Junglewise Threat Intelligence

CVE-2024-57977: Linux Kernel soft lockup in memcg OOM process

CVE-2024-57977 · Severity: medium · CVSS 5.5 · Published 2025-02-27

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's memory management system can cause a system to become unresponsive (soft lockup) during Out-of-Memory (OOM) events. This occurs when the system attempts to manage a very large number of processes (e.g., tens of thousands) within a specific memory control group. An exploit could lead to a denial-of-service condition, impacting the availability of the server and any hosted applications.

Technical details

A soft lockup vulnerability exists in the Linux kernel's memcg OOM handler. The issue is caused by the 'mem_cgroup_scan_tasks' function and global OOM 'dump_tasks' loop failing to yield the CPU while traversing a very large number of tasks (e.g., 56,000+). This results in the CPU being held for an extended period (e.g., 23 seconds), triggering the watchdog timer. The fix introduces 'cond_resched()' and 'touch_softlockup_watchdog()' every 1000 iterations to ensure the kernel remains responsive. This is a local denial-of-service vulnerability requiring the ability to trigger OOM conditions or manage large task counts in a cgroup.

Affected products

  • Linux Linux Kernel 3.6 to 6.12.13, 6.13 to 6.13.2

Timeline

  • 2024-12-24: other: Patch authored
  • 2025-02-26: advisory: CVE received from kernel.org
  • 2025-02-27: disclosed: Initial publication
  • 2025-03-07: patched: NIST initial analysis and patch references added

References

Related threats