CVE-2024-56566

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

mm/slub: Avoid list corruption when removing a slab from the full list

Boot with slub_debug=UFPZ.

If allocated object failed in alloc_consistency_checks, all objects of

the slab will be marked as used, and then the slab will be removed from

the partial list.

When an object belonging to the slab got freed later, the remove_full()

function is called. Because the slab is neither on the partial list nor

on the full list, it eventually lead to a list corruption (actually a

list poison being detected).

So we need to mark and isolate the slab page with metadata corruption,

do not put it back in circulation.

Because the debug caches avoid all the fastpaths, reusing the frozen bit

to mark slab page with metadata corruption seems to be fine.

[ 4277.385669] list_del corruption, ffffea00044b3e50->next is LIST_POISON1 (dead000000000100)

[ 4277.387023] ------------[ cut here ]------------

[ 4277.387880] kernel BUG at lib/list

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References