mm/page_owner: use memcg_data snapshot to avoid TOCTOU in print_page_owner_memcg()
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 6.6.160, 6.12.114, 7.2.4
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
In the Linux kernel, the following vulnerability has been resolved: mm/page_owner: use memcg_data snapshot to avoid TOCTOU in print_page_owner_memcg() print_page_owner_memcg() reads page->memcg_data via READ_ONCE() at the start to guard against tail pages and NULL data. However, it later re-reads page->memcg_data locklessly in two places: 1: page_memcg_check(page) 2: PageMemcgKmem(page) (via folio_memcg_kmem(), which includes VM_BUG_ON assertions for tail pages and MEMCG_DATA_OBJEXTS) If the page is concurrently freed and reallocated as a THP tail page or slab page between these calls, the VM_BUG_ON assertions can trigger on CONFIG_DEBUG_VM=y builds, crashing the kernel. Fix both TOCTOU issues by using the memcg_data snapshot throughout.
Timeline
- CVE published
- Record last updated
Affected versions
- Linux Linux
From fcf8935832b86d3437f00e732c6d0d4d2819d6a9 · fixed in e7c1923c5f30a6953f0540e3171d882ec17b05d3; From fcf8935832b86d3437f00e732c6d0d4d2819d6a9 · fixed in a4c940ab3f794f221a338c9431ad1ce0d73a2bea; From fcf8935832b86d3437f00e732c6d0d4d2819d6a9 · fixed in 46761406e14381dc35f498c247a87565b87ea2ef; From fcf8935832b86d3437f00e732c6d0d4d2819d6a9 · fixed in 90f095b816e25c6a9e4446d299bac5007fdcb3df
- Linux Linux
5.18
- KernelLinux
From 5.18.0 · fixed in 6.6.160; From 6.7.0 · fixed in 6.12.114; From 6.13.0 · fixed in 7.2.4