CVE-2024-27023: md: Fix missing release of 'active_io' for flush
In the Linux kernel, the following vulnerability has been resolved:
md: Fix missing release of 'activeio' for flush
submitflushes atomicset(&mddev->flushpending, 1); rdevforeachrcu(rdev, mddev) atomicinc(&mddev->flushpending); bi->biendio = mdendflush submitbio(bi); / flush io is done first / mdendflush if (atomicdecandtest(&mddev->flushpending)) percpurefput(&mddev->activeio) -> activeio is not released
if (atomicdecandtest(&mddev->flushpending)) -> missing release of activeio
For consequence, mddevsuspend() will wait for 'activeio' to be zero forever.
Fix this problem by releasing 'activeio' in submitflushes() if 'flushpending' is decreased to zero.
Other sources
In the Linux kernel, the following vulnerability has been resolved:
md: Fix missing release of 'activeio' for flush
The Linux kernel CVE team has assigned CVE-2024-27023 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024050105-CVE-2024-27023-4810@gregkh/T
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-27023?
CVE-2024-27023 has been classified with a severity rating that implies a moderate level of risk to affected systems.
How do I fix CVE-2024-27023?
To resolve CVE-2024-27023, you should update the Linux kernel to version 6.1.80, 6.6.19, or 6.7.7 or later.
What versions of the Linux kernel are affected by CVE-2024-27023?
CVE-2024-27023 affects versions of the Linux kernel prior to 6.1.80, 6.6.19, and 6.7.7.
What impact does CVE-2024-27023 have on system performance?
CVE-2024-27023 could potentially lead to degraded performance during I/O operations due to the handling of flush requests.
Is CVE-2024-27023 related to data integrity issues?
Yes, CVE-2024-27023 may pose risks to data integrity because of improper handling of active I/O flushes.