CVE-2024-41027

Fix userfaultfd_api to return EINVAL as expected

Description

In the Linux kernel, the following vulnerability has been resolved: Fix userfaultfd_api to return EINVAL as expected Currently if we request a feature that is not set in the Kernel config we fail silently and return all the available features. However, the man page indicates we should return an EINVAL. We need to fix this issue since we can end up with a Kernel warning should a program request the feature UFFD_FEATURE_WP_UNPOPULATED on a kernel with the config not set with this feature. [ 200.812896] WARNING: CPU: 91 PID: 13634 at mm/memory.c:1660 zap_pte_range+0x43d/0x660 [ 200.820738] Modules linked in: [ 200.869387] CPU: 91 PID: 13634 Comm: userfaultfd Kdump: loaded Not tainted 6.9.0-rc5+ #8 [ 200.877477] Hardware name: Dell Inc. PowerEdge R6525/0N7YGH, BIOS 2.7.3 03/30/2022 [ 200.885052] RIP: 0010:zap_pte_range+0x43d/0x660

N/A

CVSS

Severity:

EPSS 0.10%

Affected: Linux Linux

References

Link	Tags
https://git.kernel.org/stable/c/519547760f16eae7803d2658d9524bc5ba7a20a7
https://git.kernel.org/stable/c/14875fd5f9bcf60ac5518c63bfb676ade44aa7c6
https://git.kernel.org/stable/c/cd94cac4069a763ab5206be2c64c9a8beae590ba
https://git.kernel.org/stable/c/8111f902b7c95d75fc80c7e577f5045886c6b384
https://git.kernel.org/stable/c/1723f04caacb32cadc4e063725d836a0c4450694

Frequently Asked Questions

What is the severity of CVE-2024-41027?: CVE-2024-41027 has not yet been assigned a CVSS score.
How to fix CVE-2024-41027?: To fix CVE-2024-41027, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2024-41027 being actively exploited in the wild?: As for now, there are no information to confirm that CVE-2024-41027 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2024-41027?: CVE-2024-41027 affects Linux Linux, Linux Linux.

This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.