In the Linux kernel, the following vulnerability has been resolved:
mm/slub: add missing TID updates on slab deactivation
The fastpath in slaballocnode() assumes that c->slab is stable as long as the TID stays the same. However, two places in _slaballoc() currently don't update the TID when deactivating the CPU slab.
If multiple operations race the right way, this could lead to an object
getting lost; or, in an even more unlikely situation, it could even lead to
an object being freed onto the wrong slab's freelist, messing up the
inuse counter and eventually causing a page to be freed to the page
allocator while it still contains slab objects.
(I haven't actually tested these cases though, this is just based on looking at the code. Writing testcases for this stuff seems like it'd be a pain...)
The race leading to state inconsistency is (all operations on the same CPU and kmem_cache):
slab == c->slab (true)c->freelist is NULL)c->slab = NULLFrom there, the object on c->freelist will get lost if task B is allowed to continue from here: It will proceed to the retryloadslab label, set c->slab, then jump to load_freelist, which clobbers c->freelist.
But if we instead continue as follows, we get worse corruption:
At this point, the inuse count of slab-1 is 1 lower than it should be. This means that if we free all allocated objects in slab-1 except for one, SLUB will think that slab-1 is completely unused, and may free its page, leading to use-after-free.
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e7e3e90d671078455a3a08189f89d85b3da2de9e",
"target": {
"function": "___slab_alloc",
"file": "mm/slub.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-49700-139bcffd",
"digest": {
"length": 1620.0,
"function_hash": "105069892452050388053074970319772374479"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e2b2f0e2e34d71ae6c2a1114fd3c525930e84bc7",
"target": {
"function": "deactivate_slab",
"file": "mm/slub.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-49700-17bc55ec",
"digest": {
"length": 2105.0,
"function_hash": "198807045846531031014138733260278693959"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e7e3e90d671078455a3a08189f89d85b3da2de9e",
"target": {
"file": "mm/slub.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-49700-19c0f0f7",
"digest": {
"threshold": 0.9,
"line_hashes": [
"40147995757969018907260173510112362156",
"164985540673631977357762055708209769595",
"230873671306792419080977549432761860278",
"195101541097081870358695796604134405201",
"250339480263985758670124874371425733248",
"332162620870701129781257272974909188075",
"99663995409527347471845018296939098226",
"24995538239635222763876982052368521986",
"301893294442246839119074046206098401189",
"186586871957341391818562450209282715265",
"250019047539882222006473082908409187578",
"139719664182289237938188484157541668355"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e2b2f0e2e34d71ae6c2a1114fd3c525930e84bc7",
"target": {
"function": "___slab_alloc",
"file": "mm/slub.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-49700-1ccaa63d",
"digest": {
"length": 1620.0,
"function_hash": "105069892452050388053074970319772374479"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@eeaa345e128515135ccb864c04482180c08e3259",
"target": {
"file": "mm/slub.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-49700-246629f8",
"digest": {
"threshold": 0.9,
"line_hashes": [
"55768429331329545390310239106981303919",
"155973361966303774333597059244284379271",
"162691841390943720082114154501420667356",
"287595365083714388080340380081861115934",
"208588648838062109002860995587869948313",
"231649796662562231778232543340034953540",
"42654384429249983658841075485649535333",
"279025291215393746793553916746469086838"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0515cc9b6b24877f59b222ade704bfaa42caa2a6",
"target": {
"function": "___slab_alloc",
"file": "mm/slub.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-49700-2edb59e1",
"digest": {
"length": 3221.0,
"function_hash": "139047500129606864457731649670528936914"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d6a597450e686d4c6388bd3cdcb17224b4dae7f0",
"target": {
"file": "mm/slub.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-49700-2f275200",
"digest": {
"threshold": 0.9,
"line_hashes": [
"40147995757969018907260173510112362156",
"164985540673631977357762055708209769595",
"230873671306792419080977549432761860278",
"195101541097081870358695796604134405201",
"250339480263985758670124874371425733248",
"332162620870701129781257272974909188075",
"99663995409527347471845018296939098226",
"24995538239635222763876982052368521986",
"301893294442246839119074046206098401189",
"186586871957341391818562450209282715265",
"250019047539882222006473082908409187578",
"139719664182289237938188484157541668355"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6c32496964da0dc230cea763a0e934b2e02dabd5",
"target": {
"function": "deactivate_slab",
"file": "mm/slub.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-49700-365173e3",
"digest": {
"length": 2204.0,
"function_hash": "238035710577846967376332797272894676965"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d6a597450e686d4c6388bd3cdcb17224b4dae7f0",
"target": {
"function": "flush_slab",
"file": "mm/slub.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-49700-3771d3bf",
"digest": {
"length": 211.0,
"function_hash": "167733319880909405774381273145192993770"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@197e257da473c725dfe47759c3ee02f2398d8ea5",
"target": {
"function": "___slab_alloc",
"file": "mm/slub.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-49700-40412cc4",
"digest": {
"length": 3221.0,
"function_hash": "183826250432902699148027095861524355636"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d6a597450e686d4c6388bd3cdcb17224b4dae7f0",
"target": {
"function": "deactivate_slab",
"file": "mm/slub.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-49700-4a569546",
"digest": {
"length": 2105.0,
"function_hash": "198807045846531031014138733260278693959"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6c32496964da0dc230cea763a0e934b2e02dabd5",
"target": {
"function": "flush_slab",
"file": "mm/slub.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-49700-51e95455",
"digest": {
"length": 211.0,
"function_hash": "167733319880909405774381273145192993770"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@308c6d0e1f200fd26c71270c6e6bfcf0fc6ff082",
"target": {
"function": "___slab_alloc",
"file": "mm/slub.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-49700-6f055999",
"digest": {
"length": 1752.0,
"function_hash": "269823638377900948829995003452608240340"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6c32496964da0dc230cea763a0e934b2e02dabd5",
"target": {
"file": "mm/slub.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-49700-78212eec",
"digest": {
"threshold": 0.9,
"line_hashes": [
"40147995757969018907260173510112362156",
"164985540673631977357762055708209769595",
"230873671306792419080977549432761860278",
"195101541097081870358695796604134405201",
"250339480263985758670124874371425733248",
"332162620870701129781257272974909188075",
"99663995409527347471845018296939098226",
"24995538239635222763876982052368521986",
"301893294442246839119074046206098401189",
"186586871957341391818562450209282715265",
"250019047539882222006473082908409187578",
"139719664182289237938188484157541668355"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@eeaa345e128515135ccb864c04482180c08e3259",
"target": {
"function": "___slab_alloc",
"file": "mm/slub.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-49700-81cedb09",
"digest": {
"length": 3209.0,
"function_hash": "87574819803440855272538000657279939650"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6c32496964da0dc230cea763a0e934b2e02dabd5",
"target": {
"function": "___slab_alloc",
"file": "mm/slub.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-49700-8ad7ddca",
"digest": {
"length": 1658.0,
"function_hash": "244334869661463524876145467602248214075"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e2b2f0e2e34d71ae6c2a1114fd3c525930e84bc7",
"target": {
"function": "flush_slab",
"file": "mm/slub.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-49700-8b4c251f",
"digest": {
"length": 211.0,
"function_hash": "167733319880909405774381273145192993770"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0515cc9b6b24877f59b222ade704bfaa42caa2a6",
"target": {
"file": "mm/slub.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-49700-8c33ab86",
"digest": {
"threshold": 0.9,
"line_hashes": [
"301893294442246839119074046206098401189",
"7225491137326846074037047488772910898",
"27268481291560667265095925736461409038",
"310098679726064903706737474191949940214",
"83808393440056878563937957358827152770",
"159861786318197165844029250699719509281",
"95007791048898542642986686166743978694",
"214279786189504479716480942798449033729"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@197e257da473c725dfe47759c3ee02f2398d8ea5",
"target": {
"file": "mm/slub.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-49700-946653f4",
"digest": {
"threshold": 0.9,
"line_hashes": [
"55768429331329545390310239106981303919",
"155973361966303774333597059244284379271",
"162691841390943720082114154501420667356",
"287595365083714388080340380081861115934",
"208588648838062109002860995587869948313",
"231649796662562231778232543340034953540",
"42654384429249983658841075485649535333",
"279025291215393746793553916746469086838"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e2b2f0e2e34d71ae6c2a1114fd3c525930e84bc7",
"target": {
"file": "mm/slub.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-49700-ac0541ad",
"digest": {
"threshold": 0.9,
"line_hashes": [
"40147995757969018907260173510112362156",
"164985540673631977357762055708209769595",
"230873671306792419080977549432761860278",
"195101541097081870358695796604134405201",
"250339480263985758670124874371425733248",
"332162620870701129781257272974909188075",
"99663995409527347471845018296939098226",
"24995538239635222763876982052368521986",
"301893294442246839119074046206098401189",
"186586871957341391818562450209282715265",
"250019047539882222006473082908409187578",
"139719664182289237938188484157541668355"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d6a597450e686d4c6388bd3cdcb17224b4dae7f0",
"target": {
"function": "___slab_alloc",
"file": "mm/slub.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-49700-b61821b1",
"digest": {
"length": 1620.0,
"function_hash": "105069892452050388053074970319772374479"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@308c6d0e1f200fd26c71270c6e6bfcf0fc6ff082",
"target": {
"file": "mm/slub.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-49700-c4664018",
"digest": {
"threshold": 0.9,
"line_hashes": [
"47295590079436007138583795362239608057",
"26650738910397095182264822485685271560",
"325415380771464387316552511832172514036",
"318100368190481237463170992477330936853",
"53677195624123001515753963142223903252",
"26650738910397095182264822485685271560",
"325415380771464387316552511832172514036",
"308393225268619430901082892945259521122",
"301893294442246839119074046206098401189",
"186586871957341391818562450209282715265",
"250019047539882222006473082908409187578",
"139719664182289237938188484157541668355",
"129148424930287968491996278728438571723",
"139965315876387491956516913111046215903",
"75823661311162779061934178420436271358",
"145089692317841320137315765597393685141",
"49732208803703949686402614818582272224",
"73649176641476418903341066093273265317",
"269385059687728719841462249894026117784",
"242848538900561626700297441147236323186"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e7e3e90d671078455a3a08189f89d85b3da2de9e",
"target": {
"function": "deactivate_slab",
"file": "mm/slub.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-49700-e4dc62a8",
"digest": {
"length": 2152.0,
"function_hash": "98078646641841612847495014285985059690"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e7e3e90d671078455a3a08189f89d85b3da2de9e",
"target": {
"function": "flush_slab",
"file": "mm/slub.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-49700-ef639453",
"digest": {
"length": 211.0,
"function_hash": "167733319880909405774381273145192993770"
},
"signature_type": "Function"
}
]