CyberRota Analysis
AI-GeneratedThe vulnerability affects the Linux kernel's userfaultfd feature, allowing unauthorized registration on shadow stack virtual memory areas (VMAs). This could enable an attacker with userfaultfd access to manipulate the stack by discarding a page and injecting a page with chosen return addresses, potentially leading to arbitrary code execution. Organizations using Linux systems, particularly those implementing userfaultfd, should prioritize applying the relevant updates to mitigate this risk.
Original NVD Description
In the Linux kernel, the following vulnerability has been resolved: userfaultfd: prevent registration of special VMAs Vova Tokarev says: userfaultfd allows registration on shadow stack VMAs. With userfaultfd access, you can register on the shadow stack, discard a page ... and inject a page with chosen return addresses via UFFDIO_COPY. Update vma_can_userfault() to reject VM_SHADOW_STACK. While on it, also reject VM_SPECIAL so that if a driver would implement vm_uffd_ops, it wouldn't be possible to register special VMAs with userfaultfd. Since VM_SPECIAL includes VM_DONTEXPAND which is set but hugetlb, exclude hugetlb VMAs from the check for VM_SPECIAL.