CVE-2024-36943 (GCVE-0-2024-36943)

Vulnerability from cvelistv5 – Published: 2024-05-30 15:35 – Updated: 2026-08-05 11:32
VLAI
Title
fs/proc/task_mmu: fix loss of young/dirty bits during pagemap scan
Summary
In the Linux kernel, the following vulnerability has been resolved: fs/proc/task_mmu: fix loss of young/dirty bits during pagemap scan make_uffd_wp_pte() was previously doing: pte = ptep_get(ptep); ptep_modify_prot_start(ptep); pte = pte_mkuffd_wp(pte); ptep_modify_prot_commit(ptep, pte); But if another thread accessed or dirtied the pte between the first 2 calls, this could lead to loss of that information. Since ptep_modify_prot_start() gets and clears atomically, the following is the correct pattern and prevents any possible race. Any access after the first call would see an invalid pte and cause a fault: pte = ptep_modify_prot_start(ptep); pte = pte_mkuffd_wp(pte); ptep_modify_prot_commit(ptep, pte);
Severity
7.3 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-06-05 18:15 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 52526ca7fdb905a768a93f8faa418e9b988fc34b , < 74b3d66f91d9f539f99faad74d796fa9a389a015 (git)
Affected: 52526ca7fdb905a768a93f8faa418e9b988fc34b , < c70dce4982ce1718bf978a35f8e26160b82081f4 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.7
Unaffected: 0 , < 6.7 (semver)
Unaffected: 6.8.10 , ≤ 6.8.* (semver)
Unaffected: 6.9 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-36943",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-05T18:15:10.001170Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-05T18:17:48.241Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T03:43:50.375Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/74b3d66f91d9f539f99faad74d796fa9a389a015"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/c70dce4982ce1718bf978a35f8e26160b82081f4"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/proc/task_mmu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "74b3d66f91d9f539f99faad74d796fa9a389a015",
              "status": "affected",
              "version": "52526ca7fdb905a768a93f8faa418e9b988fc34b",
              "versionType": "git"
            },
            {
              "lessThan": "c70dce4982ce1718bf978a35f8e26160b82081f4",
              "status": "affected",
              "version": "52526ca7fdb905a768a93f8faa418e9b988fc34b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/proc/task_mmu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.7"
            },
            {
              "lessThan": "6.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.10",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/proc/task_mmu: fix loss of young/dirty bits during pagemap scan\n\nmake_uffd_wp_pte() was previously doing:\n\n  pte = ptep_get(ptep);\n  ptep_modify_prot_start(ptep);\n  pte = pte_mkuffd_wp(pte);\n  ptep_modify_prot_commit(ptep, pte);\n\nBut if another thread accessed or dirtied the pte between the first 2\ncalls, this could lead to loss of that information.  Since\nptep_modify_prot_start() gets and clears atomically, the following is the\ncorrect pattern and prevents any possible race.  Any access after the\nfirst call would see an invalid pte and cause a fault:\n\n  pte = ptep_modify_prot_start(ptep);\n  pte = pte_mkuffd_wp(pte);\n  ptep_modify_prot_commit(ptep, pte);"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached only through the PAGEMAP_SCAN ioctl on /proc/\u003cpid\u003e/pagemap combined with a userfaultfd WP-async registration, both of which require local execution on the host. There is no network-facing consumer of this path.\nAC:L - The attacker owns both sides of the race \u2014 sibling threads continuously writing to the mapped range set the hardware A/D bits while another thread loops PAGEMAP_SCAN with PM_SCAN_WP_MATCHING over millions of PTEs per iteration, so a hit is effectively guaranteed and can be retried without limit. No condition depends on external state the attacker cannot influence.\nPR:L - Only an ordinary unprivileged local account is needed: pagemap_open() requires just PTRACE_MODE_READ (trivial for /proc/self), the PAGEMAP_SCAN ioctl has no capability check, and userfaultfd_syscall_allowed() unconditionally permits UFFD_USER_MODE_ONLY so even vm.unprivileged_userfaultfd=0 does not block UFFD_FEATURE_WP_ASYNC registration. All required Kconfig options (PROC_PAGE_MONITOR, PTE_MARKER_UFFD_WP) are default-y in distro kernels.\nUI:N - The attacker drives the ioctl and the racing writes entirely from its own threads with no victim action required; when targeting another mm the victim\u0027s pre-existing uffd-wp-async registration is passive state, not an interaction.\nS:U - The lost PTE bits corrupt memory managed by the same kernel that contains the flaw, with no crossing of a hypervisor, IOMMU, or sandbox boundary. This is the standard unchanged-scope case for a kernel memory-management defect.\nC:L - Discarding the dirty bit causes a page\u0027s rewritten contents to be dropped and the stale swap-slot contents to be resurrected, so data a process deliberately overwrote or scrubbed (keys, credentials) persists in memory and on the swap device instead of being erased. This is a bounded exposure of previously-written data rather than an arbitrary kernel read primitive.\nI:H - Loss of the dirty bit makes the kernel silently drop modified pages \u2014 swap-cached anonymous pages revert to stale contents and MADV_FREE pages are discarded to zeros via the try_to_unmap_one discard path \u2014 with no error to the application. The attacker can repeat this across an unbounded number of pages, including in another process\u0027s mm it can ptrace-read (e.g. a CRIU- or VMM-managed workload using uffd-wp-async dirty tracking), amounting to total loss of integrity of that memory.\nA:H - Pages silently reverting to stale swap contents or being zeroed out corrupts live program state and reliably renders the affected process \u2014 including a targeted uffd-wp-async user such as a checkpoint/restore agent or live-migration VMM and its guest \u2014 non-functional or crashed. The condition is repeatable at will by an unprivileged local user."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:32:11.488Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/74b3d66f91d9f539f99faad74d796fa9a389a015"
        },
        {
          "url": "https://git.kernel.org/stable/c/c70dce4982ce1718bf978a35f8e26160b82081f4"
        }
      ],
      "title": "fs/proc/task_mmu: fix loss of young/dirty bits during pagemap scan",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-36943",
    "datePublished": "2024-05-30T15:35:42.119Z",
    "dateReserved": "2024-05-30T15:25:07.073Z",
    "dateUpdated": "2026-08-05T11:32:11.488Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-36943",
      "date": "2026-10-01",
      "epss": "0.00182",
      "percentile": "0.07016"
    },
    "fkie_nvd": {
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/proc/task_mmu: fix loss of young/dirty bits during pagemap scan\n\nmake_uffd_wp_pte() was previously doing:\n\n  pte = ptep_get(ptep);\n  ptep_modify_prot_start(ptep);\n  pte = pte_mkuffd_wp(pte);\n  ptep_modify_prot_commit(ptep, pte);\n\nBut if another thread accessed or dirtied the pte between the first 2\ncalls, this could lead to loss of that information.  Since\nptep_modify_prot_start() gets and clears atomically, the following is the\ncorrect pattern and prevents any possible race.  Any access after the\nfirst call would see an invalid pte and cause a fault:\n\n  pte = ptep_modify_prot_start(ptep);\n  pte = pte_mkuffd_wp(pte);\n  ptep_modify_prot_commit(ptep, pte);"
        },
        {
          "lang": "es",
          "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: fs/proc/task_mmu: corrige la p\u00e9rdida de bits j\u00f3venes/sucios durante el escaneo del mapa de p\u00e1ginas que make_uffd_wp_pte() estaba haciendo anteriormente: pte = ptep_get(ptep); ptep_modify_prot_start(ptep); pte = pte_mkuffd_wp(pte); ptep_modify_prot_commit(ptep,pte); Pero si otro hilo accedi\u00f3 o ensuci\u00f3 el pte entre las 2 primeras llamadas, esto podr\u00eda provocar la p\u00e9rdida de esa informaci\u00f3n. Dado que ptep_modify_prot_start() obtiene y borra at\u00f3micamente, el siguiente es el patr\u00f3n correcto y evita cualquier posible ejecuci\u00f3n. Cualquier acceso despu\u00e9s de la primera llamada ver\u00eda un pte no v\u00e1lido y provocar\u00eda una falla: pte = ptep_modify_prot_start(ptep); pte = pte_mkuffd_wp(pte); ptep_modify_prot_commit(ptep,pte);"
        }
      ],
      "id": "CVE-2024-36943",
      "lastModified": "2024-11-21T09:22:52.417",
      "published": "2024-05-30T16:15:17.307",
      "references": [
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/74b3d66f91d9f539f99faad74d796fa9a389a015"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/c70dce4982ce1718bf978a35f8e26160b82081f4"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://git.kernel.org/stable/c/74b3d66f91d9f539f99faad74d796fa9a389a015"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://git.kernel.org/stable/c/c70dce4982ce1718bf978a35f8e26160b82081f4"
        }
      ],
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/proc/task_mmu.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "74b3d66f91d9f539f99faad74d796fa9a389a015",
                    "status": "affected",
                    "version": "52526ca7fdb905a768a93f8faa418e9b988fc34b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "c70dce4982ce1718bf978a35f8e26160b82081f4",
                    "status": "affected",
                    "version": "52526ca7fdb905a768a93f8faa418e9b988fc34b",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "fs/proc/task_mmu.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.7"
                  },
                  {
                    "lessThan": "6.7",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.8.*",
                    "status": "unaffected",
                    "version": "6.8.10",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.9",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "6A6B920C-8D8F-4130-86B4-AD334F4CF2E3",
                    "versionEndExcluding": "6.8.10",
                    "versionStartIncluding": "6.7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "22BEDD49-2C6D-402D-9DBF-6646F6ECD10B",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "DF73CB2A-DFFD-46FB-9BFE-AA394F27EA37",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc3:*:*:*:*:*:*",
                    "matchCriteriaId": "52048DDA-FC5A-4363-95A0-A6357B4D7F8C",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc4:*:*:*:*:*:*",
                    "matchCriteriaId": "A06B2CCF-3F43-4FA9-8773-C83C3F5764B2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc5:*:*:*:*:*:*",
                    "matchCriteriaId": "F850DCEC-E08B-4317-A33B-D2DCF39F601B",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc6:*:*:*:*:*:*",
                    "matchCriteriaId": "91326417-E981-482E-A5A3-28BC1327521B",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc7:*:*:*:*:*:*",
                    "matchCriteriaId": "DAECDCD8-F556-4606-8D7B-5C6D47A501F2",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/proc/task_mmu: fix loss of young/dirty bits during pagemap scan\n\nmake_uffd_wp_pte() was previously doing:\n\n  pte = ptep_get(ptep);\n  ptep_modify_prot_start(ptep);\n  pte = pte_mkuffd_wp(pte);\n  ptep_modify_prot_commit(ptep, pte);\n\nBut if another thread accessed or dirtied the pte between the first 2\ncalls, this could lead to loss of that information.  Since\nptep_modify_prot_start() gets and clears atomically, the following is the\ncorrect pattern and prevents any possible race.  Any access after the\nfirst call would see an invalid pte and cause a fault:\n\n  pte = ptep_modify_prot_start(ptep);\n  pte = pte_mkuffd_wp(pte);\n  ptep_modify_prot_commit(ptep, pte);"
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: fs/proc/task_mmu: corrige la p\u00e9rdida de bits j\u00f3venes/sucios durante el escaneo del mapa de p\u00e1ginas que make_uffd_wp_pte() estaba haciendo anteriormente: pte = ptep_get(ptep); ptep_modify_prot_start(ptep); pte = pte_mkuffd_wp(pte); ptep_modify_prot_commit(ptep,pte); Pero si otro hilo accedi\u00f3 o ensuci\u00f3 el pte entre las 2 primeras llamadas, esto podr\u00eda provocar la p\u00e9rdida de esa informaci\u00f3n. Dado que ptep_modify_prot_start() obtiene y borra at\u00f3micamente, el siguiente es el patr\u00f3n correcto y evita cualquier posible ejecuci\u00f3n. Cualquier acceso despu\u00e9s de la primera llamada ver\u00eda un pte no v\u00e1lido y provocar\u00eda una falla: pte = ptep_modify_prot_start(ptep); pte = pte_mkuffd_wp(pte); ptep_modify_prot_commit(ptep,pte);"
          }
        ],
        "id": "CVE-2024-36943",
        "lastModified": "2026-08-04T11:18:33.553",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.3,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "LOW",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.5,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 4.7,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.0,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2024-36943",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-05T18:15:10.001170Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-05-30T16:15:17.307",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/74b3d66f91d9f539f99faad74d796fa9a389a015"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/c70dce4982ce1718bf978a35f8e26160b82081f4"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/74b3d66f91d9f539f99faad74d796fa9a389a015"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/c70dce4982ce1718bf978a35f8e26160b82081f4"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "NVD-CWE-noinfo"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T18:53:18+00:00",
      "cve": "CVE-2024-36943",
      "id": "CVE-2024-36943",
      "initial_release_date": "2024-05-30T00:00:00+00:00",
      "product_status:known_affected": "42",
      "product_status:known_not_affected": "156",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: fs/proc/task_mmu: fix loss of young/dirty bits during pagemap scan",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-36943.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-30T02:34:58Z",
      "cve": "CVE-2024-36943",
      "id": "CVE-2024-36943",
      "initial_release_date": "2024-06-04T02:25:21Z",
      "product_status:known_not_affected": "385",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-36943",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-36943.json",
      "version": "19"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2024-08-02T03:43:50.375Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/74b3d66f91d9f539f99faad74d796fa9a389a015"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/c70dce4982ce1718bf978a35f8e26160b82081f4"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2024-36943",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-06-05T18:15:10.001170Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-06-05T18:15:18.500Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "fs/proc/task_mmu.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "74b3d66f91d9f539f99faad74d796fa9a389a015",
                  "status": "affected",
                  "version": "52526ca7fdb905a768a93f8faa418e9b988fc34b",
                  "versionType": "git"
                },
                {
                  "lessThan": "c70dce4982ce1718bf978a35f8e26160b82081f4",
                  "status": "affected",
                  "version": "52526ca7fdb905a768a93f8faa418e9b988fc34b",
                  "versionType": "git"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "fs/proc/task_mmu.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "6.7"
                },
                {
                  "lessThan": "6.7",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.8.*",
                  "status": "unaffected",
                  "version": "6.8.10",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "6.9",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.8.10",
                      "versionStartIncluding": "6.7",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.9",
                      "versionStartIncluding": "6.7",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/proc/task_mmu: fix loss of young/dirty bits during pagemap scan\n\nmake_uffd_wp_pte() was previously doing:\n\n  pte = ptep_get(ptep);\n  ptep_modify_prot_start(ptep);\n  pte = pte_mkuffd_wp(pte);\n  ptep_modify_prot_commit(ptep, pte);\n\nBut if another thread accessed or dirtied the pte between the first 2\ncalls, this could lead to loss of that information.  Since\nptep_modify_prot_start() gets and clears atomically, the following is the\ncorrect pattern and prevents any possible race.  Any access after the\nfirst call would see an invalid pte and cause a fault:\n\n  pte = ptep_modify_prot_start(ptep);\n  pte = pte_mkuffd_wp(pte);\n  ptep_modify_prot_commit(ptep, pte);"
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 7.3,
                "baseSeverity": "HIGH",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H",
                "version": "3.1"
              },
              "scenarios": [
                {
                  "lang": "en",
                  "value": "AV:L - The vulnerability is reached only through the PAGEMAP_SCAN ioctl on /proc/\u003cpid\u003e/pagemap combined with a userfaultfd WP-async registration, both of which require local execution on the host. There is no network-facing consumer of this path.\nAC:L - The attacker owns both sides of the race \u2014 sibling threads continuously writing to the mapped range set the hardware A/D bits while another thread loops PAGEMAP_SCAN with PM_SCAN_WP_MATCHING over millions of PTEs per iteration, so a hit is effectively guaranteed and can be retried without limit. No condition depends on external state the attacker cannot influence.\nPR:L - Only an ordinary unprivileged local account is needed: pagemap_open() requires just PTRACE_MODE_READ (trivial for /proc/self), the PAGEMAP_SCAN ioctl has no capability check, and userfaultfd_syscall_allowed() unconditionally permits UFFD_USER_MODE_ONLY so even vm.unprivileged_userfaultfd=0 does not block UFFD_FEATURE_WP_ASYNC registration. All required Kconfig options (PROC_PAGE_MONITOR, PTE_MARKER_UFFD_WP) are default-y in distro kernels.\nUI:N - The attacker drives the ioctl and the racing writes entirely from its own threads with no victim action required; when targeting another mm the victim\u0027s pre-existing uffd-wp-async registration is passive state, not an interaction.\nS:U - The lost PTE bits corrupt memory managed by the same kernel that contains the flaw, with no crossing of a hypervisor, IOMMU, or sandbox boundary. This is the standard unchanged-scope case for a kernel memory-management defect.\nC:L - Discarding the dirty bit causes a page\u0027s rewritten contents to be dropped and the stale swap-slot contents to be resurrected, so data a process deliberately overwrote or scrubbed (keys, credentials) persists in memory and on the swap device instead of being erased. This is a bounded exposure of previously-written data rather than an arbitrary kernel read primitive.\nI:H - Loss of the dirty bit makes the kernel silently drop modified pages \u2014 swap-cached anonymous pages revert to stale contents and MADV_FREE pages are discarded to zeros via the try_to_unmap_one discard path \u2014 with no error to the application. The attacker can repeat this across an unbounded number of pages, including in another process\u0027s mm it can ptrace-read (e.g. a CRIU- or VMM-managed workload using uffd-wp-async dirty tracking), amounting to total loss of integrity of that memory.\nA:H - Pages silently reverting to stale swap contents or being zeroed out corrupts live program state and reliably renders the affected process \u2014 including a targeted uffd-wp-async user such as a checkpoint/restore agent or live-migration VMM and its guest \u2014 non-functional or crashed. The condition is repeatable at will by an unprivileged local user."
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-05T11:32:11.488Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/74b3d66f91d9f539f99faad74d796fa9a389a015"
            },
            {
              "url": "https://git.kernel.org/stable/c/c70dce4982ce1718bf978a35f8e26160b82081f4"
            }
          ],
          "title": "fs/proc/task_mmu: fix loss of young/dirty bits during pagemap scan",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2024-36943",
        "datePublished": "2024-05-30T15:35:42.119Z",
        "dateReserved": "2024-05-30T15:25:07.073Z",
        "dateUpdated": "2026-08-05T11:32:11.488Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.