CVE-2024-35797 (GCVE-0-2024-35797)

Vulnerability from cvelistv5 – Published: 2024-05-17 13:23 – Updated: 2026-05-11 20:11
VLAI
Title
mm: cachestat: fix two shmem bugs
Summary
In the Linux kernel, the following vulnerability has been resolved: mm: cachestat: fix two shmem bugs When cachestat on shmem races with swapping and invalidation, there are two possible bugs: 1) A swapin error can have resulted in a poisoned swap entry in the shmem inode's xarray. Calling get_shadow_from_swap_cache() on it will result in an out-of-bounds access to swapper_spaces[]. Validate the entry with non_swap_entry() before going further. 2) When we find a valid swap entry in the shmem's inode, the shadow entry in the swapcache might not exist yet: swap IO is still in progress and we're before __remove_mapping; swapin, invalidation, or swapoff have removed the shadow from swapcache after we saw the shmem swap entry. This will send a NULL to workingset_test_recent(). The latter purely operates on pointer bits, so it won't crash - node 0, memcg ID 0, eviction timestamp 0, etc. are all valid inputs - but it's a bogus test. In theory that could result in a false "recently evicted" count. Such a false positive wouldn't be the end of the world. But for code clarity and (future) robustness, be explicit about this case. Bail on get_shadow_from_swap_cache() returning NULL.
Severity
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: cf264e1329fb0307e044f7675849f9f38b44c11a , < b79f9e1ff27c994a4c452235ba09e672ec698e23 (git)
Affected: cf264e1329fb0307e044f7675849f9f38b44c11a , < d962f6c583458037dc7e529659b2b02b9dd3d94b (git)
Affected: cf264e1329fb0307e044f7675849f9f38b44c11a , < 24a0e73d544439bb9329fbbafac44299e548a677 (git)
Affected: cf264e1329fb0307e044f7675849f9f38b44c11a , < d5d39c707a4cf0bcc84680178677b97aa2cb2627 (git)
Create a notification for this product.
Linux Linux Affected: 6.5
Unaffected: 0 , < 6.5 (semver)
Unaffected: 6.6.24 , ≤ 6.6.* (semver)
Unaffected: 6.7.12 , ≤ 6.7.* (semver)
Unaffected: 6.8.3 , ≤ 6.8.* (semver)
Unaffected: 6.9 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "LOW",
              "baseScore": 5.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-35797",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-17T17:19:03.392959Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-787",
                "description": "CWE-787 Out-of-bounds Write",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-12T16:52:46.185Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T03:21:47.505Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/b79f9e1ff27c994a4c452235ba09e672ec698e23"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/d962f6c583458037dc7e529659b2b02b9dd3d94b"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/24a0e73d544439bb9329fbbafac44299e548a677"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/d5d39c707a4cf0bcc84680178677b97aa2cb2627"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "mm/filemap.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b79f9e1ff27c994a4c452235ba09e672ec698e23",
              "status": "affected",
              "version": "cf264e1329fb0307e044f7675849f9f38b44c11a",
              "versionType": "git"
            },
            {
              "lessThan": "d962f6c583458037dc7e529659b2b02b9dd3d94b",
              "status": "affected",
              "version": "cf264e1329fb0307e044f7675849f9f38b44c11a",
              "versionType": "git"
            },
            {
              "lessThan": "24a0e73d544439bb9329fbbafac44299e548a677",
              "status": "affected",
              "version": "cf264e1329fb0307e044f7675849f9f38b44c11a",
              "versionType": "git"
            },
            {
              "lessThan": "d5d39c707a4cf0bcc84680178677b97aa2cb2627",
              "status": "affected",
              "version": "cf264e1329fb0307e044f7675849f9f38b44c11a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "mm/filemap.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.5"
            },
            {
              "lessThan": "6.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.24",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.24",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.12",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.3",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm: cachestat: fix two shmem bugs\n\nWhen cachestat on shmem races with swapping and invalidation, there\nare two possible bugs:\n\n1) A swapin error can have resulted in a poisoned swap entry in the\n   shmem inode\u0027s xarray. Calling get_shadow_from_swap_cache() on it\n   will result in an out-of-bounds access to swapper_spaces[].\n\n   Validate the entry with non_swap_entry() before going further.\n\n2) When we find a valid swap entry in the shmem\u0027s inode, the shadow\n   entry in the swapcache might not exist yet: swap IO is still in\n   progress and we\u0027re before __remove_mapping; swapin, invalidation,\n   or swapoff have removed the shadow from swapcache after we saw the\n   shmem swap entry.\n\n   This will send a NULL to workingset_test_recent(). The latter\n   purely operates on pointer bits, so it won\u0027t crash - node 0, memcg\n   ID 0, eviction timestamp 0, etc. are all valid inputs - but it\u0027s a\n   bogus test. In theory that could result in a false \"recently\n   evicted\" count.\n\n   Such a false positive wouldn\u0027t be the end of the world. But for\n   code clarity and (future) robustness, be explicit about this case.\n\n   Bail on get_shadow_from_swap_cache() returning NULL."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T20:11:13.892Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b79f9e1ff27c994a4c452235ba09e672ec698e23"
        },
        {
          "url": "https://git.kernel.org/stable/c/d962f6c583458037dc7e529659b2b02b9dd3d94b"
        },
        {
          "url": "https://git.kernel.org/stable/c/24a0e73d544439bb9329fbbafac44299e548a677"
        },
        {
          "url": "https://git.kernel.org/stable/c/d5d39c707a4cf0bcc84680178677b97aa2cb2627"
        }
      ],
      "title": "mm: cachestat: fix two shmem bugs",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-35797",
    "datePublished": "2024-05-17T13:23:08.204Z",
    "dateReserved": "2024-05-17T12:19:12.340Z",
    "dateUpdated": "2026-05-11T20:11:13.892Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-35797",
      "date": "2026-07-21",
      "epss": "0.00646",
      "percentile": "0.46942"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-35797\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-17T14:15:11.937\",\"lastModified\":\"2026-06-17T07:35:24.097\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmm: cachestat: fix two shmem bugs\\n\\nWhen cachestat on shmem races with swapping and invalidation, there\\nare two possible bugs:\\n\\n1) A swapin error can have resulted in a poisoned swap entry in the\\n   shmem inode\u0027s xarray. Calling get_shadow_from_swap_cache() on it\\n   will result in an out-of-bounds access to swapper_spaces[].\\n\\n   Validate the entry with non_swap_entry() before going further.\\n\\n2) When we find a valid swap entry in the shmem\u0027s inode, the shadow\\n   entry in the swapcache might not exist yet: swap IO is still in\\n   progress and we\u0027re before __remove_mapping; swapin, invalidation,\\n   or swapoff have removed the shadow from swapcache after we saw the\\n   shmem swap entry.\\n\\n   This will send a NULL to workingset_test_recent(). The latter\\n   purely operates on pointer bits, so it won\u0027t crash - node 0, memcg\\n   ID 0, eviction timestamp 0, etc. are all valid inputs - but it\u0027s a\\n   bogus test. In theory that could result in a false \\\"recently\\n   evicted\\\" count.\\n\\n   Such a false positive wouldn\u0027t be the end of the world. But for\\n   code clarity and (future) robustness, be explicit about this case.\\n\\n   Bail on get_shadow_from_swap_cache() returning NULL.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: mm: cachestat: corrige dos errores de shmem Cuando cachestat en shmem se ejecuta con intercambio e invalidaci\u00f3n, hay dos errores posibles: 1) Un error de intercambio puede haber resultado en una entrada de intercambio envenenada en la matriz x del inodo shmem. Llamar a get_shadow_from_swap_cache() dar\u00e1 como resultado un acceso fuera de los l\u00edmites a swapper_spaces[]. Valide la entrada con non_swap_entry() antes de continuar. 2) Cuando encontramos una entrada de intercambio v\u00e1lida en el inodo de shmem, es posible que la entrada oculta en el cach\u00e9 de intercambio a\u00fan no exista: el intercambio de E/S a\u00fan est\u00e1 en progreso y estamos antes de __remove_mapping; swapin, invalidaci\u00f3n o swapoff han eliminado la sombra de swapcache despu\u00e9s de que vimos la entrada de intercambio shmem. Esto enviar\u00e1 un NULL aworkingset_test_recent(). Este \u00faltimo opera exclusivamente con bits de puntero, por lo que no fallar\u00e1 (el nodo 0, el ID de memcg 0, la marca de tiempo de desalojo 0, etc. son todas entradas v\u00e1lidas), pero es una prueba falsa. En teor\u00eda, eso podr\u00eda resultar en un recuento falso de \\\"desalojados recientemente\\\". Un falso positivo as\u00ed no ser\u00eda el fin del mundo. Pero para mayor claridad del c\u00f3digo y solidez (futura), sea expl\u00edcito sobre este caso. Libere get_shadow_from_swap_cache() y devuelva NULL.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"mm/filemap.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"cf264e1329fb0307e044f7675849f9f38b44c11a\",\"lessThan\":\"b79f9e1ff27c994a4c452235ba09e672ec698e23\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"cf264e1329fb0307e044f7675849f9f38b44c11a\",\"lessThan\":\"d962f6c583458037dc7e529659b2b02b9dd3d94b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"cf264e1329fb0307e044f7675849f9f38b44c11a\",\"lessThan\":\"24a0e73d544439bb9329fbbafac44299e548a677\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"cf264e1329fb0307e044f7675849f9f38b44c11a\",\"lessThan\":\"d5d39c707a4cf0bcc84680178677b97aa2cb2627\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"mm/filemap.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.5\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.5\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.24\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.7.12\",\"lessThanOrEqual\":\"6.7.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.8.3\",\"lessThanOrEqual\":\"6.8.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.9\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L\",\"baseScore\":5.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":3.9,\"impactScore\":1.4}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-05-17T17:19:03.392959Z\",\"id\":\"CVE-2024-35797\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-787\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-787\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.5\",\"versionEndExcluding\":\"6.6.24\",\"matchCriteriaId\":\"A2469D58-C2A6-4C9E-9A71-83830808C4FD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.7.12\",\"matchCriteriaId\":\"6BE9771A-BAFD-4624-95F9-58D536540C53\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.8\",\"versionEndExcluding\":\"6.8.3\",\"matchCriteriaId\":\"4C59BBC3-6495-4A77-9C82-55EC7CDF5E02\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"22BEDD49-2C6D-402D-9DBF-6646F6ECD10B\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/24a0e73d544439bb9329fbbafac44299e548a677\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b79f9e1ff27c994a4c452235ba09e672ec698e23\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d5d39c707a4cf0bcc84680178677b97aa2cb2627\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d962f6c583458037dc7e529659b2b02b9dd3d94b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/24a0e73d544439bb9329fbbafac44299e548a677\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b79f9e1ff27c994a4c452235ba09e672ec698e23\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d5d39c707a4cf0bcc84680178677b97aa2cb2627\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d962f6c583458037dc7e529659b2b02b9dd3d94b\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2025-11-21T11:00:28+00:00",
      "cve": "CVE-2024-35797",
      "id": "CVE-2024-35797",
      "initial_release_date": "2024-05-17T00:00:00+00:00",
      "product_status:fixed": "845",
      "product_status:known_affected": "64",
      "product_status:known_not_affected": "88",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: mm: cachestat: fix two shmem bugs",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-35797.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"cna\": {\"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2024-11-05T09:22:32.625Z\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmm: cachestat: fix two shmem bugs\\n\\nWhen cachestat on shmem races with swapping and invalidation, there\\nare two possible bugs:\\n\\n1) A swapin error can have resulted in a poisoned swap entry in the\\n   shmem inode\u0027s xarray. Calling get_shadow_from_swap_cache() on it\\n   will result in an out-of-bounds access to swapper_spaces[].\\n\\n   Validate the entry with non_swap_entry() before going further.\\n\\n2) When we find a valid swap entry in the shmem\u0027s inode, the shadow\\n   entry in the swapcache might not exist yet: swap IO is still in\\n   progress and we\u0027re before __remove_mapping; swapin, invalidation,\\n   or swapoff have removed the shadow from swapcache after we saw the\\n   shmem swap entry.\\n\\n   This will send a NULL to workingset_test_recent(). The latter\\n   purely operates on pointer bits, so it won\u0027t crash - node 0, memcg\\n   ID 0, eviction timestamp 0, etc. are all valid inputs - but it\u0027s a\\n   bogus test. In theory that could result in a false \\\"recently\\n   evicted\\\" count.\\n\\n   Such a false positive wouldn\u0027t be the end of the world. But for\\n   code clarity and (future) robustness, be explicit about this case.\\n\\n   Bail on get_shadow_from_swap_cache() returning NULL.\"}], \"affected\": [{\"product\": \"Linux\", \"vendor\": \"Linux\", \"defaultStatus\": \"unaffected\", \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"programFiles\": [\"mm/filemap.c\"], \"versions\": [{\"version\": \"cf264e1329fb\", \"lessThan\": \"b79f9e1ff27c\", \"status\": \"affected\", \"versionType\": \"git\"}, {\"version\": \"cf264e1329fb\", \"lessThan\": \"d962f6c58345\", \"status\": \"affected\", \"versionType\": \"git\"}, {\"version\": \"cf264e1329fb\", \"lessThan\": \"24a0e73d5444\", \"status\": \"affected\", \"versionType\": \"git\"}, {\"version\": \"cf264e1329fb\", \"lessThan\": \"d5d39c707a4c\", \"status\": \"affected\", \"versionType\": \"git\"}]}, {\"product\": \"Linux\", \"vendor\": \"Linux\", \"defaultStatus\": \"affected\", \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"programFiles\": [\"mm/filemap.c\"], \"versions\": [{\"version\": \"6.5\", \"status\": \"affected\"}, {\"version\": \"0\", \"lessThan\": \"6.5\", \"status\": \"unaffected\", \"versionType\": \"semver\"}, {\"version\": \"6.6.24\", \"lessThanOrEqual\": \"6.6.*\", \"status\": \"unaffected\", \"versionType\": \"semver\"}, {\"version\": \"6.7.12\", \"lessThanOrEqual\": \"6.7.*\", \"status\": \"unaffected\", \"versionType\": \"semver\"}, {\"version\": \"6.8.3\", \"lessThanOrEqual\": \"6.8.*\", \"status\": \"unaffected\", \"versionType\": \"semver\"}, {\"version\": \"6.9\", \"lessThanOrEqual\": \"*\", \"status\": \"unaffected\", \"versionType\": \"original_commit_for_fix\"}]}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/b79f9e1ff27c994a4c452235ba09e672ec698e23\"}, {\"url\": \"https://git.kernel.org/stable/c/d962f6c583458037dc7e529659b2b02b9dd3d94b\"}, {\"url\": \"https://git.kernel.org/stable/c/24a0e73d544439bb9329fbbafac44299e548a677\"}, {\"url\": \"https://git.kernel.org/stable/c/d5d39c707a4cf0bcc84680178677b97aa2cb2627\"}], \"title\": \"mm: cachestat: fix two shmem bugs\", \"x_generator\": {\"engine\": \"bippy-9e1c9544281a\"}}, \"adp\": [{\"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T03:21:47.505Z\"}, \"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/b79f9e1ff27c994a4c452235ba09e672ec698e23\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/d962f6c583458037dc7e529659b2b02b9dd3d94b\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/24a0e73d544439bb9329fbbafac44299e548a677\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/d5d39c707a4cf0bcc84680178677b97aa2cb2627\", \"tags\": [\"x_transferred\"]}]}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.3, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"LOW\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-35797\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-05-17T17:19:03.392959Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-787\", \"description\": \"CWE-787 Out-of-bounds Write\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-05-23T19:01:24.714Z\"}}]}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-35797\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"state\": \"PUBLISHED\", \"assignerShortName\": \"Linux\", \"dateReserved\": \"2024-05-17T12:19:12.340Z\", \"datePublished\": \"2024-05-17T13:23:08.204Z\", \"dateUpdated\": \"2024-11-12T16:52:46.185Z\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.