| From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2024-53113: mm: fix NULL pointer dereference in alloc_pages_bulk_noprof |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| mm: fix NULL pointer dereference in alloc_pages_bulk_noprof |
| |
| We triggered a NULL pointer dereference for ac.preferred_zoneref->zone in |
| alloc_pages_bulk_noprof() when the task is migrated between cpusets. |
| |
| When cpuset is enabled, in prepare_alloc_pages(), ac->nodemask may be |
| ¤t->mems_allowed. when first_zones_zonelist() is called to find |
| preferred_zoneref, the ac->nodemask may be modified concurrently if the |
| task is migrated between different cpusets. Assuming we have 2 NUMA Node, |
| when traversing Node1 in ac->zonelist, the nodemask is 2, and when |
| traversing Node2 in ac->zonelist, the nodemask is 1. As a result, the |
| ac->preferred_zoneref points to NULL zone. |
| |
| In alloc_pages_bulk_noprof(), for_each_zone_zonelist_nodemask() finds a |
| allowable zone and calls zonelist_node_idx(ac.preferred_zoneref), leading |
| to NULL pointer dereference. |
| |
| __alloc_pages_noprof() fixes this issue by checking NULL pointer in commit |
| ea57485af8f4 ("mm, page_alloc: fix check for NULL preferred_zone") and |
| commit df76cee6bbeb ("mm, page_alloc: remove redundant checks from alloc |
| fastpath"). |
| |
| To fix it, check NULL pointer for preferred_zoneref->zone. |
| |
| The Linux kernel CVE team has assigned CVE-2024-53113 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Issue introduced in 5.13 with commit 387ba26fb1cb9be9e35dc14a6d97188e916eda05 and fixed in 5.15.174 with commit 903d896448c2e50e8652aaba529a30d4d1eaa0e5 |
| Issue introduced in 5.13 with commit 387ba26fb1cb9be9e35dc14a6d97188e916eda05 and fixed in 6.1.119 with commit 6addb2d9501ec866d7b3a3b4e665307c437e9be2 |
| Issue introduced in 5.13 with commit 387ba26fb1cb9be9e35dc14a6d97188e916eda05 and fixed in 6.6.63 with commit d0f16cec79774c3132df006cf771eddd89d08f58 |
| Issue introduced in 5.13 with commit 387ba26fb1cb9be9e35dc14a6d97188e916eda05 and fixed in 6.11.10 with commit 31502374627ba9ec3e710dbd0bb00457cc6d2c19 |
| Issue introduced in 5.13 with commit 387ba26fb1cb9be9e35dc14a6d97188e916eda05 and fixed in 6.12 with commit 8ce41b0f9d77cca074df25afd39b86e2ee3aa68e |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2024-53113 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| mm/page_alloc.c |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/903d896448c2e50e8652aaba529a30d4d1eaa0e5 |
| https://git.kernel.org/stable/c/6addb2d9501ec866d7b3a3b4e665307c437e9be2 |
| https://git.kernel.org/stable/c/d0f16cec79774c3132df006cf771eddd89d08f58 |
| https://git.kernel.org/stable/c/31502374627ba9ec3e710dbd0bb00457cc6d2c19 |
| https://git.kernel.org/stable/c/8ce41b0f9d77cca074df25afd39b86e2ee3aa68e |
