Описание
In the Linux kernel, the following vulnerability has been resolved:
mm, slab: clean up slab->obj_exts always
When memory allocation profiling is disabled at runtime or due to an
error, shutdown_mem_profiling() is called: slab->obj_exts which
previously allocated remains.
It won't be cleared by unaccount_slab() because of
mem_alloc_profiling_enabled() not true. It's incorrect, slab->obj_exts
should always be cleaned up in unaccount_slab() to avoid following error:
[...]BUG: Bad page state in process...
..
[...]page dumped because: page still charged to cgroup
[andriy.shevchenko@linux.intel.com: fold need_slab_obj_ext() into its only user]
A flaw was found in the Linux kernel. This vulnerability allows system instability and a denial of service (DoS) via improper cleanup of slab object extensions when memory allocation profiling is disabled.
Отчет
A flaw was found in the Linux kernel's slab allocator. When memory allocation profiling is disabled at runtime or due to an error, shutdown_mem_profiling() is called, but previously allocated slab object extension buffers (slab->obj_exts) are not released, because unaccount_slab() only performs that cleanup while mem_alloc_profiling_enabled() is true. Pages can consequently remain charged to a memory cgroup after being freed, which triggers a kernel BUG report (Bad page state; page still charged to cgroup) and leads to system instability and a local denial of service. Triggering this condition requires local access with privileges on a system where memory allocation profiling has been enabled and subsequently disabled. Red Hat rates this flaw as Moderate impact, lower than the Important severity implied by the upstream NVD and CVE.org CVSS scores of 7.8, because the flaw requires local access and this uncommon configuration, and primarily affects availability. Red Hat Enterprise Linux 6, 7, 8, and 9 and Red Hat In-Vehicle OS 1 are not affected because the vulnerable code is not present in those kernels. Red Hat Enterprise Linux 10 is affected, and a fix is being pursued through delegated handling for the rhel-10.1 stream; the remaining RHEL 10 streams (rhel-10.0.z, rhel-10.1.z, and rhel-10.2) were assessed as not affected because the vulnerable code is not in the execute path.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | kernel | Not affected | ||
| Red Hat Enterprise Linux 6 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 9 | kernel | Not affected | ||
| Red Hat Enterprise Linux 9 | kernel-rt | Not affected |
Показывать по
Дополнительная информация
Статус:
7.1 High
CVSS3
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: mm, slab: clean up slab->obj_exts always When memory allocation profiling is disabled at runtime or due to an error, shutdown_mem_profiling() is called: slab->obj_exts which previously allocated remains. It won't be cleared by unaccount_slab() because of mem_alloc_profiling_enabled() not true. It's incorrect, slab->obj_exts should always be cleaned up in unaccount_slab() to avoid following error: [...]BUG: Bad page state in process... .. [...]page dumped because: page still charged to cgroup [andriy.shevchenko@linux.intel.com: fold need_slab_obj_ext() into its only user]
In the Linux kernel, the following vulnerability has been resolved: mm, slab: clean up slab->obj_exts always When memory allocation profiling is disabled at runtime or due to an error, shutdown_mem_profiling() is called: slab->obj_exts which previously allocated remains. It won't be cleared by unaccount_slab() because of mem_alloc_profiling_enabled() not true. It's incorrect, slab->obj_exts should always be cleaned up in unaccount_slab() to avoid following error: [...]BUG: Bad page state in process... .. [...]page dumped because: page still charged to cgroup [andriy.shevchenko@linux.intel.com: fold need_slab_obj_ext() into its only user]
In the Linux kernel, the following vulnerability has been resolved: m ...
In the Linux kernel, the following vulnerability has been resolved: mm, slab: clean up slab->obj_exts always When memory allocation profiling is disabled at runtime or due to an error, shutdown_mem_profiling() is called: slab->obj_exts which previously allocated remains. It won't be cleared by unaccount_slab() because of mem_alloc_profiling_enabled() not true. It's incorrect, slab->obj_exts should always be cleaned up in unaccount_slab() to avoid following error: [...]BUG: Bad page state in process... .. [...]page dumped because: page still charged to cgroup [andriy.shevchenko@linux.intel.com: fold need_slab_obj_ext() into its only user]
Уязвимость компонента slab ядра операционной системы Linux, позволяющая нарушителю вызвать отказ в обслуживании
7.1 High
CVSS3