CVE-2024-42131
Severity CVSS v4.0:
Pending analysis
Type:
CWE-190
Integer Overflow or Wraparound
Publication date:
30/07/2024
Last modified:
03/11/2025
Description
In the Linux kernel, the following vulnerability has been resolved:<br />
<br />
mm: avoid overflows in dirty throttling logic<br />
<br />
The dirty throttling logic is interspersed with assumptions that dirty<br />
limits in PAGE_SIZE units fit into 32-bit (so that various multiplications<br />
fit into 64-bits). If limits end up being larger, we will hit overflows,<br />
possible divisions by 0 etc. Fix these problems by never allowing so<br />
large dirty limits as they have dubious practical value anyway. For<br />
dirty_bytes / dirty_background_bytes interfaces we can just refuse to set<br />
so large limits. For dirty_ratio / dirty_background_ratio it isn&#39;t so<br />
simple as the dirty limit is computed from the amount of available memory<br />
which can change due to memory hotplug etc. So when converting dirty<br />
limits from ratios to numbers of pages, we just don&#39;t allow the result to<br />
exceed UINT_MAX.<br />
<br />
This is root-only triggerable problem which occurs when the operator<br />
sets dirty limits to >16 TB.
Impact
Base Score 3.x
4.40
Severity 3.x
MEDIUM
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 4.19.320 (excluding) | |
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 4.20 (including) | 5.4.282 (excluding) |
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 5.5 (including) | 5.10.222 (excluding) |
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 5.11 (including) | 5.15.163 (excluding) |
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 5.16 (including) | 6.1.98 (excluding) |
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 6.2 (including) | 6.6.39 (excluding) |
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 6.7 (including) | 6.9.9 (excluding) |
| cpe:2.3:o:linux:linux_kernel:6.10:rc1:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:6.10:rc2:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:6.10:rc3:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:6.10:rc4:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:6.10:rc5:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:6.10:rc6:*:*:*:*:*:* |
To consult the complete list of CPE names with products and versions, see this page
References to Advisories, Solutions, and Tools
- https://git.kernel.org/stable/c/2b2d2b8766db028bd827af34075f221ae9e9efff
- https://git.kernel.org/stable/c/385d838df280eba6c8680f9777bfa0d0bfe7e8b2
- https://git.kernel.org/stable/c/4d3817b64eda07491bdd86a234629fe0764fb42a
- https://git.kernel.org/stable/c/7a49389771ae7666f4dc3426e2a4594bf23ae290
- https://git.kernel.org/stable/c/8e0b5e7f2895eccef5c2a0018b589266f90c4805
- https://git.kernel.org/stable/c/a25e8536184516b55ef89ab91dd2eea429de28d2
- https://git.kernel.org/stable/c/bd16a7ee339aef3ee4c90cb23902afb6af379ea0
- https://git.kernel.org/stable/c/c83ed422c24f0d4b264f89291d4fabe285f80dbc
- https://git.kernel.org/stable/c/385d838df280eba6c8680f9777bfa0d0bfe7e8b2
- https://git.kernel.org/stable/c/7a49389771ae7666f4dc3426e2a4594bf23ae290
- https://git.kernel.org/stable/c/8e0b5e7f2895eccef5c2a0018b589266f90c4805
- https://git.kernel.org/stable/c/a25e8536184516b55ef89ab91dd2eea429de28d2
- https://git.kernel.org/stable/c/bd16a7ee339aef3ee4c90cb23902afb6af379ea0
- https://git.kernel.org/stable/c/c83ed422c24f0d4b264f89291d4fabe285f80dbc
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html



