In the Linux kernel, the following vulnerability has been resolved:
Revert "mm/writeback: fix possible divide-by-zero in wbdirtylimits(), again"
Patch series "mm: Avoid possible overflows in dirty throttling".
Dirty throttling logic assumes dirty limits in page units fit into 32-bits. This patch series makes sure this is true (see patch 2/2 for more details).
This patch (of 2):
This reverts commit 9319b647902cbd5cc884ac08a8a6d54ce111fc78.
The commit is broken in several ways. Firstly, the removed (u64) cast from the multiplication will introduce a multiplication overflow on 32-bit archs if wbthresh * bgthresh >= 1<<32 (which is actually common - the default settings with 4GB of RAM will trigger this). Secondly, the div64u64() is unnecessarily expensive on 32-bit archs. We have div64ul() in case we want to be safe & cheap. Thirdly, if dirty thresholds are larger than 1<<32 pages, then dirty balancing is going to blow up in many other spectacular ways anyway so trying to fix one possible overflow is just moot.
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@000099d71648504fb9c7a4616f92c2b70c3e44ec",
"target": {
"file": "mm/page-writeback.c"
},
"id": "CVE-2024-42102-1d734618",
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"line_hashes": [
"141899177697129405176143389160842508880",
"73472667025783967710143586800700946331",
"217843178086309577530426246534381880871",
"323284434618013042429668787529361820978"
],
"threshold": 0.9
},
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@23a28f5f3f6ca1e4184bd0e9631cd0944cf1c807",
"target": {
"function": "wb_dirty_limits",
"file": "mm/page-writeback.c"
},
"id": "CVE-2024-42102-2c61acc5",
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"function_hash": "219080059844858924053441801535366141212",
"length": 523.0
},
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@145faa3d03688cbb7bbaaecbd84c01539852942c",
"target": {
"function": "wb_dirty_limits",
"file": "mm/page-writeback.c"
},
"id": "CVE-2024-42102-307fb557",
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"function_hash": "219080059844858924053441801535366141212",
"length": 523.0
},
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@253f9ea7e8e53a5176bd80ceb174907b10724c1a",
"target": {
"function": "wb_dirty_limits",
"file": "mm/page-writeback.c"
},
"id": "CVE-2024-42102-3561b771",
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"function_hash": "219080059844858924053441801535366141212",
"length": 523.0
},
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2820005edae13b140f2d54267d1bd6bb23915f59",
"target": {
"function": "wb_dirty_limits",
"file": "mm/page-writeback.c"
},
"id": "CVE-2024-42102-3a98d706",
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"function_hash": "219080059844858924053441801535366141212",
"length": 523.0
},
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cbbe17a324437c0ff99881a3ee453da45b228a00",
"target": {
"file": "mm/page-writeback.c"
},
"id": "CVE-2024-42102-431f05c1",
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"line_hashes": [
"141899177697129405176143389160842508880",
"73472667025783967710143586800700946331",
"217843178086309577530426246534381880871",
"323284434618013042429668787529361820978"
],
"threshold": 0.9
},
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f6620df12cb6bdcad671d269debbb23573502f9d",
"target": {
"file": "mm/page-writeback.c"
},
"id": "CVE-2024-42102-4fd9232e",
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"line_hashes": [
"141899177697129405176143389160842508880",
"73472667025783967710143586800700946331",
"217843178086309577530426246534381880871",
"323284434618013042429668787529361820978"
],
"threshold": 0.9
},
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@145faa3d03688cbb7bbaaecbd84c01539852942c",
"target": {
"file": "mm/page-writeback.c"
},
"id": "CVE-2024-42102-732e6d82",
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"line_hashes": [
"141899177697129405176143389160842508880",
"73472667025783967710143586800700946331",
"217843178086309577530426246534381880871",
"323284434618013042429668787529361820978"
],
"threshold": 0.9
},
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cbbe17a324437c0ff99881a3ee453da45b228a00",
"target": {
"function": "wb_dirty_limits",
"file": "mm/page-writeback.c"
},
"id": "CVE-2024-42102-92b678ed",
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"function_hash": "219080059844858924053441801535366141212",
"length": 523.0
},
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f6620df12cb6bdcad671d269debbb23573502f9d",
"target": {
"function": "wb_dirty_limits",
"file": "mm/page-writeback.c"
},
"id": "CVE-2024-42102-9b72d105",
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"function_hash": "219080059844858924053441801535366141212",
"length": 523.0
},
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@30139c702048f1097342a31302cbd3d478f50c63",
"target": {
"file": "mm/page-writeback.c"
},
"id": "CVE-2024-42102-af3d8f1e",
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"line_hashes": [
"122056104241526251229410383619307315321",
"185312701573432724671205086878625958352",
"217843178086309577530426246534381880871",
"323284434618013042429668787529361820978"
],
"threshold": 0.9
},
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@23a28f5f3f6ca1e4184bd0e9631cd0944cf1c807",
"target": {
"file": "mm/page-writeback.c"
},
"id": "CVE-2024-42102-b6f04b89",
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"line_hashes": [
"141899177697129405176143389160842508880",
"73472667025783967710143586800700946331",
"217843178086309577530426246534381880871",
"323284434618013042429668787529361820978"
],
"threshold": 0.9
},
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2820005edae13b140f2d54267d1bd6bb23915f59",
"target": {
"file": "mm/page-writeback.c"
},
"id": "CVE-2024-42102-b8c00ed2",
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"line_hashes": [
"141899177697129405176143389160842508880",
"73472667025783967710143586800700946331",
"217843178086309577530426246534381880871",
"323284434618013042429668787529361820978"
],
"threshold": 0.9
},
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@253f9ea7e8e53a5176bd80ceb174907b10724c1a",
"target": {
"file": "mm/page-writeback.c"
},
"id": "CVE-2024-42102-c17b2e83",
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"line_hashes": [
"141899177697129405176143389160842508880",
"73472667025783967710143586800700946331",
"217843178086309577530426246534381880871",
"323284434618013042429668787529361820978"
],
"threshold": 0.9
},
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@30139c702048f1097342a31302cbd3d478f50c63",
"target": {
"function": "wb_dirty_limits",
"file": "mm/page-writeback.c"
},
"id": "CVE-2024-42102-c3f1f49f",
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"function_hash": "258818938197515659875184560468796820530",
"length": 541.0
},
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@000099d71648504fb9c7a4616f92c2b70c3e44ec",
"target": {
"function": "wb_dirty_limits",
"file": "mm/page-writeback.c"
},
"id": "CVE-2024-42102-fe9bb6d7",
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"function_hash": "219080059844858924053441801535366141212",
"length": 523.0
},
"deprecated": false
}
]