In the Linux kernel, the following vulnerability has been resolved:
mm: list_lru: fix UAF for memory cgroup
The mem_cgroup_from_slab_obj() is supposed to be called under rcu lock or
cgroup_mutex or others which could prevent returned memcg from being
freed. Fix it by adding missing rcu read lock.
Found by code inspection.
[songmuchun@bytedance.com: only grab rcu lock when necessary, per Vlastimil]
References
Configurations
Configuration 1 (hide)
|
History
16 Apr 2025, 19:15
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | In the Linux kernel, the following vulnerability has been resolved: mm: list_lru: fix UAF for memory cgroup The mem_cgroup_from_slab_obj() is supposed to be called under rcu lock or cgroup_mutex or others which could prevent returned memcg from being freed. Fix it by adding missing rcu read lock. Found by code inspection. [songmuchun@bytedance.com: only grab rcu lock when necessary, per Vlastimil] |
27 Aug 2024, 14:37
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://git.kernel.org/stable/c/4589f77c18dd98b65f45617b6d1e95313cf6fcab - Patch | |
| References | () https://git.kernel.org/stable/c/5161b48712dcd08ec427c450399d4d1483e21dea - Patch | |
| CWE | CWE-416 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.8 |
| First Time |
Linux
Linux linux Kernel |
|
| CPE | cpe:2.3:o:linux:linux_kernel:6.11:rc2:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.11:rc1:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
26 Aug 2024, 11:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-08-26 11:15
Updated : 2025-04-16 19:15
NVD link : CVE-2024-43888
Mitre link : CVE-2024-43888
JSON object : View
Products Affected
linux
- linux_kernel
CWE
CWE-416
Use After Free