VM_PAT\\nflag after undoing the reservation.\\n\\nNote that any copied page table entries will get zapped when the VMA will\\nget removed later, after copy_page_range() succeeded; as VM_PAT is not set\\nthen, we won\u0027t try cleaning VM_PAT up once more and untrack_pfn() will be\\nhappy. Note that leaving these page tables in place without a reservation\\nis not a problem, as we are aborting fork(); this process will never run.\\n\\nA reproducer can trigger this usually at the first try:\\n\\n  https://gitlab.com/davidhildenbrand/scratchspace/-/raw/main/reproducers/pat_fork.c\\n\\n  WARNING: CPU: 26 PID: 11650 at arch/x86/mm/pat/memtype.c:983 get_pat_info+0xf6/0x110\\n  Modules linked in: ...\\n  CPU: 26 UID: 0 PID: 11650 Comm: repro3 Not tainted 6.12.0-rc5+ #92\\n  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-2.fc40 04/01/2014\\n  RIP: 0010:get_pat_info+0xf6/0x110\\n  ...\\n  Call Trace:\\n   \u003cTASK\u003e\\n   ...\\n   untrack_pfn+0x52/0x110\\n   unmap_single_vma+0xa6/0xe0\\n   unmap_vmas+0x105/0x1f0\\n   exit_mmap+0xf6/0x460\\n   __mmput+0x4b/0x120\\n   copy_process+0x1bf6/0x2aa0\\n   kernel_clone+0xab/0x440\\n   __do_sys_clone+0x66/0x90\\n   do_syscall_64+0x95/0x180\\n\\nLikely this case was missed in:\\n\\n  d155df53f310 (\\\"x86/mm/pat: clear VM_PAT if copy_p4d_range failed\\\")\\n\\n... and instead of undoing the reservation we simply cleared the VM_PAT flag.\\n\\nKeep the documentation of these functions in include/linux/pgtable.h,\\none place is more than sufficient -- we should clean that up for the other\\nfunctions like track_pfn_remap/untrack_pfn separately.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: x86/mm/pat: Se corrige la gesti\u00f3n de VM_PAT cuando fork() falla en copy_page_range(). Si track_pfn_copy() falla, ya se agreg\u00f3 el VMA dst al \u00e1rbol de maple. Si fork() falla, se limpiar\u00e1 el \u00e1rbol de maple y se encontrar\u00e1 con el VMA dst para el cual no se realiz\u00f3 ninguna reserva ni se copi\u00f3 ninguna tabla de p\u00e1ginas. En consecuencia, untrack_pfn() detectar\u00e1 VM_PAT e intentar\u00e1 obtener la informaci\u00f3n de PAT de la tabla de p\u00e1ginas, lo cual falla porque esta no se copi\u00f3. La soluci\u00f3n m\u00e1s sencilla ser\u00eda simplemente borrar el indicador VM_PAT del VMA dst si track_pfn_copy() falla. Sin embargo, la cuesti\u00f3n de simplemente borrar el indicador VM_PAT tambi\u00e9n es problem\u00e1tica: si pasamos track_pfn_copy() y realizamos una reserva, pero la copia de las tablas de p\u00e1ginas falla, simplemente borraremos el indicador VM_PAT, sin deshacer la reserva correctamente, lo cual tambi\u00e9n es incorrecto. As\u00ed que vamos a solucionarlo correctamente: configuremos el indicador VM_PAT solo si la reserva se realiz\u00f3 correctamente (dej\u00e1ndolo inicialmente en blanco) y deshag\u00e1mosla si algo sale mal al copiar las tablas de p\u00e1ginas: borremos el indicador VM_PAT despu\u00e9s de deshacer la reserva. Tenga en cuenta que cualquier entrada copiada de la tabla de p\u00e1ginas se eliminar\u00e1 cuando se elimine el VMA posteriormente, despu\u00e9s de que copy_page_range() se haya ejecutado correctamente; como VM_PAT no est\u00e1 configurado en ese momento, no intentaremos borrarlo de nuevo y untrack_pfn() funcionar\u00e1 correctamente. Tenga en cuenta que dejar estas tablas de p\u00e1ginas sin una reserva no es un problema, ya que estamos cancelando fork(); este proceso nunca se ejecutar\u00e1. Un reproductor puede activar esto generalmente en el primer intento: https://gitlab.com/davidhildenbrand/scratchspace/-/raw/main/reproducers/pat_fork.c ADVERTENCIA: CPU: 26 PID: 11650 en arch/x86/mm/pat/memtype.c:983 get_pat_info+0xf6/0x110 M\u00f3dulos vinculados: ... CPU: 26 UID: 0 PID: 11650 Comm: repro3 No contaminado 6.12.0-rc5+ #92 Nombre del hardware: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-2.fc40 01/04/2014 RIP: 0010:get_pat_info+0xf6/0x110 ... Seguimiento de llamadas:  ... untrack_pfn+0x52/0x110 unmap_single_vma+0xa6/0xe0 unmap_vmas+0x105/0x1f0 exit_mmap+0xf6/0x460 __mmput+0x4b/0x120 copy_process+0x1bf6/0x2aa0 kernel_clone+0xab/0x440 __do_sys_clone+0x66/0x90 do_syscall_64+0x95/0x180 Es probable que este caso no se haya encontrado en: d155df53f310 (\\\"x86/mm/pat: borrar VM_PAT si copy_p4d_range fall\u00f3\\\") ... y en lugar de deshacer la reserva simplemente borramos el indicador VM_PAT. Mantenga la documentaci\u00f3n de estas funciones en include/linux/pgtable.h, un lugar es m\u00e1s que suficiente; deber\u00edamos limpiarlo para las otras funciones como track_pfn_remap/untrack_pfn por separado.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/8d6373f83f367dbed316ddeb178130a3a64b5b67\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b07398e8a5da517083f5c3f2daa8f6681b48ab28\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/da381c33f3aa6406406c9fdf07b8b0b63e0ce722\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/dc84bc2aba85a1508f04a936f9f9a15f64ebfb31\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/de6185b8892d88142ef69768fe4077cbf40109c0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.