Skip to content
CVE PROGRAM SOURCE RECORD7.8 High

CVE-2024-43888

mm: list_lru: fix UAF for memory cgroup

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: mm: list_lru: fix UAF for memory cgroup The mem_cgroup_from_slab_obj() is supposed to be called under rcu lock or cgroup_mutex or others which could prevent returned memcg from being freed. Fix it by adding missing rcu read lock. Found by code inspection. [songmuchun@bytedance.com: only grab rcu lock when necessary, per Vlastimil]

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 0a97c01cd20bb96359d8c9dedad92a061ed34e0b to < 4589f77c18dd98b65f45617b6d1e95313cf6fcabaffected
  • 0a97c01cd20bb96359d8c9dedad92a061ed34e0b to < 5161b48712dcd08ec427c450399d4d1483e21deaaffected
  • 32d7120a499d475bc03e893c59611116279bcfb8affected
  • 6.6.160 to < 6.7affected

Linux Linux

Default version status: affected

  • 6.8affected
  • 0 to < 6.8unaffected
  • 6.10.5 to ≤ 6.10.*unaffected
  • 6.11 to ≤ *unaffected

References