Linux Kernel VMA Unmapping Vulnerability in Stacked Drivers

A vulnerability in the Linux kernel's memory management system has been addressed. The issue arose in the Virtual Memory Area (VMA) handling, specifically when the 'mmap_prepare' function was invoked from the 'mmap' hook of stacked drivers, such as overlayfs and shared memory. In these cases, the VMA pointer was not fully established and detached, leading to errors when attempting to unmap it. This problem was unnecessary, as the 'mmap' handler would already clean up the VMA on error. The vulnerability has been resolved by modifying the 'mmap_action_complete' function to properly manage VMA cleanup based on how the 'mmap' action is completed, ensuring that detached VMAs are not incorrectly unmapped.

Impact

The vulnerability could cause warnings about detached VMAs, indicating a potential issue in the VMA management process.

Reproduction

To reproduce this vulnerability, invoke the 'mmap_prepare' function from the 'mmap' hook of a stacked driver, such as overlayfs or shared memory. This will pass a detached VMA pointer to the caller, creating a scenario where an error can occur if an attempt is made to unmap the VMA, as it is already detached. The issue can be observed as a warning in 'vma_mark_detached()', highlighting the problem with the VMA being in a detached state.

Remediation

Users can update to the latest version of the Linux kernel, where this vulnerability has been fixed.