CVE-2024-35846

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

mm: zswap: fix shrinker NULL crash with cgroup_disable=memory

Christian reports a NULL deref in zswap that he bisected down to the zswap

shrinker. The issue also cropped up in the bug trackers of libguestfs [1]

and the Red Hat bugzilla [2].

The problem is that when memcg is disabled with the boot time flag, the

zswap shrinker might get called with sc->memcg == NULL. This is okay in

many places, like the lruvec operations. But it crashes in

memcg_page_state() - which is only used due to the non-node accounting of

cgroup's the zswap memory to begin with.

Nhat spotted that the memcg can be NULL in the memcg-disabled case, and I

was then able to reproduce the crash locally as well.

[1] https://github.com/libguestfs/libguestfs/issues/139

[2] https://bugzilla.redhat.com/show_bug.cgi?id=2275252

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References