CVE-2023-53621

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

memcontrol: ensure memcg acquired by id is properly set up

In the eviction recency check, we attempt to retrieve the memcg to which

the folio belonged when it was evicted, by the memcg id stored in the

shadow entry. However, there is a chance that the retrieved memcg is not

the original memcg that has been killed, but a new one which happens to

have the same id.

This is a somewhat unfortunate, but acceptable and rare inaccuracy in the

heuristics. However, if we retrieve this new memcg between its allocation

and when it is properly attached to the memcg hierarchy, we could run into

the following NULL pointer exception during the memcg hierarchy traversal

done in mem_cgroup_get_nr_swap_pages():

[ 155757.793456] BUG: kernel NULL pointer dereference, address: 00000000000000c0

[ 155757.807568] #PF: supervisor read access in kernel mode

[ 155757.818024] #PF: error_code(0x0000) - not-present page

[ 155757.828482] PGD 40

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References