CVE-2024-44973

What it actually does

The flaw causes slab corruption when __kmem_cache_free_bulk incorrectly invokes do_slab_free on KFENCE objects, resulting in padding overwrites and kernel crashes during bulk memory freeing operations.

Why it matters to the business

Systems may experience unexpected crashes and instability during normal operation of memory-intensive workloads, potentially leading to service disruptions in environments using affected kernel versions or dependent applications.

How an attack unfolds

An attacker triggers bulk allocation and freeing paths (such as network skb operations) that reach the buggy code path in __kmem_cache_free_bulk, causing the kernel to mishandle KFENCE objects and corrupt slab metadata, resulting in a crash.

How to fix it

Update the Linux kernel to a version containing the fix for this issue. For affected ekuiper deployments, upgrade to version 1.14.2 or later.

How to confirm the fix worked

Verify the presence of the kfence_free check in __kmem_cache_free_bulk in the running kernel source or binary; test bulk free paths with KFENCE enabled to confirm no crashes occur.

Typical attack path

1. Identify or induce bulk memory operations involving network or skb allocations
2. Force conditions where KFENCE objects are passed to the bulk free path
3. Trigger slab_pad_check or free_to_partial_list to detect and panic on overwritten padding

How to detect it

Review kernel logs for BUG reports mentioning skbuff_head_cache, slab_err, or padding overwritten messages; correlate with napi_build_skb or kmem_cache_alloc_bulk call traces.

What your security team should do

• Prioritize kernel updates on systems running workloads that perform frequent bulk memory allocations
• Monitor for slab_err or padding overwrite panics in kernel logs
• Apply the ekuiper 1.14.2 update where the package is deployed