CVE-2017-1000405

HighCVSS 7.0/10Last modified Jun 17, 2026

Description

The Linux Kernel versions 2.6.38 through 4.14 have a problematic use of pmd_mkdirty() in the touch_pmd() function inside the THP implementation. touch_pmd() can be reached by get_user_pages(). In such case, the pmd will become dirty. This scenario breaks the new can_follow_write_pmd()'s logic - pmd can become dirty without going through a COW cycle. This bug is not as severe as the original "Dirty cow" because an ext4 file (or any other regular file) cannot be mapped using THP. Nevertheless, it does allow us to overwrite read-only huge pages. For example, the zero huge page and sealed shmem files can be overwritten (since their mapping can be populated using THP). Note that after the first write page-fault to the zero page, it will be replaced with a new fresh (and zeroed) thp.

Metrics

CVSS 3.1 7.0/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-362

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.securityfocus.com/bid/102032Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1040020Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2018:0180Third Party Advisory
https://medium.com/bindecy/huge-dirty-cow-cve-2017-1000405-110eca132de0Exploit, Issue Tracking, Third Party Advisory
https://source.android.com/security/bulletin/pixel/2018-02-01Third Party Advisory
https://www.exploit-db.com/exploits/43199/Exploit, Issue Tracking, Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/102032Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1040020Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2018:0180Third Party Advisory
https://medium.com/bindecy/huge-dirty-cow-cve-2017-1000405-110eca132de0Exploit, Issue Tracking, Third Party Advisory
https://source.android.com/security/bulletin/pixel/2018-02-01Third Party Advisory
https://www.exploit-db.com/exploits/43199/Exploit, Issue Tracking, Third Party Advisory, VDB Entry

Timeline

Published: Nov 30, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-10004067.5OpenDaylight Karaf 0.6.1-Carbon fails to clear the cache after a password change, allowing the old password to be used until the Karaf cache CVE-2017-10004077.4The Linux Kernel 2.6.32 and later are affected by a denial of service, by flooding the diagnostic port 0x80 an exception can be triggered le CVE-2017-10004087.8A memory leak in glibc 2.1.1 (released on May 24, 1999) can be reached and amplified through the LD_HWCAP_MASK environment variable. Please CVE-2017-10004097.0A buffer overflow in glibc 2.5 (released on September 29, 2006) and can be triggered through the LD_LIBRARY_PATH environment variable. Pleas CVE-2017-10004107.5The Linux kernel version 3.3-rc1 and later is affected by a vulnerability lies in the processing of incoming L2CAP commands - ConfigRequest,CVE-2017-10004117.5OpenFlow Plugin and OpenDayLight Controller versions Nitrogen, Carbon, Boron, Robert Varga, Anil Vishnoi contain a flaw when multiple 'expir CVE-2017-10004127.5Linaro's open source TEE solution called OP-TEE, version 2.4.0 (and older) is vulnerable to the bellcore attack in the LibTomCrypt code resu CVE-2017-10004135.9Linaro's open source TEE solution called OP-TEE, version 2.4.0 (and older) is vulnerable a timing attack in the Montgomery parts of libMPA i CVE-2017-10004147.5ImpulseAdventure JPEGsnoop version 1.7.5 is vulnerable to a division by zero in the JFIF decode handling resulting denial of service.CVE-2017-10004155.9MatrixSSL version 3.7.2 has an incorrect UTCTime date range validation in its X.509 certificate validation process resulting in some certifi CVE-2017-10004165.3axTLS version 1.5.3 has a coding error in the ASN.1 parser resulting in the year (19)50 of UTCTime being misinterpreted as 2050.CVE-2017-10004175.3MatrixSSL version 3.7.2 adopts a collision-prone OID comparison logic resulting in possible spoofing of OIDs (e.g. in ExtKeyUsage extension)