CVE-2024-35985: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-35985 affects the Linux kernel's scheduler component, specifically in the EEVDF (Earliest Eligible Virtual Deadline First) scheduler. The vulnerability was discovered in May 2024 and involves a NULL pointer dereference issue in the reweight_eevdf() function. The vulnerability affects Linux kernel versions from 6.6.4 up to (excluding) 6.6.30, versions from 6.7 up to (excluding) 6.8.9, and various release candidates of version 6.9 (NVD).

The vulnerability stems from a condition where pick_eevdf() could return NULL, leading to a NULL pointer dereference. This occurs due to entity_eligible() returning false negatives because of an s64 multiplication overflow. The issue specifically arises in reweight_eevdf() which computes the vlag (virtual lag) without considering the limit placed upon vlag as update_entity_lag() does. The subsequent scaling multiplication, involving 20-bit fixed-point weight calculations, can overflow, resulting in incorrect vruntime calculations that cause entity_eligible() to incorrectly indicate nothing is eligible (Kernel Patch). The vulnerability has been assigned a CVSS v3.1 base score of 5.5 (Medium) with vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD).

When exploited, this vulnerability can lead to a system crash through NULL pointer dereference. While the occurrence is described as 'quite rare,' it is fatal when it does happen, potentially causing a denial of service condition in affected systems (Kernel Patch).

The vulnerability requires local access to the system and can be triggered through the scheduler's weight adjustment mechanism. The issue was reported by multiple individuals including Sergei Trofimovich, Igor Raits, Breno Leitao, and was also detected by the kernel test robot (Kernel Patch).

The vulnerability has been fixed in the Linux kernel through a patch that implements proper bounds checking for vlag in reweight_eevdf(). The fix involves adding an entity_lag() function that properly limits the range of vlag values. Ubuntu has released updates for affected versions, including fixes in version 6.8.0-38.38 for Ubuntu 24.04 LTS and various other kernel variants (Ubuntu Security).