CVE-2024-42131: mm: avoid overflows in dirty throttling logic
In the Linux kernel, the following vulnerability has been resolved:
mm: avoid overflows in dirty throttling logic
The dirty throttling logic is interspersed with assumptions that dirty
limits in PAGE_SIZE units fit into 32-bit (so that various multiplications
fit into 64-bits). If limits end up being larger, we will hit overflows,
possible divisions by 0 etc. Fix these problems by never allowing so
large dirty limits as they have dubious practical value anyway. For
dirty_bytes / dirty_background_bytes interfaces we can just refuse to set
so large limits. For dirty_ratio / dirty_background_ratio it isn't so
simple as the dirty limit is computed from the amount of available memory
which can change due to memory hotplug etc. So when converting dirty
limits from ratios to numbers of pages, we just don't allow the result to
exceed UINT_MAX.
This is root-only triggerable problem which occurs when the operator
sets dirty limits to >16 TB.
Security readout for executives and security teams
Plain-English summary
This Linux kernel issue affects dirty memory throttling when extremely large dirty limits are configured. The source says it is root-only triggerable and occurs when an operator sets dirty limits above 16 TB. Business urgency is low for typical systems, but large-memory hosts and custom kernel/sysctl configurations should be checked.
Executive priority
Treat as a targeted maintenance item, not an emergency, unless your fleet includes very large Linux systems with custom dirty memory tuning. Prioritize through normal kernel patch cycles and configuration review.
Technical view
Dirty throttling logic assumed page-based dirty limits fit within 32-bit values, creating overflow and possible divide-by-zero conditions when limits became too large. The fix caps ratio-derived dirty limits at UINT_MAX and rejects oversized dirty_bytes and dirty_background_bytes settings. Sources identify Linux kernel affected versions and stable commit references.
Likely exposure
Exposure is most plausible on Linux systems where privileged administrators or automation configure unusually large vm dirty limits, especially large-memory or memory-hotplug environments. Default or ordinary server configurations are less likely to reach the described condition.
Exploitation context
The source bundle states this is root-only triggerable and requires dirty limits greater than 16 TB. KEV is false, and the provided sources do not claim active exploitation, public weaponization, or remote unauthenticated reachability.
Researcher notes
The key constraint is local privileged configuration. The sources do not provide CVSS, CWE, exploit reports, or a precise runtime impact beyond overflow and possible division-by-zero behavior. Avoid expanding scope beyond Linux kernel dirty throttling logic.
Mitigation direction
Update affected Linux kernels to vendor builds containing the referenced stable fixes.
Avoid configuring dirty_bytes or dirty_background_bytes above practical vendor-supported limits.
Review dirty_ratio and dirty_background_ratio use on very large-memory systems.
Track distribution advisories, including Debian LTS if applicable.
Do not deploy kernels until standard unit, regression, and operational tests pass.
Validation and detection
Inventory Linux kernel versions against the affected and fixed vendor ranges.
Review vm dirty limit settings for values that could exceed 16 TB.
Check large-memory and memory-hotplug hosts first.
Confirm installed kernel packages include the referenced stable fix lineage.
Document whether local automation manages dirty throttling sysctls.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Potential ATT&CK relevance
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
cve · low confidence lookup
CVE-2024-42131 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.