CVE-2024-43892

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

memcg: protect concurrent access to mem_cgroup_idr

Commit 73f576c04b94 ("mm: memcontrol: fix cgroup creation failure after

many small jobs") decoupled the memcg IDs from the CSS ID space to fix the

cgroup creation failures. It introduced IDR to maintain the memcg ID

space. The IDR depends on external synchronization mechanisms for

modifications. For the mem_cgroup_idr, the idr_alloc() and idr_replace()

happen within css callback and thus are protected through cgroup_mutex

from concurrent modifications. However idr_remove() for mem_cgroup_idr

was not protected against concurrency and can be run concurrently for

different memcgs when they hit their refcnt to zero. Fix that.

We have been seeing list_lru based kernel crashes at a low frequency in

our fleet for a long time. These crashes were in different part of

list_lru code including list_lru_add(), list_lru_del() and reparenting

code. Upon further inspection,

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References