CVE-2024-35797

Summary

In the Linux kernel, the following vulnerability has been resolved:

mm: cachestat: fix two shmem bugs

When cachestat on shmem races with swapping and invalidation, there are two possible bugs:

  1. A swapin error can have resulted in a poisoned swap entry in the shmem inode's xarray. Calling get_shadow_from_swap_cache() on it will result in an out-of-bounds access to swapper_spaces[].

    Validate the entry with non_swap_entry() before going further.

  2. When we find a valid swap entry in the shmem's inode, the shadow entry in the swapcache might not exist yet: swap IO is still in progress and we're before __remove_mapping; swapin, invalidation, or swapoff have removed the shadow from swapcache after we saw the shmem swap entry.

    This will send a NULL to workingset_test_recent(). The latter purely operates on pointer bits, so it won't crash - node 0, memcg ID 0, eviction timestamp 0, etc. are all valid inputs - but it's a bogus test. In theory that could result in a false "recently evicted" count.

    Such a false positive wouldn't be the end of the world. But for code clarity and (future) robustness, be explicit about this case.

    Bail on get_shadow_from_swap_cache() returning NULL.

Affected Software

VendorProductVersion RangeStatus
LinuxLinuxcf264e1329fb0307e044f7675849f9f38b44c11a < b79f9e1ff27c994a4c452235ba09e672ec698e23affected
LinuxLinuxcf264e1329fb0307e044f7675849f9f38b44c11a < d962f6c583458037dc7e529659b2b02b9dd3d94baffected
LinuxLinuxcf264e1329fb0307e044f7675849f9f38b44c11a < 24a0e73d544439bb9329fbbafac44299e548a677affected
LinuxLinuxcf264e1329fb0307e044f7675849f9f38b44c11a < d5d39c707a4cf0bcc84680178677b97aa2cb2627affected
LinuxLinux6.5affected
LinuxLinux0 < 6.5unaffected
LinuxLinux6.6.24 <= 6.6.*unaffected
LinuxLinux6.7.12 <= 6.7.*unaffected
LinuxLinux6.8.3 <= 6.8.*unaffected
LinuxLinux6.9 <= *unaffected

Weaknesses

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

CVE Program Container

Additional References

References