CVE-2024-35797

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-35797", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-05-17T12:19:12.340Z", "datePublished": "2024-05-17T13:23:08.204Z", "dateUpdated": "2026-08-05T11:30:00.460Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:30:00.460Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm: cachestat: fix two shmem bugs\n\nWhen cachestat on shmem races with swapping and invalidation, there\nare two possible bugs:\n\n1) A swapin error can have resulted in a poisoned swap entry in the\n shmem inode's xarray. Calling get_shadow_from_swap_cache() on it\n will result in an out-of-bounds access to swapper_spaces[].\n\n Validate the entry with non_swap_entry() before going further.\n\n2) When we find a valid swap entry in the shmem's inode, the shadow\n entry in the swapcache might not exist yet: swap IO is still in\n progress and we're before __remove_mapping; swapin, invalidation,\n or swapoff have removed the shadow from swapcache after we saw the\n shmem swap entry.\n\n This will send a NULL to workingset_test_recent(). The latter\n purely operates on pointer bits, so it won't crash - node 0, memcg\n ID 0, eviction timestamp 0, etc. are all valid inputs - but it's a\n bogus test. In theory that could result in a false \"recently\n evicted\" count.\n\n Such a false positive wouldn't be the end of the world. But for\n code clarity and (future) robustness, be explicit about this case.\n\n Bail on get_shadow_from_swap_cache() returning NULL."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "baseScore": 7.1, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerability is reached only through the `cachestat(2)` syscall on a local file descriptor for a shmem/tmpfs mapping (memfd, /dev/shm, or any readable tmpfs file). There is no network or remote-peer path into `filemap_cachestat()`.\nAC:L - Once a poisoned swap entry exists in a shmem inode it persists until truncate, and every `cachestat()` call covering that index deterministically and repeatably performs the out-of-bounds `swapper_spaces[]` access; the attacker additionally controls both sides of the cachestat-vs-swapping/invalidation race and can drive unbounded shmem swap I/O (large tmpfs files plus memory pressure) to provoke the swapin error, which is routine on flash-backed embedded/IoT swap and network-backed swap in diskless/cloud deployments.\nPR:L - `cachestat(2)` performs only `fdget()` with no capability or permission check whatsoever in the affected versions, and any unprivileged user can create a shmem mapping via `memfd_create()` or `/dev/shm`. No elevated privileges or namespace tricks are needed.\nUI:N - The attacker triggers the flaw entirely from their own process with a single syscall on a file descriptor they already hold. No action by any other user or victim process is required.\nS:U - The out-of-bounds access, wild dereference and resulting oops are all confined to the kernel's own security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - The read past the end of `swapper_spaces[]` yields an unvalidated non-pointer value that is dereferenced as a `struct address_space` and walked as an xarray, so the kernel reads memory at an address it never bounds-checked; the value derived from that walk feeds `workingset_test_recent()` whose outcome is reflected in the `nr_recently_evicted` field copied back to userspace, forming a kernel-memory disclosure oracle. This is an unbounded out-of-bounds read, not a read strictly limited to a few bytes.\nI:N - The faulty path only performs reads (`xa_load`), and the memcg reference taken in `workingset_test_recent()` is released on all paths, so no kernel memory is written or corrupted and no write or control-flow-hijack primitive is produced. The only integrity effect is an inaccurate statistics counter returned to the caller.\nA:H - The out-of-bounds `swapper_spaces[31]` value is almost always zero (or unmapped garbage), producing a NULL/wild pointer dereference and kernel oops inside an `rcu_read_lock()` critical section; the leaked RCU nesting on task death can escalate to RCU stalls and a system-wide hang, and `panic_on_oops` systems panic outright."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["mm/filemap.c"], "versions": [{"version": "cf264e1329fb0307e044f7675849f9f38b44c11a", "lessThan": "b79f9e1ff27c994a4c452235ba09e672ec698e23", "status": "affected", "versionType": "git"}, {"version": "cf264e1329fb0307e044f7675849f9f38b44c11a", "lessThan": "d962f6c583458037dc7e529659b2b02b9dd3d94b", "status": "affected", "versionType": "git"}, {"version": "cf264e1329fb0307e044f7675849f9f38b44c11a", "lessThan": "24a0e73d544439bb9329fbbafac44299e548a677", "status": "affected", "versionType": "git"}, {"version": "cf264e1329fb0307e044f7675849f9f38b44c11a", "lessThan": "d5d39c707a4cf0bcc84680178677b97aa2cb2627", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["mm/filemap.c"], "versions": [{"version": "6.5", "status": "affected"}, {"version": "0", "lessThan": "6.5", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.24", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.7.12", "lessThanOrEqual": "6.7.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.8.3", "lessThanOrEqual": "6.8.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.9", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.5", "versionEndExcluding": "6.6.24"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.5", "versionEndExcluding": "6.7.12"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.5", "versionEndExcluding": "6.8.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.5", "versionEndExcluding": "6.9"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/b79f9e1ff27c994a4c452235ba09e672ec698e23"}, {"url": "https://git.kernel.org/stable/c/d962f6c583458037dc7e529659b2b02b9dd3d94b"}, {"url": "https://git.kernel.org/stable/c/24a0e73d544439bb9329fbbafac44299e548a677"}, {"url": "https://git.kernel.org/stable/c/d5d39c707a4cf0bcc84680178677b97aa2cb2627"}], "title": "mm: cachestat: fix two shmem bugs", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-787", "lang": "en", "description": "CWE-787 Out-of-bounds Write"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-05-17T17:19:03.392959Z", "id": "CVE-2024-35797", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-12T16:52:46.185Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T03:21:47.505Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/b79f9e1ff27c994a4c452235ba09e672ec698e23", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/d962f6c583458037dc7e529659b2b02b9dd3d94b", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/24a0e73d544439bb9329fbbafac44299e548a677", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/d5d39c707a4cf0bcc84680178677b97aa2cb2627", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/b79f9e1ff27c994a4c452235ba09e672ec698e23", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/d962f6c583458037dc7e529659b2b02b9dd3d94b", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/24a0e73d544439bb9329fbbafac44299e548a677", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/d5d39c707a4cf0bcc84680178677b97aa2cb2627", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T03:21:47.505Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-35797", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-05-17T17:19:03.392959Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-787", "description": "CWE-787 Out-of-bounds Write"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-23T19:01:24.714Z"}}], "cna": {"title": "mm: cachestat: fix two shmem bugs", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.1, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerability is reached only through the `cachestat(2)` syscall on a local file descriptor for a shmem/tmpfs mapping (memfd, /dev/shm, or any readable tmpfs file). There is no network or remote-peer path into `filemap_cachestat()`.\nAC:L - Once a poisoned swap entry exists in a shmem inode it persists until truncate, and every `cachestat()` call covering that index deterministically and repeatably performs the out-of-bounds `swapper_spaces[]` access; the attacker additionally controls both sides of the cachestat-vs-swapping/invalidation race and can drive unbounded shmem swap I/O (large tmpfs files plus memory pressure) to provoke the swapin error, which is routine on flash-backed embedded/IoT swap and network-backed swap in diskless/cloud deployments.\nPR:L - `cachestat(2)` performs only `fdget()` with no capability or permission check whatsoever in the affected versions, and any unprivileged user can create a shmem mapping via `memfd_create()` or `/dev/shm`. No elevated privileges or namespace tricks are needed.\nUI:N - The attacker triggers the flaw entirely from their own process with a single syscall on a file descriptor they already hold. No action by any other user or victim process is required.\nS:U - The out-of-bounds access, wild dereference and resulting oops are all confined to the kernel's own security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - The read past the end of `swapper_spaces[]` yields an unvalidated non-pointer value that is dereferenced as a `struct address_space` and walked as an xarray, so the kernel reads memory at an address it never bounds-checked; the value derived from that walk feeds `workingset_test_recent()` whose outcome is reflected in the `nr_recently_evicted` field copied back to userspace, forming a kernel-memory disclosure oracle. This is an unbounded out-of-bounds read, not a read strictly limited to a few bytes.\nI:N - The faulty path only performs reads (`xa_load`), and the memcg reference taken in `workingset_test_recent()` is released on all paths, so no kernel memory is written or corrupted and no write or control-flow-hijack primitive is produced. The only integrity effect is an inaccurate statistics counter returned to the caller.\nA:H - The out-of-bounds `swapper_spaces[31]` value is almost always zero (or unmapped garbage), producing a NULL/wild pointer dereference and kernel oops inside an `rcu_read_lock()` critical section; the leaked RCU nesting on task death can escalate to RCU stalls and a system-wide hang, and `panic_on_oops` systems panic outright."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "cf264e1329fb0307e044f7675849f9f38b44c11a", "lessThan": "b79f9e1ff27c994a4c452235ba09e672ec698e23", "versionType": "git"}, {"status": "affected", "version": "cf264e1329fb0307e044f7675849f9f38b44c11a", "lessThan": "d962f6c583458037dc7e529659b2b02b9dd3d94b", "versionType": "git"}, {"status": "affected", "version": "cf264e1329fb0307e044f7675849f9f38b44c11a", "lessThan": "24a0e73d544439bb9329fbbafac44299e548a677", "versionType": "git"}, {"status": "affected", "version": "cf264e1329fb0307e044f7675849f9f38b44c11a", "lessThan": "d5d39c707a4cf0bcc84680178677b97aa2cb2627", "versionType": "git"}], "programFiles": ["mm/filemap.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.5"}, {"status": "unaffected", "version": "0", "lessThan": "6.5", "versionType": "semver"}, {"status": "unaffected", "version": "6.6.24", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.7.12", "versionType": "semver", "lessThanOrEqual": "6.7.*"}, {"status": "unaffected", "version": "6.8.3", "versionType": "semver", "lessThanOrEqual": "6.8.*"}, {"status": "unaffected", "version": "6.9", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["mm/filemap.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/b79f9e1ff27c994a4c452235ba09e672ec698e23"}, {"url": "https://git.kernel.org/stable/c/d962f6c583458037dc7e529659b2b02b9dd3d94b"}, {"url": "https://git.kernel.org/stable/c/24a0e73d544439bb9329fbbafac44299e548a677"}, {"url": "https://git.kernel.org/stable/c/d5d39c707a4cf0bcc84680178677b97aa2cb2627"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm: cachestat: fix two shmem bugs\n\nWhen cachestat on shmem races with swapping and invalidation, there\nare two possible bugs:\n\n1) A swapin error can have resulted in a poisoned swap entry in the\n shmem inode's xarray. Calling get_shadow_from_swap_cache() on it\n will result in an out-of-bounds access to swapper_spaces[].\n\n Validate the entry with non_swap_entry() before going further.\n\n2) When we find a valid swap entry in the shmem's inode, the shadow\n entry in the swapcache might not exist yet: swap IO is still in\n progress and we're before __remove_mapping; swapin, invalidation,\n or swapoff have removed the shadow from swapcache after we saw the\n shmem swap entry.\n\n This will send a NULL to workingset_test_recent(). The latter\n purely operates on pointer bits, so it won't crash - node 0, memcg\n ID 0, eviction timestamp 0, etc. are all valid inputs - but it's a\n bogus test. In theory that could result in a false \"recently\n evicted\" count.\n\n Such a false positive wouldn't be the end of the world. But for\n code clarity and (future) robustness, be explicit about this case.\n\n Bail on get_shadow_from_swap_cache() returning NULL."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.24", "versionStartIncluding": "6.5"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.7.12", "versionStartIncluding": "6.5"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.8.3", "versionStartIncluding": "6.5"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.9", "versionStartIncluding": "6.5"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:30:00.460Z"}}}, "cveMetadata": {"cveId": "CVE-2024-35797", "state": "PUBLISHED", "dateUpdated": "2026-08-05T11:30:00.460Z", "dateReserved": "2024-05-17T12:19:12.340Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-05-17T13:23:08.204Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["mm/filemap.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "b79f9e1ff27c994a4c452235ba09e672ec698e23", "status": "affected", "version": "cf264e1329fb0307e044f7675849f9f38b44c11a", "versionType": "git"}, {"lessThan": "d962f6c583458037dc7e529659b2b02b9dd3d94b", "status": "affected", "version": "cf264e1329fb0307e044f7675849f9f38b44c11a", "versionType": "git"}, {"lessThan": "24a0e73d544439bb9329fbbafac44299e548a677", "status": "affected", "version": "cf264e1329fb0307e044f7675849f9f38b44c11a", "versionType": "git"}, {"lessThan": "d5d39c707a4cf0bcc84680178677b97aa2cb2627", "status": "affected", "version": "cf264e1329fb0307e044f7675849f9f38b44c11a", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["mm/filemap.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.5"}, {"lessThan": "6.5", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.24", "versionType": "semver"}, {"lessThanOrEqual": "6.7.*", "status": "unaffected", "version": "6.7.12", "versionType": "semver"}, {"lessThanOrEqual": "6.8.*", "status": "unaffected", "version": "6.8.3", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.9", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "A2469D58-C2A6-4C9E-9A71-83830808C4FD", "versionEndExcluding": "6.6.24", "versionStartIncluding": "6.5", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "6BE9771A-BAFD-4624-95F9-58D536540C53", "versionEndExcluding": "6.7.12", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "4C59BBC3-6495-4A77-9C82-55EC7CDF5E02", "versionEndExcluding": "6.8.3", "versionStartIncluding": "6.8", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*", "matchCriteriaId": "22BEDD49-2C6D-402D-9DBF-6646F6ECD10B", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm: cachestat: fix two shmem bugs\n\nWhen cachestat on shmem races with swapping and invalidation, there\nare two possible bugs:\n\n1) A swapin error can have resulted in a poisoned swap entry in the\n shmem inode's xarray. Calling get_shadow_from_swap_cache() on it\n will result in an out-of-bounds access to swapper_spaces[].\n\n Validate the entry with non_swap_entry() before going further.\n\n2) When we find a valid swap entry in the shmem's inode, the shadow\n entry in the swapcache might not exist yet: swap IO is still in\n progress and we're before __remove_mapping; swapin, invalidation,\n or swapoff have removed the shadow from swapcache after we saw the\n shmem swap entry.\n\n This will send a NULL to workingset_test_recent(). The latter\n purely operates on pointer bits, so it won't crash - node 0, memcg\n ID 0, eviction timestamp 0, etc. are all valid inputs - but it's a\n bogus test. In theory that could result in a false \"recently\n evicted\" count.\n\n Such a false positive wouldn't be the end of the world. But for\n code clarity and (future) robustness, be explicit about this case.\n\n Bail on get_shadow_from_swap_cache() returning NULL."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: mm: cachestat: corrige dos errores de shmem Cuando cachestat en shmem se ejecuta con intercambio e invalidaci\u00f3n, hay dos errores posibles: 1) Un error de intercambio puede haber resultado en una entrada de intercambio envenenada en la matriz x del inodo shmem. Llamar a get_shadow_from_swap_cache() dar\u00e1 como resultado un acceso fuera de los l\u00edmites a swapper_spaces[]. Valide la entrada con non_swap_entry() antes de continuar. 2) Cuando encontramos una entrada de intercambio v\u00e1lida en el inodo de shmem, es posible que la entrada oculta en el cach\u00e9 de intercambio a\u00fan no exista: el intercambio de E/S a\u00fan est\u00e1 en progreso y estamos antes de __remove_mapping; swapin, invalidaci\u00f3n o swapoff han eliminado la sombra de swapcache despu\u00e9s de que vimos la entrada de intercambio shmem. Esto enviar\u00e1 un NULL aworkingset_test_recent(). Este \u00faltimo opera exclusivamente con bits de puntero, por lo que no fallar\u00e1 (el nodo 0, el ID de memcg 0, la marca de tiempo de desalojo 0, etc. son todas entradas v\u00e1lidas), pero es una prueba falsa. En teor\u00eda, eso podr\u00eda resultar en un recuento falso de \"desalojados recientemente\". Un falso positivo as\u00ed no ser\u00eda el fin del mundo. Pero para mayor claridad del c\u00f3digo y solidez (futura), sea expl\u00edcito sobre este caso. Libere get_shadow_from_swap_cache() y devuelva NULL."}], "id": "CVE-2024-35797", "lastModified": "2026-08-04T11:17:53.760", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.2, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-35797", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-05-17T17:19:03.392959Z", "version": "2.0.3"}}]}, "published": "2024-05-17T14:15:11.937", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/24a0e73d544439bb9329fbbafac44299e548a677"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/b79f9e1ff27c994a4c452235ba09e672ec698e23"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/d5d39c707a4cf0bcc84680178677b97aa2cb2627"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/d962f6c583458037dc7e529659b2b02b9dd3d94b"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/24a0e73d544439bb9329fbbafac44299e548a677"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/b79f9e1ff27c994a4c452235ba09e672ec698e23"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/d5d39c707a4cf0bcc84680178677b97aa2cb2627"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/d962f6c583458037dc7e529659b2b02b9dd3d94b"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-787"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"affected_release": [{"advisory": "RHSA-2024:6567", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "kernel-0:5.14.0-427.35.1.el9_4", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2024-09-11T00:00:00Z"}, {"advisory": "RHSA-2024:6567", "cpe": "cpe:/o:redhat:enterprise_linux:9", "package": "kernel-0:5.14.0-427.35.1.el9_4", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2024-09-11T00:00:00Z"}], "bugzilla": {"description": "kernel: mm: cachestat: fix two shmem bugs", "id": "2281151", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2281151"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "verified"}, "details": ["In the Linux kernel, the following vulnerability has been resolved:\nmm: cachestat: fix two shmem bugs\nWhen cachestat on shmem races with swapping and invalidation, there\nare two possible bugs:\n1) A swapin error can have resulted in a poisoned swap entry in the\nshmem inode's xarray. Calling get_shadow_from_swap_cache() on it\nwill result in an out-of-bounds access to swapper_spaces[].\nValidate the entry with non_swap_entry() before going further.\n2) When we find a valid swap entry in the shmem's inode, the shadow\nentry in the swapcache might not exist yet: swap IO is still in\nprogress and we're before __remove_mapping; swapin, invalidation,\nor swapoff have removed the shadow from swapcache after we saw the\nshmem swap entry.\nThis will send a NULL to workingset_test_recent(). The latter\npurely operates on pointer bits, so it won't crash - node 0, memcg\nID 0, eviction timestamp 0, etc. are all valid inputs - but it's a\nbogus test. In theory that could result in a false \"recently\nevicted\" count.\nSuch a false positive wouldn't be the end of the world. But for\ncode clarity and (future) robustness, be explicit about this case.\nBail on get_shadow_from_swap_cache() returning NULL.", "CVE-2024-35797 is a vulnerability in the Linux kernel\u2019s memory management, specifically affecting the cachestat feature when handling shared memory. The flaw stems from race conditions during operations like swapping or invalidation, which can lead to out-of-bounds memory access or invalid pointer dereferencing. These issues can result in crashes or system instability. The kernel has been patched to improve checks and handling of swap entries to ensure stable and safe operation."], "name": "CVE-2024-35797", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-05-17T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-35797\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-35797\nhttps://lore.kernel.org/linux-cve-announce/2024051737-CVE-2024-35797-06f6@gregkh/T"], "threat_severity": "Moderate"}

{}