CVE-2017-1000405

What it actually does

The flaw allows a local process to cause a PMD to become dirty via touch_pmd() reached through get_user_pages() without a copy-on-write cycle, enabling writes to read-only huge pages such as the zero page and sealed shmem files.

Why it matters to the business

Attackers on affected Linux systems can corrupt memory regions that should be read-only, potentially leading to privilege escalation or integrity violations on servers and endpoints running vulnerable kernels.

How an attack unfolds

A local attacker maps a read-only huge page, triggers get_user_pages() to invoke touch_pmd(), forces the PMD dirty state, and then performs writes that bypass intended protections on the zero huge page or sealed shmem.

How to fix it

Upgrade the Linux kernel to a version containing commit 0e2c4c21a56b8f820bab218566b02ea728909f45 or later; apply vendor-supplied kernel updates for distributions based on versions 2.6.38 through 4.14.

How to confirm the fix worked

Verify the running kernel version is newer than the affected range or contains the referenced commit; test that read-only huge page mappings cannot be written after the update.

Typical attack path

1. Obtain local user access on a vulnerable Linux system
2. Map a read-only huge page or sealed shmem file using THP
3. Trigger get_user_pages() to reach touch_pmd()
4. Exploit the dirty PMD state to write to the read-only page
5. Achieve memory corruption or code execution

How to detect it

Review system logs for unusual page fault patterns or memory mapping activity by unprivileged processes; examine kernel audit records for get_user_pages calls on huge pages.

What your security team should do

• Prioritize kernel updates on all systems still running versions 2.6.38-4.14
• Restrict untrusted local accounts where possible until patches are applied
• Monitor for new public exploits targeting this race condition