CVE-2024-36892 mm/slub: avoid zeroing outside-object freepointer for single free

2024-05-3015:28:58

Linux

github.com

linux kernel

vulnerability

resolved

single object

bulk object

freeing

slab

hook

debug

hardened

freepointer

corruption

kernel build

reproducing

dmesg

log

6.8 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

9.0%

JSON

In the Linux kernel, the following vulnerability has been resolved:

mm/slub: avoid zeroing outside-object freepointer for single free

Commit 284f17ac13fe (“mm/slub: handle bulk and single object freeing
separately”) splits single and bulk object freeing in two functions
slab_free() and slab_free_bulk() which leads slab_free() to call
slab_free_hook() directly instead of slab_free_freelist_hook().

If init_on_free is set, slab_free_hook() zeroes the object.
Afterward, if slub_debug=F and CONFIG_SLAB_FREELIST_HARDENED are
set, the do_slab_free() slowpath executes freelist consistency
checks and try to decode a zeroed freepointer which leads to a
“Freepointer corrupt” detection in check_object().

During bulk free, slab_free_freelist_hook() isn’t affected as it always
sets it objects freepointer using set_freepointer() to maintain its
reconstructed freelist after init_on_free.

For single free, object’s freepointer thus needs to be avoided when
stored outside the object if init_on_free is set. The freepointer left
as is, check_object() may later detect an invalid pointer value due to
objects overflow.

To reproduce, set slub_debug=FU init_on_free=1 log_level=7 on the
command line of a kernel build with CONFIG_SLAB_FREELIST_HARDENED=y.

dmesg sample log:
[ 10.708715] =============================================================================
[ 10.710323] BUG kmalloc-rnd-05-32 (Tainted: G B T ): Freepointer corrupt
[ 10.712695] -----------------------------------------------------------------------------
[ 10.712695]
[ 10.712695] Slab 0xffffd8bdc400d580 objects=32 used=4 fp=0xffff9d9a80356f80 flags=0x200000000000a00(workingset|slab|node=0|zone=2)
[ 10.716698] Object 0xffff9d9a80356600 @offset=1536 fp=0x7ee4f480ce0ecd7c
[ 10.716698]
[ 10.716698] Bytes b4 ffff9d9a803565f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 …
[ 10.720703] Object ffff9d9a80356600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 …
[ 10.720703] Object ffff9d9a80356610: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 …
[ 10.724696] Padding ffff9d9a8035666c: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 …
[ 10.724696] Padding ffff9d9a8035667c: 00 00 00 00 …
[ 10.724696] FIX kmalloc-rnd-05-32: Object at 0xffff9d9a80356600 not freed

CNA Affected

[
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "284f17ac13fe",
        "lessThan": "56900355485f",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "284f17ac13fe",
        "lessThan": "8f828aa48812",
        "versionType": "git"
      }
    ],
    "programFiles": [
      "mm/slub.c"
    ],
    "defaultStatus": "unaffected"
  },
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "6.8"
      },
      {
        "status": "unaffected",
        "version": "0",
        "lessThan": "6.8",
        "versionType": "custom"
      },
      {
        "status": "unaffected",
        "version": "6.8.10",
        "versionType": "custom",
        "lessThanOrEqual": "6.8.*"
      },
      {
        "status": "unaffected",
        "version": "6.9",
        "versionType": "original_commit_for_fix",
        "lessThanOrEqual": "*"
      }
    ],
    "programFiles": [
      "mm/slub.c"
    ],
    "defaultStatus": "affected"
  }
]