Linux Kernel Vulnerability in Vmalloc Management Can Lead to Unexpected BUG() Trigger

A vulnerability in the Linux kernel's virtual memory management can cause the system to improperly trigger a BUG() error when it should not. This issue arises in the __get_vm_area_node() function, which mistakenly interprets the context as being in_interrupt() when bottom halves are disabled. The problem can occur in bridge code that manipulates the hash lock, disabling bottom halves and then calling rhashtable_lookup_insert_fast(). This sequence leads to the allocation of memory via vmalloc(), which in turn calls __get_vm_area_node() and triggers the BUG() error. The vulnerability affects the Linux kernel stable tree.

Impact

Exploitation of this vulnerability can cause the system to trigger a BUG() error, potentially leading to a system crash or instability.

Reproduction

To reproduce this vulnerability, disable bottom halves in the bridge code by acquiring the hash lock with spin_lock_bh(). Then, call rhashtable_lookup_insert_fast(), which will initiate a memory allocation process that goes through vmalloc() and eventually __get_vm_area_node(). This will trigger the BUG() error, despite not being in an NMI or hard IRQ context.

Remediation

The vulnerability has been addressed by modifying the __get_vm_area_node() function to check for in_nmi() or in_hardirq() instead of in_interrupt(). Users should apply the latest patches available in the Linux kernel stable tree to mitigate this issue.