Race Condition Affecting kernel-uek-doc package, versions <0:4.1.12-103.10.1.el6uek


Severity

Recommended
0.0
high
0
10

Based on Oracle Linux security rating.

Threat Intelligence

Exploit Maturity
Mature
EPSS
0.21% (59th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Race Condition vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-ORACLE6-KERNELUEKDOC-2522768
  • published10 Apr 2022
  • disclosed30 Nov 2017

Introduced: 30 Nov 2017

CVE-2017-1000405  (opens in a new tab)
CWE-362  (opens in a new tab)

How to fix?

Upgrade Oracle:6 kernel-uek-doc to version 0:4.1.12-103.10.1.el6uek or higher.
This issue was patched in ELSA-2017-3651.

NVD Description

Note: Versions mentioned in the description apply only to the upstream kernel-uek-doc package and not the kernel-uek-doc package as distributed by Oracle. See How to fix? for Oracle:6 relevant fixed versions and status.

The Linux Kernel versions 2.6.38 through 4.14 have a problematic use of pmd_mkdirty() in the touch_pmd() function inside the THP implementation. touch_pmd() can be reached by get_user_pages(). In such case, the pmd will become dirty. This scenario breaks the new can_follow_write_pmd()'s logic - pmd can become dirty without going through a COW cycle. This bug is not as severe as the original "Dirty cow" because an ext4 file (or any other regular file) cannot be mapped using THP. Nevertheless, it does allow us to overwrite read-only huge pages. For example, the zero huge page and sealed shmem files can be overwritten (since their mapping can be populated using THP). Note that after the first write page-fault to the zero page, it will be replaced with a new fresh (and zeroed) thp.

CVSS Scores

version 3.1