Description (CNA)
In the Linux kernel, the following vulnerability has been resolved: mm/mempolicy: fix mpol_new leak in shared_policy_replace If mpol_new is allocated but not used in restart loop, mpol_new will be freed via mpol_put before returning to the caller. But refcnt is not initialized yet, so mpol_put could not do the right things and might leak the unused mpol_new. This would happen if mempolicy was updated on the shared shmem file while the sp->lock has been dropped during the memory allocation. This issue could be triggered easily with the below code snippet if there are many processes doing the below work at the same time: shmid = shmget((key_t)5566, 1024 * PAGE_SIZE, 0666|IPC_CREAT); shm = shmat(shmid, 0, 0); loop many times { mbind(shm, 1024 * PAGE_SIZE, MPOL_LOCAL, mask, maxnode, 0); mbind(shm + 128 * PAGE_SIZE, 128 * PAGE_SIZE, MPOL_DEFAULT, mask, maxnode, 0); }
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Linux / Linux | affected 42288fe366c4f1ce7522bc9f27d0bc2a81c55264 before 8510c2346d9e47a72b7f018a36ef0c39483e53d6; affected 42288fe366c4f1ce7522bc9f27d0bc2a81c55264 before 5e16dc5378abd749a836daa9ee4ab2c8d2668999; affected 42288fe366c4f1ce7522bc9f27d0bc2a81c55264 before 39a32f3c06f6d68a530bf9612afa19f50f12e93d; affected 42288fe366c4f1ce7522bc9f27d0bc2a81c55264 before 25f506273b6ae806fd46bfcb6fdaa5b9ec81a05b; affected 42288fe366c4f1ce7522bc9f27d0bc2a81c55264 before f7e183b0a7136b6dc9c7b9b2a85a608a8feba894; affected 42288fe366c4f1ce7522bc9f27d0bc2a81c55264 before 198932a14aeb19a15cf19e51e151d023bc4cd648; affected 42288fe366c4f1ce7522bc9f27d0bc2a81c55264 before 6e00309ac716fa8225f0cbde2cd9c24f0e74ee21; affected 42288fe366c4f1ce7522bc9f27d0bc2a81c55264 before fe39ac59dbbf893b73b24e3184161d0bd06d6651; affected 42288fe366c4f1ce7522bc9f27d0bc2a81c55264 before 4ad099559b00ac01c3726e5c95dc3108ef47d03e |
| Linux / Linux | affected 3.8; unaffected 0 before 3.8; unaffected 4.9.311 through 4.9.*; unaffected 4.14.276 through 4.14.*; unaffected 4.19.238 through 4.19.*; unaffected 5.4.189 through 5.4.*; unaffected 5.10.111 through 5.10.*; unaffected 5.15.34 through 5.15.*; unaffected 5.16.20 through 5.16.*; unaffected 5.17.3 through 5.17.*; unaffected 5.18 through * |
CWE
No CWE identifiers supplied.
References
- https://git.kernel.org/stable/c/8510c2346d9e47a72b7f018a36ef0c39483e53d6
- https://git.kernel.org/stable/c/5e16dc5378abd749a836daa9ee4ab2c8d2668999
- https://git.kernel.org/stable/c/39a32f3c06f6d68a530bf9612afa19f50f12e93d
- https://git.kernel.org/stable/c/25f506273b6ae806fd46bfcb6fdaa5b9ec81a05b
- https://git.kernel.org/stable/c/f7e183b0a7136b6dc9c7b9b2a85a608a8feba894
- https://git.kernel.org/stable/c/198932a14aeb19a15cf19e51e151d023bc4cd648
- https://git.kernel.org/stable/c/6e00309ac716fa8225f0cbde2cd9c24f0e74ee21
- https://git.kernel.org/stable/c/fe39ac59dbbf893b73b24e3184161d0bd06d6651
- https://git.kernel.org/stable/c/4ad099559b00ac01c3726e5c95dc3108ef47d03e