CVE-2024-57884

一、漏洞信息
 漏洞编号：[CVE-2024-57884](https://nvd.nist.gov/vuln/detail/CVE-2024-57884)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.19,6.4.0,6.6.0
 CVSS V3.0分值：
  BaseScore：5.5 Medium
  Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:mm: vmscan: account for free pages to prevent infinite Loop in throttle_direct_reclaim()The task sometimes continues looping in throttle_direct_reclaim() becauseallow_direct_reclaim(pgdat) keeps returning false.   #0 [ffff80002cb6f8d0] __switch_to at ffff8000080095ac #1 [ffff80002cb6f900] __schedule at ffff800008abbd1c #2 [ffff80002cb6f990] schedule at ffff800008abc50c #3 [ffff80002cb6f9b0] throttle_direct_reclaim at ffff800008273550 #4 [ffff80002cb6fa20] try_to_free_pages at ffff800008277b68 #5 [ffff80002cb6fae0] __alloc_pages_nodemask at ffff8000082c4660 #6 [ffff80002cb6fc50] alloc_pages_vma at ffff8000082e4a98 #7 [ffff80002cb6fca0] do_anonymous_page at ffff80000829f5a8 #8 [ffff80002cb6fce0] __handle_mm_fault at ffff8000082a5974 #9 [ffff80002cb6fd90] handle_mm_fault at ffff8000082a5bd4At this point, the pgdat contains the following two zones:        NODE: 4  ZONE: 0  ADDR: ffff00817fffe540  NAME:  DMA32           SIZE: 20480  MIN/LOW/HIGH: 11/28/45          VM_STAT:                NR_FREE_PAGES: 359        NR_ZONE_INACTIVE_ANON: 18813          NR_ZONE_ACTIVE_ANON: 0        NR_ZONE_INACTIVE_FILE: 50          NR_ZONE_ACTIVE_FILE: 0          NR_ZONE_UNEVICTABLE: 0        NR_ZONE_WRITE_PENDING: 0                     NR_MLOCK: 0                    NR_BOUNCE: 0                   NR_ZSPAGES: 0            NR_FREE_CMA_PAGES: 0        NODE: 4  ZONE: 1  ADDR: ffff00817fffec00  NAME:  Normal           SIZE: 8454144  PRESENT: 98304  MIN/LOW/HIGH: 68/166/264          VM_STAT:                NR_FREE_PAGES: 146        NR_ZONE_INACTIVE_ANON: 94668          NR_ZONE_ACTIVE_ANON: 3        NR_ZONE_INACTIVE_FILE: 735          NR_ZONE_ACTIVE_FILE: 78          NR_ZONE_UNEVICTABLE: 0        NR_ZONE_WRITE_PENDING: 0                     NR_MLOCK: 0                    NR_BOUNCE: 0                   NR_ZSPAGES: 0            NR_FREE_CMA_PAGES: 0In allow_direct_reclaim(), while processing ZONE_DMA32, the sum ofinactive/active file-backed pages calculated in zone_reclaimable_pages()based on the result of zone_page_state_snapshot() is zero.  Additionally, since this system lacks swap, the calculation of inactive/active anonymous pages is skipped.        crash> p nr_swap_pages        nr_swap_pages = $1937 = {          counter = 0        }As a result, ZONE_DMA32 is deemed unreclaimable and skipped, moving on tothe processing of the next zone, ZONE_NORMAL, despite ZONE_DMA32 havingfree pages significantly exceeding the high watermark.The problem is that the pgdat->kswapd_failures hasn t been incremented.        crash> px ((struct pglist_data *) 0xffff00817fffe540)->kswapd_failures        $1935 = 0x0This is because the node deemed balanced.  The node balancing logic inbalance_pgdat() evaluates all zones collectively.  If one or more zones(e.g., ZONE_DMA32) have enough free pages to meet their watermarks, theentire node is deemed balanced.  This causes balance_pgdat() to exit earlybefore incrementing the kswapd_failures, as it considers the overallmemory state acceptable, even though some zones (like ZONE_NORMAL) remainunder significant pressure.The patch ensures that zone_reclaimable_pages() includes free pages(NR_FREE_PAGES) in its calculation when no other reclaimable pages areavailable (e.g., file-backed or anonymous pages).  This change preventszones like ZONE_DMA32, which have sufficient free pages, from beingmistakenly deemed unreclaimable.  By doing so, the patch ensures propernode balancing, avoids masking pressure on other zones like ZONE_NORMAL,and prevents infinite loops in throttle_direct_reclaim() caused byallow_direct_reclaim(pgdat) repeatedly returning false.The kernel hangs due to a task stuck in throttle_direct_reclaim(), causedby a node being incorrectly deemed balanced despite pressure in certainzones, such as ZONE_NORMAL.  This issue arises fromzone_reclaimable_pages---truncated---
 漏洞公开时间：2025-01-15 21:15:12
 漏洞创建时间：2025-01-17 01:00:25
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2024-57884
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/1ff2302e8aeac7f2eedb551d7a89617283b5c6b2 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/58d0d02dbc67438fc80223fdd7bbc49cf0733284 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/63eac98d6f0898229f515cb62fe4e4db2430e99c |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/66cd37660ec34ec444fe42f2277330ae4a36bb19 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/6aaced5abd32e2a57cd94fd64f824514d0361da8 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/bfb701192129803191c9cd6cdd1f82cd07f8de2c |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/d675fefbaec3815b3ae0af1bebd97f27df3a05c8 |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-57884 | https://bugzilla.suse.com/show_bug.cgi?id=1235948 |
| suse_bugzilla | https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2024/CVE-2024-57884.mbox | https://bugzilla.suse.com/show_bug.cgi?id=1235948 |
| suse_bugzilla | https://git.kernel.org/stable/c/66cd37660ec34ec444fe42f2277330ae4a36bb19 | https://bugzilla.suse.com/show_bug.cgi?id=1235948 |
| suse_bugzilla | https://git.kernel.org/stable/c/d675fefbaec3815b3ae0af1bebd97f27df3a05c8 | https://bugzilla.suse.com/show_bug.cgi?id=1235948 |
| suse_bugzilla | https://git.kernel.org/stable/c/63eac98d6f0898229f515cb62fe4e4db2430e99c | https://bugzilla.suse.com/show_bug.cgi?id=1235948 |
| suse_bugzilla | https://git.kernel.org/stable/c/bfb701192129803191c9cd6cdd1f82cd07f8de2c | https://bugzilla.suse.com/show_bug.cgi?id=1235948 |
| suse_bugzilla | https://git.kernel.org/stable/c/1ff2302e8aeac7f2eedb551d7a89617283b5c6b2 | https://bugzilla.suse.com/show_bug.cgi?id=1235948 |
| suse_bugzilla | https://git.kernel.org/stable/c/58d0d02dbc67438fc80223fdd7bbc49cf0733284 | https://bugzilla.suse.com/show_bug.cgi?id=1235948 |
| suse_bugzilla | https://git.kernel.org/stable/c/6aaced5abd32e2a57cd94fd64f824514d0361da8 | https://bugzilla.suse.com/show_bug.cgi?id=1235948 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2024-57884 | https://bugzilla.suse.com/show_bug.cgi?id=1235948 |
| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2338199 | https://bugzilla.suse.com/show_bug.cgi?id=1235948 |
| redhat_bugzilla | https://lore.kernel.org/linux-cve-announce/2025011510-CVE-2024-57884-4cf8@gregkh/T | https://bugzilla.redhat.com/show_bug.cgi?id=2338199 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2025:6966 | https://bugzilla.redhat.com/show_bug.cgi?id=2338199 |
| debian |  | https://security-tracker.debian.org/tracker/CVE-2024-57884 |
| mageia |  | http://advisories.mageia.org/MGASA-2025-0030.html |
| osv | https://git.kernel.org/stable/c/1ff2302e8aeac7f2eedb551d7a89617283b5c6b2 | https://osv.dev/vulnerability/CVE-2024-57884 |
| osv | https://git.kernel.org/stable/c/58d0d02dbc67438fc80223fdd7bbc49cf0733284 | https://osv.dev/vulnerability/CVE-2024-57884 |
| osv | https://git.kernel.org/stable/c/63eac98d6f0898229f515cb62fe4e4db2430e99c | https://osv.dev/vulnerability/CVE-2024-57884 |
| osv | https://git.kernel.org/stable/c/66cd37660ec34ec444fe42f2277330ae4a36bb19 | https://osv.dev/vulnerability/CVE-2024-57884 |
| osv | https://git.kernel.org/stable/c/6aaced5abd32e2a57cd94fd64f824514d0361da8 | https://osv.dev/vulnerability/CVE-2024-57884 |
| osv | https://git.kernel.org/stable/c/bfb701192129803191c9cd6cdd1f82cd07f8de2c | https://osv.dev/vulnerability/CVE-2024-57884 |
| osv | https://git.kernel.org/stable/c/d675fefbaec3815b3ae0af1bebd97f27df3a05c8 | https://osv.dev/vulnerability/CVE-2024-57884 |
| osv | https://security-tracker.debian.org/tracker/CVE-2024-57884 | https://osv.dev/vulnerability/CVE-2024-57884 |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
| linux_kernel | 5.4.289 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=66cd37660ec34ec444fe42f2277330ae4a36bb19Issue | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=5a1c84b404a7176b8b36e2a0041b6f0adb3151a3 | linuxkernelcves |
| linux_kernel | 5.10.233 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=d675fefbaec3815b3ae0af1bebd97f27df3a05c8Issue | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=5a1c84b404a7176b8b36e2a0041b6f0adb3151a3 | linuxkernelcves |
| linux_kernel | 5.15.176 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=63eac98d6f0898229f515cb62fe4e4db2430e99cIssue | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=5a1c84b404a7176b8b36e2a0041b6f0adb3151a3 | linuxkernelcves |
| linux_kernel | 6.1.124 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=bfb701192129803191c9cd6cdd1f82cd07f8de2cIssue | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=5a1c84b404a7176b8b36e2a0041b6f0adb3151a3 | linuxkernelcves |
| linux_kernel | 6.6.70 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=1ff2302e8aeac7f2eedb551d7a89617283b5c6b2Issue | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=5a1c84b404a7176b8b36e2a0041b6f0adb3151a3 | linuxkernelcves |
| linux_kernel | 6.12.9 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=58d0d02dbc67438fc80223fdd7bbc49cf0733284Issue | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=5a1c84b404a7176b8b36e2a0041b6f0adb3151a3 | linuxkernelcves |
| linux_kernel | 6.13-rc6 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=6aaced5abd32e2a57cd94fd64f824514d0361da8Please | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=5a1c84b404a7176b8b36e2a0041b6f0adb3151a3 | linuxkernelcves |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
  In the Linux kernel, the following vulnerability has been resolved:mm: vmscan: account for free pages to prevent infinite Loop in throttle_direct_reclaim()The task sometimes continues looping in throttle_direct_reclaim() becauseallow_direct_reclaim(pgdat) keeps returning false.   #0 [ffff80002cb6f8d0] __switch_to at ffff8000080095ac #1 [ffff80002cb6f900] __schedule at ffff800008abbd1c #2 [ffff80002cb6f990] schedule at ffff800008abc50c #3 [ffff80002cb6f9b0] throttle_direct_reclaim at ffff800008273550 #4 [ffff80002cb6fa20] try_to_free_pages at ffff800008277b68 #5 [ffff80002cb6fae0] __alloc_pages_nodemask at ffff8000082c4660 #6 [ffff80002cb6fc50] alloc_pages_vma at ffff8000082e4a98 #7 [ffff80002cb6fca0] do_anonymous_page at ffff80000829f5a8 #8 [ffff80002cb6fce0] __handle_mm_fault at ffff8000082a5974 #9 [ffff80002cb6fd90] handle_mm_fault at ffff8000082a5bd4At this point, the pgdat contains the following two zones:        NODE: 4  ZONE: 0  ADDR: ffff00817fffe540  NAME:  DMA32           SIZE: 20480  MIN/LOW/HIGH: 11/28/45          VM_STAT:                NR_FREE_PAGES: 359        NR_ZONE_INACTIVE_ANON: 18813          NR_ZONE_ACTIVE_ANON: 0        NR_ZONE_INACTIVE_FILE: 50          NR_ZONE_ACTIVE_FILE: 0          NR_ZONE_UNEVICTABLE: 0        NR_ZONE_WRITE_PENDING: 0                     NR_MLOCK: 0                    NR_BOUNCE: 0                   NR_ZSPAGES: 0            NR_FREE_CMA_PAGES: 0        NODE: 4  ZONE: 1  ADDR: ffff00817fffec00  NAME:  Normal           SIZE: 8454144  PRESENT: 98304  MIN/LOW/HIGH: 68/166/264          VM_STAT:                NR_FREE_PAGES: 146        NR_ZONE_INACTIVE_ANON: 94668          NR_ZONE_ACTIVE_ANON: 3        NR_ZONE_INACTIVE_FILE: 735          NR_ZONE_ACTIVE_FILE: 78          NR_ZONE_UNEVICTABLE: 0        NR_ZONE_WRITE_PENDING: 0                     NR_MLOCK: 0                    NR_BOUNCE: 0                   NR_ZSPAGES: 0            NR_FREE_CMA_PAGES: 0In allow_direct_reclaim(), while processing ZONE_DMA32, the sum ofinactive/active file-backed pages calculated in zone_reclaimable_pages()based on the result of zone_page_state_snapshot() is zero.  Additionally, since this system lacks swap, the calculation of inactive/active anonymous pages is skipped.        crash> p nr_swap_pages        nr_swap_pages = $1937 = {          counter = 0        }As a result, ZONE_DMA32 is deemed unreclaimable and skipped, moving on tothe processing of the next zone, ZONE_NORMAL, despite ZONE_DMA32 havingfree pages significantly exceeding the high watermark.The problem is that the pgdat->kswapd_failures hasn t been incremented.        crash> px ((struct pglist_data *) 0xffff00817fffe540)->kswapd_failures        $1935 = 0x0This is because the node deemed balanced.  The node balancing logic inbalance_pgdat() evaluates all zones collectively.  If one or more zones(e.g., ZONE_DMA32) have enough free pages to meet their watermarks, theentire node is deemed balanced.  This causes balance_pgdat() to exit earlybefore incrementing the kswapd_failures, as it considers the overallmemory state acceptable, even though some zones (like ZONE_NORMAL) remainunder significant pressure.The patch ensures that zone_reclaimable_pages() includes free pages(NR_FREE_PAGES) in its calculation when no other reclaimable pages areavailable (e.g., file-backed or anonymous pages).  This change preventszones like ZONE_DMA32, which have sufficient free pages, from beingmistakenly deemed unreclaimable.  By doing so, the patch ensures propernode balancing, avoids masking pressure on other zones like ZONE_NORMAL,and prevents infinite loops in throttle_direct_reclaim() caused byallow_direct_reclaim(pgdat) repeatedly returning false.The kernel hangs due to a task stuck in throttle_direct_reclaim(), causedby a node being incorrectly deemed balanced despite pressure in certainzones, such as ZONE_NORMAL.  This issue arises fromzone_reclaimable_pages---truncated---
 openEuler评分：
  5.5
 Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
 受影响版本排查(受影响/不受影响)：
  1.openEuler-20.03-LTS-SP4(4.19.90):受影响
2.openEuler-22.03-LTS-SP3(5.10.0):受影响
3.openEuler-22.03-LTS-SP4(5.10.0):受影响
4.openEuler-24.03-LTS(6.6.0):受影响
5.openEuler-24.03-LTS-SP1(6.6.0):受影响
6.master(6.6.0):不受影响
7.openEuler-24.03-LTS-Next(6.6.0):不受影响

修复是否涉及abi变化(是/否)：
  1.openEuler-20.03-LTS-SP4(4.19.90):否
2.openEuler-22.03-LTS-SP3(5.10.0):否
3.master(6.6.0):否
4.openEuler-24.03-LTS(6.6.0):否
5.openEuler-24.03-LTS-Next(6.6.0):否
6.openEuler-22.03-LTS-SP4(5.10.0):否
7.openEuler-24.03-LTS-SP1(6.6.0):否

原因说明：
  1.openEuler-24.03-LTS(6.6.0):正常修复
2.openEuler-24.03-LTS-SP1(6.6.0):正常修复
3.openEuler-20.03-LTS-SP4(4.19.90):不修复-超出修复范围
4.openEuler-22.03-LTS-SP3(5.10.0):不修复-超出修复范围
5.openEuler-22.03-LTS-SP4(5.10.0):不修复-超出修复范围
6.master(6.6.0):不受影响-漏洞代码不能被攻击者触发
7.openEuler-24.03-LTS-Next(6.6.0):不受影响-漏洞代码不能被攻击者触发

三、漏洞修复
安全公告链接：https://www.openeuler.org/zh/security/safety-bulletin/detail/?id=openEuler-SA-2025-1321

src-openEuler/kernel
Closed

Content Risk Flag

Comments (17)

src-openEuler/kernelClosed .gitee-modal { width: 500px !important; }

Content Risk Flag

CVE-2024-57884

Comments (17)

Search

src-openEuler/kernel
Closed