CVE-2024-50199

What it actually does

The flaw occurs in mm/swapfile during swapoff when unuse_vma processes page tables containing HugeTLB mappings; pud_none_or_clear_bad is invoked on a valid pud, triggering pud_clear_bad, which corrupts the pud entry and orphans the HugeTLB page so it is never freed.

Why it matters to the business

Systems that use 1 GB HugeTLB pages and perform swapoff after swapping anonymous memory may experience kernel errors, loss of large-page allocations, and degraded performance for latency-sensitive workloads that depend on huge pages.

How an attack unfolds

An attacker with the ability to allocate and swap out 1 GB HugeTLB pages (or who can induce a victim process to do so) triggers the condition by executing swapoff; the kernel then walks the page tables, encounters the HugeTLB pud, clears it incorrectly, and loses the mapping, resulting in a bad pud message and permanent loss of the huge page.

How to fix it

Upgrade to a kernel containing commit ba7f982cdb37ff5a7739dec85d7325ea66fc1496 or later; for Ubuntu 16.04 LTS install ironic package version 1:5.1.2-0ubuntu1 or newer. Reboot after installing the fixed kernel.

How to confirm the fix worked

Confirm the running kernel contains commit ba7f982cdb37ff5a7739dec85d7325ea66fc1496; attempt to reproduce the original steps (allocate 1 GB HugeTLB, swap out, swapoff) and verify that no bad pud message appears and the huge page is correctly freed.

Typical attack path

1. Allocate anonymous 1 GB HugeTLB pages plus other anonymous memory
2. Force the pages to be swapped out
3. Execute swapoff on the swap device
4. Observe bad pud error and permanent loss of the HugeTLB mapping

How to detect it

Search kernel logs for 'bad pud' entries originating from pud_clear_bad called during swapoff; correlate with processes that allocate 1 GB HugeTLB pages and subsequent swapoff invocations.

What your security team should do

• Apply the fixed kernel version immediately on all systems that use HugeTLB pages
• Audit workloads for 1 GB huge-page usage before scheduling swapoff operations
• Monitor kernel logs for 'bad pud' messages during swapoff as a temporary detection measure