Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2024-49885— mm, slub: avoid zeroing kmalloc redzone

Quick assessment

Affected

Linux Linux

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于在kmalloc红区处理中错误地将整个对象视为红区，可能导致红区覆盖错误。

AI Predicted 5.3 Difficulty: Theoretical EPSS 0.24% · P14 Updated Oct 21, 2026

Possible ATT&CK Techniques 2 AI

T1499 · Endpoint Denial of Service T1562.001

Affected Version Matrix 8

Vendor	Product	Version Range	Status
Linux	Linux	`946fa0dbf2d8923a587f7348adf16563d59f1b3d< 7a2e823a19746d54052c625faecf0d2d6c52ee0a`	affected
		`946fa0dbf2d8923a587f7348adf16563d59f1b3d< 83f0440b2f92227fcce9898118ca7fe7e0d64b1f`	affected
		`946fa0dbf2d8923a587f7348adf16563d59f1b3d< 59090e479ac78ae18facd4c58eb332562a23020e`	affected
		`6.2`	affected
		`< 6.2`	unaffected
		`6.10.14≤ 6.10.*`	unaffected
		`6.11.3≤ 6.11.*`	unaffected
		`6.12≤ *`	unaffected

Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2024-49885

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

mm, slub: avoid zeroing kmalloc redzone

Source: CVE Program / CVE List V5

Vulnerability Description

In the Linux kernel, the following vulnerability has been resolved: mm, slub: avoid zeroing kmalloc redzone Since commit 946fa0dbf2d8 ("mm/slub: extend redzone check to extra allocated kmalloc space than requested"), setting orig_size treats the wasted space (object_size - orig_size) as a redzone. However with init_on_free=1 we clear the full object->size, including the redzone. Additionally we clear the object metadata, including the stored orig_size, making it zero, which makes check_object() treat the whole object as a redzone. These issues lead to the following BUG report with "slub_debug=FUZ init_on_free=1": [ 0.000000] ============================================================================= [ 0.000000] BUG kmalloc-8 (Not tainted): kmalloc Redzone overwritten [ 0.000000] ----------------------------------------------------------------------------- [ 0.000000] [ 0.000000] 0xffff000010032858-0xffff00001003285f @offset=2136. First byte 0x0 instead of 0xcc [ 0.000000] FIX kmalloc-8: Restoring kmalloc Redzone 0xffff000010032858-0xffff00001003285f=0xcc [ 0.000000] Slab 0xfffffdffc0400c80 objects=36 used=23 fp=0xffff000010032a18 flags=0x3fffe0000000200(workingset|node=0|zone=0|lastcpupid=0x1ffff) [ 0.000000] Object 0xffff000010032858 @offset=2136 fp=0xffff0000100328c8 [ 0.000000] [ 0.000000] Redzone ffff000010032850: cc cc cc cc cc cc cc cc ........ [ 0.000000] Object ffff000010032858: cc cc cc cc cc cc cc cc ........ [ 0.000000] Redzone ffff000010032860: cc cc cc cc cc cc cc cc ........ [ 0.000000] Padding ffff0000100328b4: 00 00 00 00 00 00 00 00 00 00 00 00 ............ [ 0.000000] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.11.0-rc3-next-20240814-00004-g61844c55c3f4 #144 [ 0.000000] Hardware name: NXP i.MX95 19X19 board (DT) [ 0.000000] Call trace: [ 0.000000] dump_backtrace+0x90/0xe8 [ 0.000000] show_stack+0x18/0x24 [ 0.000000] dump_stack_lvl+0x74/0x8c [ 0.000000] dump_stack+0x18/0x24 [ 0.000000] print_trailer+0x150/0x218 [ 0.000000] check_object+0xe4/0x454 [ 0.000000] free_to_partial_list+0x2f8/0x5ec To address the issue, use orig_size to clear the used area. And restore the value of orig_size after clear the remaining area. When CONFIG_SLUB_DEBUG not defined, (get_orig_size()' directly returns s->object_size. So when using memset to init the area, the size can simply be orig_size, as orig_size returns object_size when CONFIG_SLUB_DEBUG not enabled. And orig_size can never be bigger than object_size.

Source: CVE Program / CVE List V5

CVSS Information

N/A

Source: CVE Program / CVE List V5

Vulnerability Type

N/A

Source: CVE Program / CVE List V5

Vulnerability Title

Linux kernel 安全漏洞

Source: CNNVD (China National Vulnerability Database)

Vulnerability Description

Source: CNNVD (China National Vulnerability Database)

CVSS Information

N/A

Source: CNNVD (China National Vulnerability Database)

Vulnerability Type

N/A

Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Linux	Linux	946fa0dbf2d8923a587f7348adf16563d59f1b3d ~ 7299868253c0e8ba9bf31f6e5198e8eafa1e700b	-
Linux	Linux	6.2	-

II. Public POCs for CVE-2024-49885

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2024-49885

请登录查看更多情报信息。

Patches & Fixes for CVE-2024-49885 (3)

Other References for CVE-2024-49885 (1)

https://git.kernel.org/stable/c/7299868253c0e8ba9bf31f6e5198e8eafa1e700b

https://www.cve.org/CVERecord?id=CVE-2024-49885

Same Patch Batch · Linux · 2024-10-21 · 372 CVEs total

CVE-2024-47695	9.8 CRITICAL	RDMA/rtrs-clt: Reset cid to con_num - 1 to stay in bounds
CVE-2022-48985	9.8 CRITICAL	net: mana: Fix race on per-CQ variable napi work_done
CVE-2024-50033	9.8 CRITICAL	slip: make slhc_remember() more robust against malicious packets
CVE-2024-50043	9.8 CRITICAL	nfsd: fix possible badness in FREE_STATEID
CVE-2024-49855	9.8 CRITICAL	nbd: fix race between timeout and normal completion
CVE-2024-50047	9.8 CRITICAL	smb: client: fix UAF in async decryption
CVE-2024-50046	9.8 CRITICAL	NFSv4: Prevent NULL-pointer dereference in nfs42_complete_copies()
CVE-2022-49003	9.8 CRITICAL	nvme: fix SRCU protection of nvme_ns_head list
CVE-2024-49996	9.4 CRITICAL	cifs: Fix buffer overflow when parsing NFS reparse points
CVE-2024-47678	9.4 CRITICAL	icmp: change the order of rate limits
CVE-2024-49950	8.8 HIGH	Bluetooth: L2CAP: Fix uaf in l2cap_connect
CVE-2024-50041	8.8 HIGH	i40e: Fix macvlan leak by synchronizing access to mac_filter_hash
CVE-2024-50029	8.8 HIGH	Bluetooth: hci_conn: Fix UAF in hci_enhanced_setup_sync
CVE-2022-49017	8.8 HIGH	tipc: re-fetch skb cb after tipc_msg_validate
CVE-2022-48962	8.8 HIGH	net: hisilicon: Fix potential use-after-free in hisi_femac_rx()
CVE-2022-49015	8.8 HIGH	net: hsr: Fix potential use-after-free
CVE-2022-48964	8.8 HIGH	ravb: Fix potential use-after-free in ravb_rx_gbeth()
CVE-2024-49939	8.8 HIGH	wifi: rtw89: avoid to add interface to list twice when SER
CVE-2022-48960	8.8 HIGH	net: hisilicon: Fix potential use-after-free in hix5hd2_rx()
CVE-2022-48967	8.8 HIGH	NFC: nci: Bounds check struct nfc_target arrays

Showing top 20 of 372 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: Linux

Same vendor: Linux

V. Comments for CVE-2024-49885

No comments yet

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2024-49885— mm, slub: avoid zeroing kmalloc redzone

Quick assessment

Possible ATT&CK Techniques 2 AI

Affected Version Matrix 8

I. Basic Information for CVE-2024-49885

Vulnerability Information

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Affected Products

II. Public POCs for CVE-2024-49885

III. Intelligence Information for CVE-2024-49885

Patches & Fixes for CVE-2024-49885 (3)

Other References for CVE-2024-49885 (1)

Same Patch Batch · Linux · 2024-10-21 · 372 CVEs total

IV. Related Vulnerabilities

V. Comments for CVE-2024-49885

Leave a comment