PT-2024-29207 · Linux+5 · Linux Kernel+5
Audra Mitchell
·
Published
2024-06-26
·
Updated
2026-03-14
·
CVE-2024-41027
CVSS v3.1
3.3
Low
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to 6.6.43
Description
The issue is related to the
userfaultfd api() function in the Linux kernel, which is associated with resource management errors. If a feature is not set in the Kernel config, the function fails silently and returns all available features, instead of returning an EINVAL as indicated by the man page. This can lead to a Kernel warning if a program requests the UFFD FEATURE WP UNPOPULATED feature on a kernel with the config not set for this feature. The vulnerability can be exploited to cause a denial of service.Recommendations
To resolve the issue, update the Linux kernel to version 6.6.43 or later. As a temporary workaround, consider restricting the use of the
userfaultfd api() function until a patch is available. Avoid requesting the UFFD FEATURE WP UNPOPULATED feature on kernels with the config not set for this feature to minimize the risk of exploitation.Exploit
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Astra Linux
Debian
Linuxmint
Linux Kernel
Red Os
Ubuntu