CVE-2024-35797 mm: cachestat: fix two shmem bugs
A race condition in Linux kernel shmem handling can cause out-of-bounds memory access, potentially leading to system crashes or instability.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-35797?
CVE-2024-35797 is a high-severity memory corruption vulnerability in Linux kernel, published on 17 May 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
mm: cachestat: fix two shmem bugs
When cachestat on shmem races with swapping and invalidation, there are two possible bugs:
1) A swapin error can have resulted in a poisoned swap entry in the shmem inode's xarray. Calling get_shadow_from_swap_cache() on it will result in an out-of-bounds access to swapper_spaces[].
Validate the entry with non_swap_entry() before going further.
2) When we find a valid swap entry in the shmem's inode, the shadow entry in the swapcache might not exist yet: swap IO is still in progress and we're before __remove_mapping; swapin, invalidation, or swapoff have removed the shadow from swapcache after we saw the shmem swap entry.
This will send a NULL to workingset_test_recent(). The latter purely operates on pointer bits, so it won't crash - node 0, memcg ID 0, eviction timestamp 0, etc. are all valid inputs - but it's a bogus test. In theory that could result in a false "recently evicted" count.
Such a false positive wouldn't be the end of the world. But for code clarity and (future) robustness, be explicit about this case.
Bail on get_shadow_from_swap_cache() returning NULL.
Weakness: CWE-787
Which versions are affected by CVE-2024-35797?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-35797?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2024-35797 being exploited?
There is no known exploitation of CVE-2024-35797 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2024-35797, DEBIAN-CVE-2024-35797, GHSA-3f3w-qrjm-6m77, UBUNTU-CVE-2024-35797.