CVE-2024-53113

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

mm: fix NULL pointer dereference in alloc_pages_bulk_noprof

We triggered a NULL pointer dereference for ac.preferred_zoneref->zone in

alloc_pages_bulk_noprof() when the task is migrated between cpusets.

When cpuset is enabled, in prepare_alloc_pages(), ac->nodemask may be

&current->mems_allowed. when first_zones_zonelist() is called to find

preferred_zoneref, the ac->nodemask may be modified concurrently if the

task is migrated between different cpusets. Assuming we have 2 NUMA Node,

when traversing Node1 in ac->zonelist, the nodemask is 2, and when

traversing Node2 in ac->zonelist, the nodemask is 1. As a result, the

ac->preferred_zoneref points to NULL zone.

In alloc_pages_bulk_noprof(), for_each_zone_zonelist_nodemask() finds a

allowable zone and calls zonelist_node_idx(ac.preferred_zoneref), leading

to NULL pointer dereference.

__alloc_pages_noprof() fixes this issue by checking NULL pointer in commit

ea574

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References