cve-2024-35797
Vulnerability from cvelistv5
Published
2024-05-17 13:23
Modified
2024-12-19 08:55
Severity ?
5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Summary
In the Linux kernel, the following vulnerability has been resolved: mm: cachestat: fix two shmem bugs When cachestat on shmem races with swapping and invalidation, there are two possible bugs: 1) A swapin error can have resulted in a poisoned swap entry in the shmem inode's xarray. Calling get_shadow_from_swap_cache() on it will result in an out-of-bounds access to swapper_spaces[]. Validate the entry with non_swap_entry() before going further. 2) When we find a valid swap entry in the shmem's inode, the shadow entry in the swapcache might not exist yet: swap IO is still in progress and we're before __remove_mapping; swapin, invalidation, or swapoff have removed the shadow from swapcache after we saw the shmem swap entry. This will send a NULL to workingset_test_recent(). The latter purely operates on pointer bits, so it won't crash - node 0, memcg ID 0, eviction timestamp 0, etc. are all valid inputs - but it's a bogus test. In theory that could result in a false "recently evicted" count. Such a false positive wouldn't be the end of the world. But for code clarity and (future) robustness, be explicit about this case. Bail on get_shadow_from_swap_cache() returning NULL.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/24a0e73d544439bb9329fbbafac44299e548a677
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/b79f9e1ff27c994a4c452235ba09e672ec698e23
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/d5d39c707a4cf0bcc84680178677b97aa2cb2627
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/d962f6c583458037dc7e529659b2b02b9dd3d94b
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/24a0e73d544439bb9329fbbafac44299e548a677
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/b79f9e1ff27c994a4c452235ba09e672ec698e23
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/d5d39c707a4cf0bcc84680178677b97aa2cb2627
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/d962f6c583458037dc7e529659b2b02b9dd3d94b
Impacted products
Vendor Product Version
Linux Linux Version: 6.5
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "LOW",
              "baseScore": 5.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-35797",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-17T17:19:03.392959Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-787",
                "description": "CWE-787 Out-of-bounds Write",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-12T16:52:46.185Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T03:21:47.505Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/b79f9e1ff27c994a4c452235ba09e672ec698e23"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/d962f6c583458037dc7e529659b2b02b9dd3d94b"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/24a0e73d544439bb9329fbbafac44299e548a677"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/d5d39c707a4cf0bcc84680178677b97aa2cb2627"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "mm/filemap.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b79f9e1ff27c994a4c452235ba09e672ec698e23",
              "status": "affected",
              "version": "cf264e1329fb0307e044f7675849f9f38b44c11a",
              "versionType": "git"
            },
            {
              "lessThan": "d962f6c583458037dc7e529659b2b02b9dd3d94b",
              "status": "affected",
              "version": "cf264e1329fb0307e044f7675849f9f38b44c11a",
              "versionType": "git"
            },
            {
              "lessThan": "24a0e73d544439bb9329fbbafac44299e548a677",
              "status": "affected",
              "version": "cf264e1329fb0307e044f7675849f9f38b44c11a",
              "versionType": "git"
            },
            {
              "lessThan": "d5d39c707a4cf0bcc84680178677b97aa2cb2627",
              "status": "affected",
              "version": "cf264e1329fb0307e044f7675849f9f38b44c11a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "mm/filemap.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.5"
            },
            {
              "lessThan": "6.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.24",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm: cachestat: fix two shmem bugs\n\nWhen cachestat on shmem races with swapping and invalidation, there\nare two possible bugs:\n\n1) A swapin error can have resulted in a poisoned swap entry in the\n   shmem inode\u0027s xarray. Calling get_shadow_from_swap_cache() on it\n   will result in an out-of-bounds access to swapper_spaces[].\n\n   Validate the entry with non_swap_entry() before going further.\n\n2) When we find a valid swap entry in the shmem\u0027s inode, the shadow\n   entry in the swapcache might not exist yet: swap IO is still in\n   progress and we\u0027re before __remove_mapping; swapin, invalidation,\n   or swapoff have removed the shadow from swapcache after we saw the\n   shmem swap entry.\n\n   This will send a NULL to workingset_test_recent(). The latter\n   purely operates on pointer bits, so it won\u0027t crash - node 0, memcg\n   ID 0, eviction timestamp 0, etc. are all valid inputs - but it\u0027s a\n   bogus test. In theory that could result in a false \"recently\n   evicted\" count.\n\n   Such a false positive wouldn\u0027t be the end of the world. But for\n   code clarity and (future) robustness, be explicit about this case.\n\n   Bail on get_shadow_from_swap_cache() returning NULL."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-19T08:55:21.971Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b79f9e1ff27c994a4c452235ba09e672ec698e23"
        },
        {
          "url": "https://git.kernel.org/stable/c/d962f6c583458037dc7e529659b2b02b9dd3d94b"
        },
        {
          "url": "https://git.kernel.org/stable/c/24a0e73d544439bb9329fbbafac44299e548a677"
        },
        {
          "url": "https://git.kernel.org/stable/c/d5d39c707a4cf0bcc84680178677b97aa2cb2627"
        }
      ],
      "title": "mm: cachestat: fix two shmem bugs",
      "x_generator": {
        "engine": "bippy-5f407fcff5a0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-35797",
    "datePublished": "2024-05-17T13:23:08.204Z",
    "dateReserved": "2024-05-17T12:19:12.340Z",
    "dateUpdated": "2024-12-19T08:55:21.971Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-35797\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-17T14:15:11.937\",\"lastModified\":\"2024-11-21T09:20:55.060\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmm: cachestat: fix two shmem bugs\\n\\nWhen cachestat on shmem races with swapping and invalidation, there\\nare two possible bugs:\\n\\n1) A swapin error can have resulted in a poisoned swap entry in the\\n   shmem inode\u0027s xarray. Calling get_shadow_from_swap_cache() on it\\n   will result in an out-of-bounds access to swapper_spaces[].\\n\\n   Validate the entry with non_swap_entry() before going further.\\n\\n2) When we find a valid swap entry in the shmem\u0027s inode, the shadow\\n   entry in the swapcache might not exist yet: swap IO is still in\\n   progress and we\u0027re before __remove_mapping; swapin, invalidation,\\n   or swapoff have removed the shadow from swapcache after we saw the\\n   shmem swap entry.\\n\\n   This will send a NULL to workingset_test_recent(). The latter\\n   purely operates on pointer bits, so it won\u0027t crash - node 0, memcg\\n   ID 0, eviction timestamp 0, etc. are all valid inputs - but it\u0027s a\\n   bogus test. In theory that could result in a false \\\"recently\\n   evicted\\\" count.\\n\\n   Such a false positive wouldn\u0027t be the end of the world. But for\\n   code clarity and (future) robustness, be explicit about this case.\\n\\n   Bail on get_shadow_from_swap_cache() returning NULL.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: mm: cachestat: corrige dos errores de shmem Cuando cachestat en shmem se ejecuta con intercambio e invalidaci\u00f3n, hay dos errores posibles: 1) Un error de intercambio puede haber resultado en una entrada de intercambio envenenada en la matriz x del inodo shmem. Llamar a get_shadow_from_swap_cache() dar\u00e1 como resultado un acceso fuera de los l\u00edmites a swapper_spaces[]. Valide la entrada con non_swap_entry() antes de continuar. 2) Cuando encontramos una entrada de intercambio v\u00e1lida en el inodo de shmem, es posible que la entrada oculta en el cach\u00e9 de intercambio a\u00fan no exista: el intercambio de E/S a\u00fan est\u00e1 en progreso y estamos antes de __remove_mapping; swapin, invalidaci\u00f3n o swapoff han eliminado la sombra de swapcache despu\u00e9s de que vimos la entrada de intercambio shmem. Esto enviar\u00e1 un NULL aworkingset_test_recent(). Este \u00faltimo opera exclusivamente con bits de puntero, por lo que no fallar\u00e1 (el nodo 0, el ID de memcg 0, la marca de tiempo de desalojo 0, etc. son todas entradas v\u00e1lidas), pero es una prueba falsa. En teor\u00eda, eso podr\u00eda resultar en un recuento falso de \\\"desalojados recientemente\\\". Un falso positivo as\u00ed no ser\u00eda el fin del mundo. Pero para mayor claridad del c\u00f3digo y solidez (futura), sea expl\u00edcito sobre este caso. Libere get_shadow_from_swap_cache() y devuelva NULL.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L\",\"baseScore\":5.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":3.9,\"impactScore\":1.4}]},\"weaknesses\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-787\"}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/24a0e73d544439bb9329fbbafac44299e548a677\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b79f9e1ff27c994a4c452235ba09e672ec698e23\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/d5d39c707a4cf0bcc84680178677b97aa2cb2627\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/d962f6c583458037dc7e529659b2b02b9dd3d94b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/24a0e73d544439bb9329fbbafac44299e548a677\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://git.kernel.org/stable/c/b79f9e1ff27c994a4c452235ba09e672ec698e23\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://git.kernel.org/stable/c/d5d39c707a4cf0bcc84680178677b97aa2cb2627\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://git.kernel.org/stable/c/d962f6c583458037dc7e529659b2b02b9dd3d94b\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.