VYPR
← All advisories
High severity7.8NVD Advisory· Published Oct 21, 2024· Updated May 12, 2026

CVE-2024-47745

CVE-2024-47745

Description

In the Linux kernel, the following vulnerability has been resolved:

mm: call the security_mmap_file() LSM hook in remap_file_pages()

The remap_file_pages syscall handler calls do_mmap() directly, which doesn't contain the LSM security check. And if the process has called personality(READ_IMPLIES_EXEC) before and remap_file_pages() is called for RW pages, this will actually result in remapping the pages to RWX, bypassing a W^X policy enforced by SELinux.

So we should check prot by security_mmap_file LSM hook in the remap_file_pages syscall handler before do_mmap() is called. Otherwise, it potentially permits an attacker to bypass a W^X policy enforced by SELinux.

The bypass is similar to CVE-2016-10044, which bypass the same thing via AIO and can be found in [1].

The PoC:

$ cat > test.c

int main(void) { size_t pagesz = sysconf(_SC_PAGE_SIZE); int mfd = syscall(SYS_memfd_create, "test", 0); const char *buf = mmap(NULL, 4 * pagesz, PROT_READ | PROT_WRITE, MAP_SHARED, mfd, 0); unsigned int old = syscall(SYS_personality, 0xffffffff); syscall(SYS_personality, READ_IMPLIES_EXEC | old); syscall(SYS_remap_file_pages, buf, pagesz, 0, 2, 0); syscall(SYS_personality, old); // show the RWX page exists even if W^X policy is enforced int fd = open("/proc/self/maps", O_RDONLY); unsigned char buf2[1024]; while (1) { int ret = read(fd, buf2, 1024); if (ret <= 0) break; write(1, buf2, ret); } close(fd); }

$ gcc test.c -o test $ ./test | grep rwx 7f1836c34000-7f1836c35000 rwxs 00002000 00:01 2050 /memfd:test (deleted)

[PM: subject line tweaks]

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

The Linux kernel's remap_file_pages() syscall bypasses the SELinux W^X policy by not invoking the security_mmap_file() LSM hook, allowing RWX mappings.

Vulnerability

The remap_file_pages() syscall handler in the Linux kernel calls do_mmap() directly without invoking the security_mmap_file() LSM hook. This omission allows a local attacker to bypass SELinux W^X (Write eXecute) policies when combined with the personality(READ_IMPLIES_EXEC) flag. The issue is similar to CVE-2016-10044, which bypassed the same policy via AIO [1][2][3].

Exploitation

An attacker with local access can call personality() to set READ_IMPLIES_EXEC, then use remap_file_pages() on a writable shared mapping. This remaps the pages as RWX, violating the intended W^X restriction. The provided proof-of-concept demonstrates that a page marked rwxs appears in /proc/self/maps even when SELinux enforces a W^X policy.

Impact

Successful exploitation grants the attacker executable memory from writable memory, undermining memory protection policies. This can facilitate further attacks such as code injection or privilege escalation.

Mitigation

The vulnerability is fixed in Linux kernel stable releases. Patches have been applied to the affected code paths [1][2][3]. Users should update their kernels to the latest stable version to remediate the issue.

References
  1. Making sure you're not a bot!
  2. Making sure you're not a bot!
  3. Making sure you're not a bot!

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

115

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

6

News mentions

0

No linked articles in our index yet.