CVE-2024-26844: block: Fix WARNING in _copy_from_iter
First published: Wed Apr 17 2024(Updated: )
In the Linux kernel, the following vulnerability has been resolved: block: Fix WARNING in _copy_from_iter Syzkaller reports a warning in _copy_from_iter because an iov_iter is supposedly used in the wrong direction. The reason is that syzcaller managed to generate a request with a transfer direction of SG_DXFER_TO_FROM_DEV. This instructs the kernel to copy user buffers into the kernel, read into the copied buffers and then copy the data back to user space. Thus the iovec is used in both directions. Detect this situation in the block layer and construct a new iterator with the correct direction for the copy-in.
Credit: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Linux Kernel | ||
| Linux Kernel | <6.1.80 | |
| Linux Kernel | >=6.2<6.6.19 | |
| Linux Kernel | >=6.7<6.7.7 | |
| Linux Kernel | =6.8-rc1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-26844?
The severity of CVE-2024-26844 has not been classified yet, but it addresses a warning in the Linux kernel's _copy_from_iter function.
How do I fix CVE-2024-26844?
To fix CVE-2024-26844, update your Linux kernel to version 6.1.80 or apply the relevant patches from the official kernel sources.
Which versions of the Linux kernel are affected by CVE-2024-26844?
CVE-2024-26844 affects Linux kernel versions from 6.2 to 6.6.19, including 6.8-rc1.
What is the impact of CVE-2024-26844 on system security?
CVE-2024-26844 primarily reports a warning related to the use of iov_iter in an incorrect direction, which may affect the integrity of data transfer.
Is CVE-2024-26844 a remote exploit vulnerability?
CVE-2024-26844 does not specify remote exploitation capabilities but addresses a warning generated during internal operations in the kernel.
- agent/references
- agent/title
- agent/type
- agent/description
- agent/first-publish-date
- agent/author
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/source
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- agent/severity
- agent/remedy
- agent/softwarecombine
- agent/tags
- vendor/linux
- canonical/linux kernel
- version/linux kernel/6.2
- version/linux kernel/6.7
- version/linux kernel/6.8-rc1