CVE-2024-35797
published 2024-05-17CVE-2024-35797: In the Linux kernel, the following vulnerability has been resolved: mm: cachestat: fix two shmem bugs When cachestat on shmem races with swapping and…
PriorityP421medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.65%
47.4th percentile
In the Linux kernel, the following vulnerability has been resolved:
mm: cachestat: fix two shmem bugs
When cachestat on shmem races with swapping and invalidation, there
are two possible bugs:
1) A swapin error can have resulted in a poisoned swap entry in the
shmem inode's xarray. Calling get_shadow_from_swap_cache() on it
will result in an out-of-bounds access to swapper_spaces[].
Validate the entry with non_swap_entry() before going further.
2) When we find a valid swap entry in the shmem's inode, the shadow
entry in the swapcache might not exist yet: swap IO is still in
progress and we're before __remove_mapping; swapin, invalidation,
or swapoff have removed the shadow from swapcache after we saw the
shmem swap entry.
This will send a NULL to workingset_test_recent(). The latter
purely operates on pointer bits, so it won't crash - node 0, memcg
ID 0, eviction timestamp 0, etc. are all valid inputs - but it's a
bogus test. In theory that could result in a false "recently
evicted" count.
Such a false positive wouldn't be the end of the world. But for
code clarity and (future) robustness, be explicit about this case.
Bail on get_shadow_from_swap_cache() returning NULL.
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.7.12-1 (forky) | linux 6.7.12-1 (forky) |
| linux | linux | — | — |
| linux | linux | >= cf264e1329fb0307e044f7675849f9f38b44c11a < b79f9e1ff27c994a4c452235ba09e672ec698e23 | b79f9e1ff27c994a4c452235ba09e672ec698e23 |
| linux | linux | >= cf264e1329fb0307e044f7675849f9f38b44c11a < d962f6c583458037dc7e529659b2b02b9dd3d94b | d962f6c583458037dc7e529659b2b02b9dd3d94b |
| linux | linux | >= cf264e1329fb0307e044f7675849f9f38b44c11a < 24a0e73d544439bb9329fbbafac44299e548a677 | 24a0e73d544439bb9329fbbafac44299e548a677 |
| linux | linux | >= cf264e1329fb0307e044f7675849f9f38b44c11a < d5d39c707a4cf0bcc84680178677b97aa2cb2627 | d5d39c707a4cf0bcc84680178677b97aa2cb2627 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 6.7.12-1 | 6.7.12-1 |
| linux | linux_kernel | >= 0 < 6.7.12-1 | 6.7.12-1 |
| linux | linux_kernel | >= 0 < 6.8.0-35.35 | 6.8.0-35.35 |
| linux | linux_kernel | >= 6.5 < 6.6.24 | 6.6.24 |
| linux | linux_kernel | >= 6.7 < 6.7.12 | 6.7.12 |
| linux | linux_kernel | >= 6.8 < 6.8.3 | 6.8.3 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_ubuntu6.3MEDIUM
vendor_debian5.5LOW
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Linux kernel (Oracle) vulnerabilities
vendor_ubuntu·2024-07-04·CVSS 6.3
CVE-2024-26868 [MEDIUM] Linux kernel (Oracle) vulnerabilities
Title: Linux kernel (Oracle) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Ziming Zhang discovered that the DRM driver for VMware Virtual GPU did not
properly handle certain error conditions, leading to a NULL pointer
dereference. A local attacker could possibly trigger this vulnerability to
cause a denial of service. (CVE-2022-38096)
Zheng Wang discovered that the Broadcom FullMAC WLAN driver in the Linux
kernel contained a race condition during device removal, leading to a use-
after-free vulnerability. A physically proximate attacker could possibly
use this to cause a denial of service (system crash). (CVE-2023-47233)
It was discovered that the ATA over Ethernet (AoE) driver in the Linux
kernel contained a race condition, leading to a use-after-fre
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2024-06-14·CVSS 6.3
CVE-2024-26978 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Ziming Zhang discovered that the DRM driver for VMware Virtual GPU did not
properly handle certain error conditions, leading to a NULL pointer
dereference. A local attacker could possibly trigger this vulnerability to
cause a denial of service. (CVE-2022-38096)
Zheng Wang discovered that the Broadcom FullMAC WLAN driver in the Linux
kernel contained a race condition during device removal, leading to a use-
after-free vulnerability. A physically proximate attacker could possibly
use this to cause a denial of service (system crash). (CVE-2023-47233)
It was discovered that the ATA over Ethernet (AoE) driver in the Linux
kernel contained a race condition, leading to a use-after-free
vulnera
Ubuntu
Linux kernel (OEM) vulnerabilities
vendor_ubuntu·2024-06-11·CVSS 6.3
CVE-2024-27033 [MEDIUM] Linux kernel (OEM) vulnerabilities
Title: Linux kernel (OEM) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Ziming Zhang discovered that the DRM driver for VMware Virtual GPU did not
properly handle certain error conditions, leading to a NULL pointer
dereference. A local attacker could possibly trigger this vulnerability to
cause a denial of service. (CVE-2022-38096)
Zheng Wang discovered that the Broadcom FullMAC WLAN driver in the Linux
kernel contained a race condition during device removal, leading to a use-
after-free vulnerability. A physically proximate attacker could possibly
use this to cause a denial of service (system crash). (CVE-2023-47233)
It was discovered that the ATA over Ethernet (AoE) driver in the Linux
kernel contained a race condition, leading to a use-after-free
v
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2024-06-07·CVSS 6.3
CVE-2024-26876 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Ziming Zhang discovered that the DRM driver for VMware Virtual GPU did not
properly handle certain error conditions, leading to a NULL pointer
dereference. A local attacker could possibly trigger this vulnerability to
cause a denial of service. (CVE-2022-38096)
Zheng Wang discovered that the Broadcom FullMAC WLAN driver in the Linux
kernel contained a race condition during device removal, leading to a use-
after-free vulnerability. A physically proximate attacker could possibly
use this to cause a denial of service (system crash). (CVE-2023-47233)
It was discovered that the ATA over Ethernet (AoE) driver in the Linux
kernel contained a race condition, leading to a use-after-free
vulnera
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2024-06-07·CVSS 6.3
CVE-2024-26870 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Ziming Zhang discovered that the DRM driver for VMware Virtual GPU did not
properly handle certain error conditions, leading to a NULL pointer
dereference. A local attacker could possibly trigger this vulnerability to
cause a denial of service. (CVE-2022-38096)
Zheng Wang discovered that the Broadcom FullMAC WLAN driver in the Linux
kernel contained a race condition during device removal, leading to a use-
after-free vulnerability. A physically proximate attacker could possibly
use this to cause a denial of service (system crash). (CVE-2023-47233)
It was discovered that the ATA over Ethernet (AoE) driver in the Linux
kernel contained a race condition, leading to a use-after-free
vulnera
Red Hat
kernel: mm: cachestat: fix two shmem bugs
vendor_redhat·2024-05-17·CVSS 5.5
CVE-2024-35797 [MEDIUM] kernel: mm: cachestat: fix two shmem bugs
kernel: mm: cachestat: fix two shmem bugs
In the Linux kernel, the following vulnerability has been resolved:
mm: cachestat: fix two shmem bugs
When cachestat on shmem races with swapping and invalidation, there
are two possible bugs:
1) A swapin error can have resulted in a poisoned swap entry in the
shmem inode's xarray. Calling get_shadow_from_swap_cache() on it
will result in an out-of-bounds access to swapper_spaces[].
Validate the entry with non_swap_entry() before going further.
2) When we find a valid swap entry in the shmem's inode, the shadow
entry in the swapcache might not exist yet: swap IO is still in
progress and we're before __remove_mapping; swapin, invalidation,
or swapoff have removed the shadow from swapcache after we saw the
shmem swap entry.
This will send a NULL to
Debian
CVE-2024-35797: linux - In the Linux kernel, the following vulnerability has been resolved: mm: cachest...
vendor_debian·2024·CVSS 5.5
CVE-2024-35797 [MEDIUM] CVE-2024-35797: linux - In the Linux kernel, the following vulnerability has been resolved: mm: cachest...
In the Linux kernel, the following vulnerability has been resolved: mm: cachestat: fix two shmem bugs When cachestat on shmem races with swapping and invalidation, there are two possible bugs: 1) A swapin error can have resulted in a poisoned swap entry in the shmem inode's xarray. Calling get_shadow_from_swap_cache() on it will result in an out-of-bounds access to swapper_spaces[]. Validate the entry with non_swap_entry() before going further. 2) When we find a valid swap entry in the shmem's inode, the shadow entry in the swapcache might not exist yet: swap IO is still in progress and we're before __remove_mapping; swapin, invalidation, or swapoff have removed the shadow from swapcache after we saw the shmem swap entry. This will send a NULL to workingset_test_recent(). The latter purely
OSV
linux-oracle vulnerabilities
osv·2024-07-04·CVSS 5.5
CVE-2022-38096 [MEDIUM] linux-oracle vulnerabilities
linux-oracle vulnerabilities
Ziming Zhang discovered that the DRM driver for VMware Virtual GPU did not
properly handle certain error conditions, leading to a NULL pointer
dereference. A local attacker could possibly trigger this vulnerability to
cause a denial of service. (CVE-2022-38096)
Zheng Wang discovered that the Broadcom FullMAC WLAN driver in the Linux
kernel contained a race condition during device removal, leading to a use-
after-free vulnerability. A physically proximate attacker could possibly
use this to cause a denial of service (system crash). (CVE-2023-47233)
It was discovered that the ATA over Ethernet (AoE) driver in the Linux
kernel contained a race condition, leading to a use-after-free
vulnerability. An attacker could use this to cause a denial of service or
possib
OSV
linux-azure, linux-gke vulnerabilities
osv·2024-06-14·CVSS 5.5
CVE-2022-38096 [MEDIUM] linux-azure, linux-gke vulnerabilities
linux-azure, linux-gke vulnerabilities
Ziming Zhang discovered that the DRM driver for VMware Virtual GPU did not
properly handle certain error conditions, leading to a NULL pointer
dereference. A local attacker could possibly trigger this vulnerability to
cause a denial of service. (CVE-2022-38096)
Zheng Wang discovered that the Broadcom FullMAC WLAN driver in the Linux
kernel contained a race condition during device removal, leading to a use-
after-free vulnerability. A physically proximate attacker could possibly
use this to cause a denial of service (system crash). (CVE-2023-47233)
It was discovered that the ATA over Ethernet (AoE) driver in the Linux
kernel contained a race condition, leading to a use-after-free
vulnerability. An attacker could use this to cause a denial of service
OSV
linux-oem-6.8 vulnerabilities
osv·2024-06-11·CVSS 5.5
CVE-2022-38096 [MEDIUM] linux-oem-6.8 vulnerabilities
linux-oem-6.8 vulnerabilities
Ziming Zhang discovered that the DRM driver for VMware Virtual GPU did not
properly handle certain error conditions, leading to a NULL pointer
dereference. A local attacker could possibly trigger this vulnerability to
cause a denial of service. (CVE-2022-38096)
Zheng Wang discovered that the Broadcom FullMAC WLAN driver in the Linux
kernel contained a race condition during device removal, leading to a use-
after-free vulnerability. A physically proximate attacker could possibly
use this to cause a denial of service (system crash). (CVE-2023-47233)
It was discovered that the ATA over Ethernet (AoE) driver in the Linux
kernel contained a race condition, leading to a use-after-free
vulnerability. An attacker could use this to cause a denial of service or
possi
OSV
linux, linux-ibm, linux-lowlatency, linux-raspi vulnerabilities
osv·2024-06-07·CVSS 5.5
CVE-2022-38096 [MEDIUM] linux, linux-ibm, linux-lowlatency, linux-raspi vulnerabilities
linux, linux-ibm, linux-lowlatency, linux-raspi vulnerabilities
Ziming Zhang discovered that the DRM driver for VMware Virtual GPU did not
properly handle certain error conditions, leading to a NULL pointer
dereference. A local attacker could possibly trigger this vulnerability to
cause a denial of service. (CVE-2022-38096)
Zheng Wang discovered that the Broadcom FullMAC WLAN driver in the Linux
kernel contained a race condition during device removal, leading to a use-
after-free vulnerability. A physically proximate attacker could possibly
use this to cause a denial of service (system crash). (CVE-2023-47233)
It was discovered that the ATA over Ethernet (AoE) driver in the Linux
kernel contained a race condition, leading to a use-after-free
vulnerability. An attacker could use this to
OSV
linux-aws, linux-gcp vulnerabilities
osv·2024-06-07·CVSS 5.5
CVE-2022-38096 [MEDIUM] linux-aws, linux-gcp vulnerabilities
linux-aws, linux-gcp vulnerabilities
Ziming Zhang discovered that the DRM driver for VMware Virtual GPU did not
properly handle certain error conditions, leading to a NULL pointer
dereference. A local attacker could possibly trigger this vulnerability to
cause a denial of service. (CVE-2022-38096)
Zheng Wang discovered that the Broadcom FullMAC WLAN driver in the Linux
kernel contained a race condition during device removal, leading to a use-
after-free vulnerability. A physically proximate attacker could possibly
use this to cause a denial of service (system crash). (CVE-2023-47233)
It was discovered that the ATA over Ethernet (AoE) driver in the Linux
kernel contained a race condition, leading to a use-after-free
vulnerability. An attacker could use this to cause a denial of service o
GHSA
GHSA-3f3w-qrjm-6m77: In the Linux kernel, the following vulnerability has been resolved:
mm: cachestat: fix two shmem bugs
When cachestat on shmem races with swapping an
ghsa_unreviewed·2024-05-17
CVE-2024-35797 [MEDIUM] CWE-787 GHSA-3f3w-qrjm-6m77: In the Linux kernel, the following vulnerability has been resolved:
mm: cachestat: fix two shmem bugs
When cachestat on shmem races with swapping an
In the Linux kernel, the following vulnerability has been resolved:
mm: cachestat: fix two shmem bugs
When cachestat on shmem races with swapping and invalidation, there
are two possible bugs:
1) A swapin error can have resulted in a poisoned swap entry in the
shmem inode's xarray. Calling get_shadow_from_swap_cache() on it
will result in an out-of-bounds access to swapper_spaces[].
Validate the entry with non_swap_entry() before going further.
2) When we find a valid swap entry in the shmem's inode, the shadow
entry in the swapcache might not exist yet: swap IO is still in
progress and we're before __remove_mapping; swapin, invalidation,
or swapoff have removed the shadow from swapcache after we saw the
shmem swap entry.
This will send a NULL to workingset_test_recent(). The latter
OSV
CVE-2024-35797: In the Linux kernel, the following vulnerability has been resolved: mm: cachestat: fix two shmem bugs When cachestat on shmem races with swapping and
osv·2024-05-17·CVSS 5.5
CVE-2024-35797 [MEDIUM] CVE-2024-35797: In the Linux kernel, the following vulnerability has been resolved: mm: cachestat: fix two shmem bugs When cachestat on shmem races with swapping and
In the Linux kernel, the following vulnerability has been resolved: mm: cachestat: fix two shmem bugs When cachestat on shmem races with swapping and invalidation, there are two possible bugs: 1) A swapin error can have resulted in a poisoned swap entry in the shmem inode's xarray. Calling get_shadow_from_swap_cache() on it will result in an out-of-bounds access to swapper_spaces[]. Validate the entry with non_swap_entry() before going further. 2) When we find a valid swap entry in the shmem's inode, the shadow entry in the swapcache might not exist yet: swap IO is still in progress and we're before __remove_mapping; swapin, invalidation, or swapoff have removed the shadow from swapcache after we saw the shmem swap entry. This will send a NULL to workingset_test_recent(). The latter purely
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/24a0e73d544439bb9329fbbafac44299e548a677https://git.kernel.org/stable/c/b79f9e1ff27c994a4c452235ba09e672ec698e23https://git.kernel.org/stable/c/d5d39c707a4cf0bcc84680178677b97aa2cb2627https://git.kernel.org/stable/c/d962f6c583458037dc7e529659b2b02b9dd3d94bhttps://git.kernel.org/stable/c/24a0e73d544439bb9329fbbafac44299e548a677https://git.kernel.org/stable/c/b79f9e1ff27c994a4c452235ba09e672ec698e23https://git.kernel.org/stable/c/d5d39c707a4cf0bcc84680178677b97aa2cb2627https://git.kernel.org/stable/c/d962f6c583458037dc7e529659b2b02b9dd3d94b
2024-05-17
Published