CyberRota Analysis
AI-GeneratedThe vulnerability arises when msync(MS_INVALIDATE) is invoked on a mapping of an unmanaged device object, leading to a use-after-free condition in the kernel due to improper handling of physical pages. This flaw allows an unprivileged local user with access to specific memory-mapped I/O devices to potentially escalate privileges by corrupting the object list during page fault handling. Organizations utilizing systems with unmanaged device objects should prioritize this issue to mitigate the risk of privilege escalation attacks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
When msync(MS_INVALIDATE) is called on a mapping of an unmanaged device object, the physical pages in the mapping range are marked invalid but remain in the pager's page list. A subsequent page fault will cause the fault handler to re-insert the page into the object's list. This corrupts the list, and on object destruction the page is freed twice. An unprivileged local user with access to a device that provides memory-mapped I/O can trigger a use-after-free in the kernel, though this is limited to a pool of objects ("fictitious pages") that are never recycled for a different purpose. It may be possible to exploit this to escalate privileges.
Related CVEs
Other vulnerabilities affecting the same vendor(s)