CVE-2024-53097

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

mm: krealloc: Fix MTE false alarm in __do_krealloc

This patch addresses an issue introduced by commit 1a83a716ec233 ("mm:

krealloc: consider spare memory for __GFP_ZERO") which causes MTE

(Memory Tagging Extension) to falsely report a slab-out-of-bounds error.

The problem occurs when zeroing out spare memory in __do_krealloc. The

original code only considered software-based KASAN and did not account

for MTE. It does not reset the KASAN tag before calling memset, leading

to a mismatch between the pointer tag and the memory tag, resulting

in a false positive.

Example of the error:

==================================================================

swapper/0: BUG: KASAN: slab-out-of-bounds in __memset+0x84/0x188

swapper/0: Write at addr f4ffff8005f0fdf0 by task swapper/0/1

swapper/0: Pointer tag: [f4], memory tag: [fe]

swapper/0:

swapper/0: CPU: 4 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.12.

swapper/0: Hardware name

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References