CVE-2024-49885

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

mm, slub: avoid zeroing kmalloc redzone

Since commit 946fa0dbf2d8 ("mm/slub: extend redzone check to extra

allocated kmalloc space than requested"), setting orig_size treats

the wasted space (object_size - orig_size) as a redzone. However with

init_on_free=1 we clear the full object->size, including the redzone.

Additionally we clear the object metadata, including the stored orig_size,

making it zero, which makes check_object() treat the whole object as a

redzone.

These issues lead to the following BUG report with "slub_debug=FUZ

init_on_free=1":

[ 0.000000] =============================================================================

[ 0.000000] BUG kmalloc-8 (Not tainted): kmalloc Redzone overwritten

[ 0.000000] -----------------------------------------------------------------------------

[ 0.000000]

[ 0.000000] 0xffff000010032858-0xffff00001003285f @offset=2136. First byte 0x0 instead of 0xcc

[

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References