{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-47745", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-09-30T16:00:12.960Z", "datePublished": "2024-10-21T12:14:12.488Z", "dateUpdated": "2026-08-05T11:39:53.925Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:39:53.925Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm: call the security_mmap_file() LSM hook in remap_file_pages()\n\nThe remap_file_pages syscall handler calls do_mmap() directly, which\ndoesn't contain the LSM security check. And if the process has called\npersonality(READ_IMPLIES_EXEC) before and remap_file_pages() is called for\nRW pages, this will actually result in remapping the pages to RWX,\nbypassing a W^X policy enforced by SELinux.\n\nSo we should check prot by security_mmap_file LSM hook in the\nremap_file_pages syscall handler before do_mmap() is called. Otherwise, it\npotentially permits an attacker to bypass a W^X policy enforced by\nSELinux.\n\nThe bypass is similar to CVE-2016-10044, which bypass the same thing via\nAIO and can be found in [1].\n\nThe PoC:\n\n$ cat > test.c\n\nint main(void) {\n\tsize_t pagesz = sysconf(_SC_PAGE_SIZE);\n\tint mfd = syscall(SYS_memfd_create, \"test\", 0);\n\tconst char *buf = mmap(NULL, 4 * pagesz, PROT_READ | PROT_WRITE,\n\t\tMAP_SHARED, mfd, 0);\n\tunsigned int old = syscall(SYS_personality, 0xffffffff);\n\tsyscall(SYS_personality, READ_IMPLIES_EXEC | old);\n\tsyscall(SYS_remap_file_pages, buf, pagesz, 0, 2, 0);\n\tsyscall(SYS_personality, old);\n\t// show the RWX page exists even if W^X policy is enforced\n\tint fd = open(\"/proc/self/maps\", O_RDONLY);\n\tunsigned char buf2[1024];\n\twhile (1) {\n\t\tint ret = read(fd, buf2, 1024);\n\t\tif (ret <= 0) break;\n\t\twrite(1, buf2, ret);\n\t}\n\tclose(fd);\n}\n\n$ gcc test.c -o test\n$ ./test | grep rwx\n7f1836c34000-7f1836c35000 rwxs 00002000 00:01 2050 /memfd:test (deleted)\n\n[PM: subject line tweaks]" } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The bypass is performed entirely through local syscalls (`memfd_create`/`mmap`/`personality`/`remap_file_pages`) operating on the calling task's own `mm_struct`. There is no network- or adjacent-reachable path into `SYSCALL_DEFINE5(remap_file_pages)`.\nAC:L - The commit's PoC is fully deterministic — no race, no heap grooming, no memory-layout dependency — and the attacker controls every input. SELinux in enforcing mode with a W^X policy is the default on Android, RHEL/CentOS and Fedora, so the required configuration is common rather than rare.\nPR:L - Any unprivileged local process can do this: `personality()` in `kernel/exec_domain.c:38` performs no capability check, and `remap_file_pages` has no privilege gate whatsoever. No user namespace trick is even needed.\nUI:N - The attacking process performs the entire sequence against its own address space in one self-contained program. No victim action, file open, or mount is required.\nS:U - The vulnerable code and the impacted resource are both governed by the kernel's own security authority, and the resulting RWX mapping lives in the attacker's own address space. This is a MAC-policy/mitigation bypass, not a VM, IOMMU, or hypervisor boundary crossing.\nC:H - Defeating W^X lets an attacker inject and run arbitrary code inside an SELinux-confined domain, which yields unrestricted read of all data and credentials that domain can reach (e.g. a confined network daemon's keys or an Android system service's data). The skipped hook also drops the `file { read/write/map }` re-validation entirely.\nI:H - The whole purpose of the SELinux `execmem`/`file execute` checks is to stop a memory-write primitive from becoming code execution; bypassing them gives the attacker arbitrary code execution in the confined domain and full modification of anything it controls. This is the same integrity impact as the analogous AIO W^X bypass, CVE-2016-10044.\nA:H - Arbitrary code execution inside a confined domain lets the attacker fully disrupt or terminate the affected service, and the mitigation bypass is the enabling step that completes exploit chains whose payloads can crash or hang the system. Following the higher-severity convention where the ceiling of the bypass is complete compromise of the confined component." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "mm/mmap.c" ], "versions": [ { "version": "c8d78c1823f46519473949d33f0d1d33fe21ea16", "lessThan": "0f910dbf2f2a4a7820ba4bac7b280f7108aa05b1", "status": "affected", "versionType": "git" }, { "version": "c8d78c1823f46519473949d33f0d1d33fe21ea16", "lessThan": "49d3a4ad57c57227c3b0fd6cd4188b2a5ebd6178", "status": "affected", "versionType": "git" }, { "version": "c8d78c1823f46519473949d33f0d1d33fe21ea16", "lessThan": "3393fddbfa947c8e1fdcc4509226905ffffd8b89", "status": "affected", "versionType": "git" }, { "version": "c8d78c1823f46519473949d33f0d1d33fe21ea16", "lessThan": "ce14f38d6ee9e88e37ec28427b4b93a7c33c70d3", "status": "affected", "versionType": "git" }, { "version": "c8d78c1823f46519473949d33f0d1d33fe21ea16", "lessThan": "ea7e2d5e49c05e5db1922387b09ca74aa40f46e2", "status": "affected", "versionType": "git" }, { "version": "097f98edde717ce09f217d8a285fe357dcd29fd1", "status": "affected", "versionType": "git" }, { "version": "3.16.59", "lessThan": "3.17", "status": "affected", "versionType": "semver" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "mm/mmap.c" ], "versions": [ { "version": "4.0", "status": "affected" }, { "version": "0", "lessThan": "4.0", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.120", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.54", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.10.13", "lessThanOrEqual": "6.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.11.2", "lessThanOrEqual": "6.11.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.0", "versionEndExcluding": "6.1.120" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.0", "versionEndExcluding": "6.6.54" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.0", "versionEndExcluding": "6.10.13" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.0", "versionEndExcluding": "6.11.2" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.0", "versionEndExcluding": "6.12" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.16.59" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/0f910dbf2f2a4a7820ba4bac7b280f7108aa05b1" }, { "url": "https://git.kernel.org/stable/c/49d3a4ad57c57227c3b0fd6cd4188b2a5ebd6178" }, { "url": "https://git.kernel.org/stable/c/3393fddbfa947c8e1fdcc4509226905ffffd8b89" }, { "url": "https://git.kernel.org/stable/c/ce14f38d6ee9e88e37ec28427b4b93a7c33c70d3" }, { "url": "https://git.kernel.org/stable/c/ea7e2d5e49c05e5db1922387b09ca74aa40f46e2" } ], "title": "mm: call the security_mmap_file() LSM hook in remap_file_pages()", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "metrics": [ { "other": { "type": "ssvc", "content": { "id": "CVE-2024-47745", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "version": "2.0.3", "timestamp": "2024-10-21T12:58:41.257228Z" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-21T13:04:13.918Z" } }, { "title": "CVE Program Container", "references": [ { "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html" } ], "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T20:40:38.700Z" } } ] } }