CVE-2024-50270: mm/damon/core: avoid overflow in damon_feed_loop_next_input()
In the Linux kernel, the following vulnerability has been resolved:
mm/damon/core: avoid overflow in damonfeedloopnextinput()
damonfeedloopnextinput() is inefficient and fragile to overflows. Specifically, 'scoregoaldiffbp' calculation can overflow when 'score' is high. The calculation is actually unnecessary at all because 'goal' is a constant of value 10,000. Calculation of 'compensation' is again fragile to overflow. Final calculation of return value for under-achiving case is again fragile to overflow when the current score is under-achieving the target.
Add two corner cases handling at the beginning of the function to make the body easier to read, and rewrite the body of the function to avoid overflows and the unnecessary bp value calcuation.
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-50270?
CVE-2024-50270 is considered a medium severity vulnerability due to the potential for overflow in memory management functions.
How do I fix CVE-2024-50270?
To fix CVE-2024-50270, update the Linux kernel to version 6.12-rc7 or later as it contains the necessary patches.
What versions of the Linux kernel are affected by CVE-2024-50270?
CVE-2024-50270 affects Linux kernel versions 6.8 through 6.11.8 and 6.12-rc1 to 6.12-rc6.
Is CVE-2024-50270 exploitable in production systems?
Yes, CVE-2024-50270 could potentially be exploited in production systems if they are running affected versions.
What components of the Linux kernel are impacted by CVE-2024-50270?
CVE-2024-50270 impacts the memory management component in Linux, specifically the damon subsystem.