Executive Summary

This vulnerability exists in the Linux kernel's DAMON core component, specifically in the handling of the damos_quota_goal->nid value used for node_memcg_{used,free}_bp. Users can set this nid value arbitrarily without proper validation. Because the DAMON core uses this value in NODE-DATA() without checking if it is valid, it can lead to out of bounds memory access, potentially causing kernel crashes or instability.

The issue can be triggered using the DAMON user-space tool (damo) by setting an invalid node id, which causes the kernel to attempt to access invalid memory addresses.

The fix involves adding validation for the node id. If an invalid node id is provided, the system returns 0% for used memory ratio and 100% for free memory ratio instead of accessing invalid memory.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by causing out of bounds memory access in the Linux kernel, which may lead to kernel crashes or system instability.

If exploited, it could disrupt normal system operations, potentially causing denial of service or unexpected behavior in systems relying on the DAMON core for memory monitoring.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by observing kernel logs for out of bounds memory access errors triggered by the DAMON user-space tool (damo). Specifically, running the damo tool with certain parameters can reproduce the issue.

• Create a cgroup directory: sudo mkdir /sys/fs/cgroup/foo
• Run the damo tool with the vulnerable parameters: sudo ./damo start --damos_action stat --damos_quota_interval 1s --damos_quota_goal node_memcg_used_bp 50% -1 /foo
• Check kernel logs for errors indicating the vulnerability: sudo dmesg

If the vulnerability is present, the kernel log will show messages such as "Unable to handle kernel paging request at virtual address ..." indicating out of bounds memory access.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability is fixed by adding validation of the given node id in the DAMON core. If an invalid node id is given, the system returns safe default values instead of accessing out of bounds memory.

Immediate mitigation steps include updating the Linux kernel to a version that contains this fix.

Until the update is applied, avoid using the DAMON user-space tool (damo) with arbitrary or invalid node id values for the damos_quota_goal parameter to prevent triggering the vulnerability.

Useful 0 Not Useful 0