CVE-2024-36892

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

mm/slub: avoid zeroing outside-object freepointer for single free

Commit 284f17ac13fe ("mm/slub: handle bulk and single object freeing

separately") splits single and bulk object freeing in two functions

slab_free() and slab_free_bulk() which leads slab_free() to call

slab_free_hook() directly instead of slab_free_freelist_hook().

If `init_on_free` is set, slab_free_hook() zeroes the object.

Afterward, if `slub_debug=F` and `CONFIG_SLAB_FREELIST_HARDENED` are

set, the do_slab_free() slowpath executes freelist consistency

checks and try to decode a zeroed freepointer which leads to a

"Freepointer corrupt" detection in check_object().

During bulk free, slab_free_freelist_hook() isn't affected as it always

sets it objects freepointer using set_freepointer() to maintain its

reconstructed freelist after `init_on_free`.

For single free, object's freepointer thus needs to be avoided when

stored outside the object if `init

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References