CVE-2024-35797
📋 TL;DR
A Linux kernel memory management vulnerability in cachestat for shmem (shared memory) allows out-of-bounds memory access or incorrect cache statistics when cachestat operations race with swapping/invalidation. This affects Linux systems using shared memory with swapping enabled. The vulnerability requires local access to trigger.
💻 Affected Systems
- Linux kernel
📦 What is this software?
Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →⚠️ Risk & Real-World Impact
Worst Case
Out-of-bounds memory access could lead to kernel panic (system crash) or potential information disclosure from kernel memory.
Likely Case
System instability or crash when cachestat races with swapping operations on shmem, or incorrect cache statistics reporting.
If Mitigated
Minor performance impact from incorrect cache statistics without system compromise.
🎯 Exploit Status
Exploitation requires race conditions between cachestat operations and swapping/invalidation, making reliable exploitation challenging. Requires local access.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Patches available in stable kernel branches via git commits referenced in CVE
Vendor Advisory: https://git.kernel.org/stable/c/24a0e73d544439bb9329fbbafac44299e548a677
Restart Required: Yes
Instructions:
1. Update Linux kernel to patched version from your distribution vendor. 2. Reboot system to load new kernel. 3. Verify kernel version after reboot.
🔧 Temporary Workarounds
Disable swap on shmem systems
linuxPrevent the race condition by disabling swap, though this may impact system performance
swapoff -a
Edit /etc/fstab to comment out swap lines
Limit shmem usage
linuxReduce shared memory usage to minimize exposure
sysctl -w kernel.shmmax=67108864
sysctl -w kernel.shmall=4194304
🧯 If You Can't Patch
- Monitor system logs for kernel panics or instability related to memory operations
- Implement strict access controls to limit local user privileges on affected systems
🔍 How to Verify
Check if Vulnerable:
Check kernel version and compare with patched versions from your distribution. Vulnerable if using unpatched kernel with shmem and swap enabled.Check Version:
uname -rVerify Fix Applied:
Verify kernel version matches patched version from vendor and system remains stable during cachestat operations on shmem.📡 Detection & Monitoring
Log Indicators:
- Kernel panic logs
- Out of bounds memory access errors in dmesg
- System instability/crash during memory operations
Network Indicators:
- None - local vulnerability only
SIEM Query:
source="kernel" AND ("panic" OR "Oops" OR "BUG") AND ("cachestat" OR "shmem" OR "swap")🔗 References
- https://git.kernel.org/stable/c/24a0e73d544439bb9329fbbafac44299e548a677
- https://git.kernel.org/stable/c/b79f9e1ff27c994a4c452235ba09e672ec698e23
- https://git.kernel.org/stable/c/d5d39c707a4cf0bcc84680178677b97aa2cb2627
- https://git.kernel.org/stable/c/d962f6c583458037dc7e529659b2b02b9dd3d94b
- https://git.kernel.org/stable/c/24a0e73d544439bb9329fbbafac44299e548a677
- https://git.kernel.org/stable/c/b79f9e1ff27c994a4c452235ba09e672ec698e23
- https://git.kernel.org/stable/c/d5d39c707a4cf0bcc84680178677b97aa2cb2627
- https://git.kernel.org/stable/c/d962f6c583458037dc7e529659b2b02b9dd3d94b
