Google: sys-kernel/lakitu-kernel-6_1, sys-kernel/lakitu-kernel-6_6: security update to 18613.75.60

medium Tenable Cloud Security Plugin ID 471580

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- In the Linux kernel, the following vulnerability has been resolved: secretmem: disable memfd_secret() if
arch cannot set direct map Return -ENOSYS from memfd_secret() syscall if !can_set_direct_map(). This is
the case for example on some arm64 configurations, where marking 4k PTEs in the direct map not present can
only be done if the direct map is set up at 4k granularity in the first place (as ARM's break-before-make
semantics do not easily allow breaking apart large/gigantic pages). More precisely, on arm64 systems with
!can_set_direct_map(), set_direct_map_invalid_noflush() is a no-op, however it returns success (0) instead
of an error. This means that memfd_secret will seemingly "work" (e.g. syscall succeeds, you can mmap the
fd and fault in pages), but it does not actually achieve its goal of removing its memory from the direct
map. Note that with this patch, memfd_secret() will start erroring on systems where can_set_direct_map()
returns false (arm64 with CONFIG_RODATA_FULL_DEFAULT_ENABLED=n, CONFIG_DEBUG_PAGEALLOC=n and
CONFIG_KFENCE=n), but that still seems better than the current silent failure. Since
CONFIG_RODATA_FULL_DEFAULT_ENABLED defaults to 'y', most arm64 systems actually have a working
memfd_secret() and aren't be affected. From going through the iterations of the original memfd_secret
patch series, it seems that disabling the syscall in these scenarios was the intended behavior [1]
(preferred over having set_direct_map_invalid_noflush return an error as that would result in SIGBUSes at
page-fault time), however the check for it got dropped between v16 [2] and v17 [3], when secretmem moved
away from CMA allocations. [1]: https://lore.kernel.org/lkml/[email protected]/ [2]:
https://lore.kernel.org/lkml/[email protected]/#t [3]:
https://lore.kernel.org/lkml/[email protected]/ (CVE-2024-50182)

Solution

Update the sys-kernel/lakitu-kernel-6_1 library and its related packages to version 18613.75.60 or later.

Plugin Details

Severity: Medium

ID: 471580

Version: Revision 1.3

Type: Local

Family: Google COS Security Checks

Published: 10/3/2026

Updated: 10/6/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.18

Vendor

Vendor Severity: MEDIUM

CVSS v2

Risk Factor: Medium

Base Score: 4.6

Temporal Score: 3.4

Vector: CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C

CVSS Score Source: CVE-2024-50182

CVSS v3

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 11/7/2024

Reference Information

CVE: CVE-2024-50182

Detections

Analytics