CVE-2024-53105
Vulnerability from cvelistv5
Published
2024-12-02 13:44
Modified
2024-12-02 13:44
Severity ?
EPSS score ?
Summary
mm: page_alloc: move mlocked flag clearance into free_pages_prepare()
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"mm/page_alloc.c",
"mm/swap.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7873d11911cd",
"status": "affected",
"version": "b109b87050df",
"versionType": "git"
},
{
"lessThan": "66edc3a5894c",
"status": "affected",
"version": "b109b87050df",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"mm/page_alloc.c",
"mm/swap.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.18"
},
{
"lessThan": "5.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.11.*",
"status": "unaffected",
"version": "6.11.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.12",
"versionType": "original_commit_for_fix"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm: page_alloc: move mlocked flag clearance into free_pages_prepare()\n\nSyzbot reported a bad page state problem caused by a page being freed\nusing free_page() still having a mlocked flag at free_pages_prepare()\nstage:\n\n BUG: Bad page state in process syz.5.504 pfn:61f45\n page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x61f45\n flags: 0xfff00000080204(referenced|workingset|mlocked|node=0|zone=1|lastcpupid=0x7ff)\n raw: 00fff00000080204 0000000000000000 dead000000000122 0000000000000000\n raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000\n page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set\n page_owner tracks the page as allocated\n page last allocated via order 0, migratetype Unmovable, gfp_mask 0x400dc0(GFP_KERNEL_ACCOUNT|__GFP_ZERO), pid 8443, tgid 8442 (syz.5.504), ts 201884660643, free_ts 201499827394\n set_page_owner include/linux/page_owner.h:32 [inline]\n post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1537\n prep_new_page mm/page_alloc.c:1545 [inline]\n get_page_from_freelist+0x303f/0x3190 mm/page_alloc.c:3457\n __alloc_pages_noprof+0x292/0x710 mm/page_alloc.c:4733\n alloc_pages_mpol_noprof+0x3e8/0x680 mm/mempolicy.c:2265\n kvm_coalesced_mmio_init+0x1f/0xf0 virt/kvm/coalesced_mmio.c:99\n kvm_create_vm virt/kvm/kvm_main.c:1235 [inline]\n kvm_dev_ioctl_create_vm virt/kvm/kvm_main.c:5488 [inline]\n kvm_dev_ioctl+0x12dc/0x2240 virt/kvm/kvm_main.c:5530\n __do_compat_sys_ioctl fs/ioctl.c:1007 [inline]\n __se_compat_sys_ioctl+0x510/0xc90 fs/ioctl.c:950\n do_syscall_32_irqs_on arch/x86/entry/common.c:165 [inline]\n __do_fast_syscall_32+0xb4/0x110 arch/x86/entry/common.c:386\n do_fast_syscall_32+0x34/0x80 arch/x86/entry/common.c:411\n entry_SYSENTER_compat_after_hwframe+0x84/0x8e\n page last free pid 8399 tgid 8399 stack trace:\n reset_page_owner include/linux/page_owner.h:25 [inline]\n free_pages_prepare mm/page_alloc.c:1108 [inline]\n free_unref_folios+0xf12/0x18d0 mm/page_alloc.c:2686\n folios_put_refs+0x76c/0x860 mm/swap.c:1007\n free_pages_and_swap_cache+0x5c8/0x690 mm/swap_state.c:335\n __tlb_batch_free_encoded_pages mm/mmu_gather.c:136 [inline]\n tlb_batch_pages_flush mm/mmu_gather.c:149 [inline]\n tlb_flush_mmu_free mm/mmu_gather.c:366 [inline]\n tlb_flush_mmu+0x3a3/0x680 mm/mmu_gather.c:373\n tlb_finish_mmu+0xd4/0x200 mm/mmu_gather.c:465\n exit_mmap+0x496/0xc40 mm/mmap.c:1926\n __mmput+0x115/0x390 kernel/fork.c:1348\n exit_mm+0x220/0x310 kernel/exit.c:571\n do_exit+0x9b2/0x28e0 kernel/exit.c:926\n do_group_exit+0x207/0x2c0 kernel/exit.c:1088\n __do_sys_exit_group kernel/exit.c:1099 [inline]\n __se_sys_exit_group kernel/exit.c:1097 [inline]\n __x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1097\n x64_sys_call+0x2634/0x2640 arch/x86/include/generated/asm/syscalls_64.h:232\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n Modules linked in:\n CPU: 0 UID: 0 PID: 8442 Comm: syz.5.504 Not tainted 6.12.0-rc6-syzkaller #0\n Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024\n Call Trace:\n \u003cTASK\u003e\n __dump_stack lib/dump_stack.c:94 [inline]\n dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120\n bad_page+0x176/0x1d0 mm/page_alloc.c:501\n free_page_is_bad mm/page_alloc.c:918 [inline]\n free_pages_prepare mm/page_alloc.c:1100 [inline]\n free_unref_page+0xed0/0xf20 mm/page_alloc.c:2638\n kvm_destroy_vm virt/kvm/kvm_main.c:1327 [inline]\n kvm_put_kvm+0xc75/0x1350 virt/kvm/kvm_main.c:1386\n kvm_vcpu_release+0x54/0x60 virt/kvm/kvm_main.c:4143\n __fput+0x23f/0x880 fs/file_table.c:431\n task_work_run+0x24f/0x310 kernel/task_work.c:239\n exit_task_work include/linux/task_work.h:43 [inline]\n do_exit+0xa2f/0x28e0 kernel/exit.c:939\n do_group_exit+0x207/0x2c0 kernel/exit.c:1088\n __do_sys_exit_group kernel/exit.c:1099 [in\n---truncated---"
}
],
"providerMetadata": {
"dateUpdated": "2024-12-02T13:44:38.257Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7873d11911cd1d21e25c354eb130d8c3b5cb3ca5"
},
{
"url": "https://git.kernel.org/stable/c/66edc3a5894c74f8887c8af23b97593a0dd0df4d"
}
],
"title": "mm: page_alloc: move mlocked flag clearance into free_pages_prepare()",
"x_generator": {
"engine": "bippy-8e903de6a542"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2024-53105",
"datePublished": "2024-12-02T13:44:38.257Z",
"dateReserved": "2024-11-19T17:17:24.992Z",
"dateUpdated": "2024-12-02T13:44:38.257Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2024-53105\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-12-02T14:15:11.313\",\"lastModified\":\"2024-12-02T14:15:11.313\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmm: page_alloc: move mlocked flag clearance into free_pages_prepare()\\n\\nSyzbot reported a bad page state problem caused by a page being freed\\nusing free_page() still having a mlocked flag at free_pages_prepare()\\nstage:\\n\\n BUG: Bad page state in process syz.5.504 pfn:61f45\\n page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x61f45\\n flags: 0xfff00000080204(referenced|workingset|mlocked|node=0|zone=1|lastcpupid=0x7ff)\\n raw: 00fff00000080204 0000000000000000 dead000000000122 0000000000000000\\n raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000\\n page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set\\n page_owner tracks the page as allocated\\n page last allocated via order 0, migratetype Unmovable, gfp_mask 0x400dc0(GFP_KERNEL_ACCOUNT|__GFP_ZERO), pid 8443, tgid 8442 (syz.5.504), ts 201884660643, free_ts 201499827394\\n set_page_owner include/linux/page_owner.h:32 [inline]\\n post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1537\\n prep_new_page mm/page_alloc.c:1545 [inline]\\n get_page_from_freelist+0x303f/0x3190 mm/page_alloc.c:3457\\n __alloc_pages_noprof+0x292/0x710 mm/page_alloc.c:4733\\n alloc_pages_mpol_noprof+0x3e8/0x680 mm/mempolicy.c:2265\\n kvm_coalesced_mmio_init+0x1f/0xf0 virt/kvm/coalesced_mmio.c:99\\n kvm_create_vm virt/kvm/kvm_main.c:1235 [inline]\\n kvm_dev_ioctl_create_vm virt/kvm/kvm_main.c:5488 [inline]\\n kvm_dev_ioctl+0x12dc/0x2240 virt/kvm/kvm_main.c:5530\\n __do_compat_sys_ioctl fs/ioctl.c:1007 [inline]\\n __se_compat_sys_ioctl+0x510/0xc90 fs/ioctl.c:950\\n do_syscall_32_irqs_on arch/x86/entry/common.c:165 [inline]\\n __do_fast_syscall_32+0xb4/0x110 arch/x86/entry/common.c:386\\n do_fast_syscall_32+0x34/0x80 arch/x86/entry/common.c:411\\n entry_SYSENTER_compat_after_hwframe+0x84/0x8e\\n page last free pid 8399 tgid 8399 stack trace:\\n reset_page_owner include/linux/page_owner.h:25 [inline]\\n free_pages_prepare mm/page_alloc.c:1108 [inline]\\n free_unref_folios+0xf12/0x18d0 mm/page_alloc.c:2686\\n folios_put_refs+0x76c/0x860 mm/swap.c:1007\\n free_pages_and_swap_cache+0x5c8/0x690 mm/swap_state.c:335\\n __tlb_batch_free_encoded_pages mm/mmu_gather.c:136 [inline]\\n tlb_batch_pages_flush mm/mmu_gather.c:149 [inline]\\n tlb_flush_mmu_free mm/mmu_gather.c:366 [inline]\\n tlb_flush_mmu+0x3a3/0x680 mm/mmu_gather.c:373\\n tlb_finish_mmu+0xd4/0x200 mm/mmu_gather.c:465\\n exit_mmap+0x496/0xc40 mm/mmap.c:1926\\n __mmput+0x115/0x390 kernel/fork.c:1348\\n exit_mm+0x220/0x310 kernel/exit.c:571\\n do_exit+0x9b2/0x28e0 kernel/exit.c:926\\n do_group_exit+0x207/0x2c0 kernel/exit.c:1088\\n __do_sys_exit_group kernel/exit.c:1099 [inline]\\n __se_sys_exit_group kernel/exit.c:1097 [inline]\\n __x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1097\\n x64_sys_call+0x2634/0x2640 arch/x86/include/generated/asm/syscalls_64.h:232\\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\\n do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83\\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\\n Modules linked in:\\n CPU: 0 UID: 0 PID: 8442 Comm: syz.5.504 Not tainted 6.12.0-rc6-syzkaller #0\\n Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024\\n Call Trace:\\n \u003cTASK\u003e\\n __dump_stack lib/dump_stack.c:94 [inline]\\n dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120\\n bad_page+0x176/0x1d0 mm/page_alloc.c:501\\n free_page_is_bad mm/page_alloc.c:918 [inline]\\n free_pages_prepare mm/page_alloc.c:1100 [inline]\\n free_unref_page+0xed0/0xf20 mm/page_alloc.c:2638\\n kvm_destroy_vm virt/kvm/kvm_main.c:1327 [inline]\\n kvm_put_kvm+0xc75/0x1350 virt/kvm/kvm_main.c:1386\\n kvm_vcpu_release+0x54/0x60 virt/kvm/kvm_main.c:4143\\n __fput+0x23f/0x880 fs/file_table.c:431\\n task_work_run+0x24f/0x310 kernel/task_work.c:239\\n exit_task_work include/linux/task_work.h:43 [inline]\\n do_exit+0xa2f/0x28e0 kernel/exit.c:939\\n do_group_exit+0x207/0x2c0 kernel/exit.c:1088\\n __do_sys_exit_group kernel/exit.c:1099 [in\\n---truncated---\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: mm: page_alloc: mover la eliminaci\u00f3n de la bandera mlocked a free_pages_prepare(). Syzbot inform\u00f3 un problema de estado de p\u00e1gina incorrecto causado por una p\u00e1gina que se libera usando free_page() y que a\u00fan tiene una bandera mlocked en la etapa free_pages_prepare(): ERROR: Estado de p\u00e1gina incorrecto en proceso syz.5.504 pfn:61f45 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x61f45 flags: 0xfff00000080204(referenced|workingset|mlocked|node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000080204 000000000000000 dead0000000000122 0000000000000000 sin procesar: 0000000000000000 000000000000000 0000000000000 00000000ffffffff 0000000000000000 p\u00e1gina volcada porque: PAGE_FLAGS_CHECK_AT_FREE bandera(s) establecidas page_owner rastrea la p\u00e1gina como asignada \u00faltima p\u00e1gina asignada mediante orden 0, migrantstype Inamovible, gfp_mask 0x400dc0(GFP_KERNEL_ACCOUNT|__GFP_ZERO), pid 8443, tgid 8442 (syz.5.504), ts 201884660643, free_ts 201499827394 set_page_owner include/linux/page_owner.h:32 [en l\u00ednea] post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [en l\u00ednea] get_page_from_freelist+0x303f/0x3190 mm/page_alloc.c:3457 __alloc_pages_noprof+0x292/0x710 mm/page_alloc.c:4733 alloc_pages_mpol_noprof+0x3e8/0x680 mm/mempolicy.c:2265 kvm_coalesced_mmio_init+0x1f/0xf0 virt/kvm/coalesced_mmio.c:99 kvm_create_vm virt/kvm/kvm_main.c:1235 [en l\u00ednea] kvm_dev_ioctl_create_vm virt/kvm/kvm_main.c:5488 [en l\u00ednea] kvm_dev_ioctl+0x12dc/0x2240 virt/kvm/kvm_main.c:5530 __do_compat_sys_ioctl fs/ioctl.c:1007 [en l\u00ednea] __se_compat_sys_ioctl+0x510/0xc90 fs/ioctl.c:950 do_syscall_32_irqs_on arch/x86/entry/common.c:165 [en l\u00ednea] __do_fast_syscall_32+0xb4/0x110 arch/x86/entry/common.c:386 do_fast_syscall_32+0x34/0x80 arch/x86/entry/common.c:411 entry_SYSENTER_compat_after_hwframe+0x84/0x8e p\u00e1gina \u00faltima libre pid 8399 tgid 8399 seguimiento de pila: reset_page_owner include/linux/page_owner.h:25 [en l\u00ednea] free_pages_prepare mm/page_alloc.c:1108 [en l\u00ednea] free_unref_folios+0xf12/0x18d0 mm/page_alloc.c:2686 folios_put_refs+0x76c/0x860 mm/swap.c:1007 free_pages_and_swap_cache+0x5c8/0x690 mm/swap_state.c:335 __tlb_batch_free_encoded_pages mm/mmu_gather.c:136 [en l\u00ednea] tlb_batch_pages_flush mm/mmu_gather.c:149 [en l\u00ednea] tlb_flush_mmu_free mm/mmu_gather.c:366 [en l\u00ednea] tlb_flush_mmu+0x3a3/0x680 mm/mmu_gather.c:373 tlb_finish_mmu+0xd4/0x200 mm/mmu_gather.c:465 exit_mmap+0x496/0xc40 mm/mmap.c:1926 __mmput+0x115/0x390 kernel/fork.c:1348 exit_mm+0x220/0x310 kernel/exit.c:571 do_exit+0x9b2/0x28e0 kernel/exit.c:926 do_group_exit+0x207/0x2c0 kernel/exit.c:1088 __do_sys_exit_group kernel/exit.c:1099 [en l\u00ednea] __se_sys_exit_group kernel/exit.c:1097 [en l\u00ednea] __x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1097 x64_sys_call+0x2634/0x2640 arch/x86/include/generated/asm/syscalls_64.h:232 do_syscall_x64 arch/x86/entry/common.c:52 [en l\u00ednea] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f M\u00f3dulos vinculados en: CPU: 0 UID: 0 PID: 8442 Comm: syz.5.504 No contaminado 6.12.0-rc6-syzkaller #0 Nombre del hardware: Google Google Compute Engine/Google Compute Engine, BIOS Google 13/09/2024 Seguimiento de llamadas: __dump_stack lib/dump_stack.c:94 [en l\u00ednea] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 bad_page+0x176/0x1d0 mm/page_alloc.c:501 free_page_is_bad mm/page_alloc.c:918 [en l\u00ednea] free_pages_prepare mm/page_alloc.c:1100 [en l\u00ednea] free_unref_page+0xed0/0xf20 mm/page_alloc.c:2638 kvm_destroy_vm virt/kvm/kvm_main.c:1327 [en l\u00ednea] kvm_put_kvm+0xc75/0x1350 virt/kvm/kvm_main.c:1386 kvm_vcpu_release+0x54/0x60 virt/kvm/kvm_main.c:4143 __fput+0x23f/0x880 fs/file_table.c:431 task_work_run+0x24f/0x310 kernel/task_work.c:239 exit_task_work include/linux/task_work.h:43 [en l\u00ednea] do_exit+0xa2f/0x28e0 kernel/exit.c:939 do_group_exit+0x207/0x2c0 kernel/exit.c:1088 __do_sys_exit_group kernel/exit.c:1099 [en ---truncado---\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/66edc3a5894c74f8887c8af23b97593a0dd0df4d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/7873d11911cd1d21e25c354eb130d8c3b5cb3ca5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.