Linux Kernel Memfd SEAL_WRITE Vulnerability Allowing Writable Mappings

A vulnerability in the Linux kernel's handling of memory file descriptors (memfd) allows writable mappings to persist even when SEAL_WRITE is supposedly applied. This issue arises because the SEAL_EXEC seal, which implies SEAL_WRITE, is added after a check that prevents writable mappings. As a result, an attacker could exploit this behavior to modify a memfd that appears to be write-sealed. The vulnerability affects the Linux kernel's stable releases.

Impact

Exploitation of this vulnerability could lead to unauthorized modifications of memory file descriptors that are intended to be write-sealed, potentially allowing for arbitrary changes to the data or behavior associated with those file descriptors.

Reproduction

To reproduce this vulnerability, create a memory file descriptor and add the SEAL_EXEC seal. The SEAL_WRITE seal will be implicitly applied, but if the memfd has writable mappings, it can still be modified. This can be done by manipulating the order in which the seals are applied and the writable mappings are denied.

Remediation

The vulnerability has been addressed by modifying the order in which the implied seals are applied, ensuring that SEAL_WRITE is correctly enforced before any writable mappings can be established.