CVE-2024-46789

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

mm/slub: add check for s->flags in the alloc_tagging_slab_free_hook

When enable CONFIG_MEMCG & CONFIG_KFENCE & CONFIG_KMEMLEAK, the following

warning always occurs,This is because the following call stack occurred:

mem_pool_alloc

kmem_cache_alloc_noprof

slab_alloc_node

kfence_alloc

Once the kfence allocation is successful,slab->obj_exts will not be empty,

because it has already been assigned a value in kfence_init_pool.

Since in the prepare_slab_obj_exts_hook function,we perform a check for

s->flags & (SLAB_NO_OBJ_EXT | SLAB_NOLEAKTRACE),the alloc_tag_add function

will not be called as a result.Therefore,ref->ct remains NULL.

However,when we call mem_pool_free,since obj_ext is not empty, it

eventually leads to the alloc_tag_sub scenario being invoked. This is

where the warning occurs.

So we should add corresponding checks in the alloc_tagging_slab_free_hook.

For __GFP_NO_OBJ_EXT case,I di

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References