CVE-2017-1000405 : What You Need to Know

A problematic use of pmd_mkdirty() in the touch_pmd() function in Linux Kernel versions 2.6.38 through 4.14 can lead to vulnerabilities allowing the overwriting of read-only huge pages.

Understanding CVE-2017-1000405

This CVE involves a specific issue in the Linux Kernel versions 2.6.38 through 4.14 that can result in security vulnerabilities.

What is CVE-2017-1000405?

The problem arises from the improper use of pmd_mkdirty() in the touch_pmd() function, impacting the logic of can_follow_write_pmd() and allowing for the overwriting of read-only huge pages.

The Impact of CVE-2017-1000405

Less severe compared to the original "Dirty cow" vulnerability
Enables the overwriting of zero huge pages and sealed shmem files
Exploitable through the Transparent Huge Pages (THP) mechanism

Technical Details of CVE-2017-1000405

This section provides more in-depth technical insights into the CVE.

Vulnerability Description

The issue stems from the incorrect use of pmd_mkdirty() in the touch_pmd() function, disrupting the logic of can_follow_write_pmd() and allowing for the overwriting of read-only huge pages.

Affected Systems and Versions

Linux Kernel versions 2.6.38 through 4.14

Exploitation Mechanism

Occurs when get_user_pages() is used to reach the touch_pmd() function
Results in the pmd becoming dirty without undergoing a copy-on-write (COW) cycle

Mitigation and Prevention

Protecting systems from CVE-2017-1000405 is crucial to maintaining security.

Immediate Steps to Take

Apply relevant patches and updates provided by the Linux Kernel maintainers
Monitor security advisories for any new information or patches

Long-Term Security Practices

Regularly update and patch the Linux Kernel to address known vulnerabilities
Implement security best practices to prevent unauthorized access and exploitation

Patching and Updates

Stay informed about security updates and patches released by the Linux Kernel community
Ensure timely application of patches to mitigate the risks associated with CVE-2017-1000405