CVE-2024-47745

What it actually does

The remap_file_pages syscall handler invokes do_mmap() without first calling the security_mmap_file LSM hook, allowing RW pages to be remapped as RWX when personality(READ_IMPLIES_EXEC) has been set, thereby bypassing SELinux W^X enforcement.

Why it matters to the business

Local attackers can obtain executable memory regions that violate mandatory access-control policies, increasing the chance of successful code execution or privilege escalation on affected Linux systems and downstream packages.

How an attack unfolds

An attacker first calls personality(READ_IMPLIES_EXEC), then invokes remap_file_pages on a writable mapping; because the LSM check is missing, the kernel grants an RWX page that SELinux would otherwise deny, similar to the earlier AIO bypass in CVE-2016-10044.

How to fix it

Upgrade the Linux kernel to commit 0f910dbf2f2a4a7820ba4bac7b280f7108aa05b1 or later; for Rocky Linux 8 lldpad update to 1.0.1-13.git036e314.el8 or newer; rebuild and reboot all affected systems.

How to confirm the fix worked

Confirm the running kernel contains the security_mmap_file call in remap_file_pages; attempt the supplied PoC and verify that no rwx mapping appears when SELinux W^X policy is active.

Typical attack path

1. Call personality(READ_IMPLIES_EXEC) to alter default mapping protections
2. Create a writable memory mapping via memfd or similar
3. Invoke remap_file_pages on the mapping to trigger the unchecked do_mmap path
4. Verify the resulting RWX page appears in /proc/self/maps
5. Use the executable mapping to load or execute attacker-controlled code

How to detect it

Review system call audit logs for sequences of personality(READ_IMPLIES_EXEC) followed immediately by remap_file_pages; inspect /proc/<pid>/maps for unexpected rwx entries created by unprivileged processes.

What your security team should do

• Apply the kernel and package updates within the next maintenance window
• Audit SELinux policies and application use of remap_file_pages and personality syscalls
• Monitor for future similar bypasses in other direct do_mmap callers