CVE-2024-35787: md/md-bitmap: fix incorrect usage for sb_index
In the Linux kernel, the following vulnerability has been resolved:
md/md-bitmap: fix incorrect usage for sbindex
Commit d7038f951828 ("md-bitmap: don't use ->index for pages backing the bitmap file") removed page->index from bitmap code, but left wrong code logic for clustered-md. current code never set slot offset for cluster nodes, will sometimes cause crash in clustered env.
Call trace (partly): mdbitmapfilesetbit+0x110/0x1d8 [mdmod] mdbitmapstartwrite+0x13c/0x240 [mdmod] raid1makerequest+0x6b0/0x1c08 [raid1] mdhandlerequest+0x1dc/0x368 [mdmod] mdsubmitbio+0x80/0xf8 [mdmod] submitbio+0x178/0x300 submitbionoacctnocheck+0x11c/0x338 submitbionoacct+0x134/0x614 submitbio+0x28/0xdc submitbhwbc+0x130/0x1cc submitbh+0x1c/0x28
Other sources
In the Linux kernel, the following vulnerability has been resolved:
md/md-bitmap: fix incorrect usage for sbindex
The Linux kernel CVE team has assigned CVE-2024-35787 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024051707-CVE-2024-35787-dede@gregkh/T
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.6.24 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.7.12 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.8.3 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.9 - Upgrade
Upgrade
Linux kernel md/md-bitmapto a version that resolves this vulnerability.Patch CVE-2024-35787 - Compensating control
If running clustered-md environments, temporarily avoid using md-bitmap until the fix for CVE-2024-35787 is applied, to prevent crashes caused by the incorrect clustered-md slot-offset logic.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-35787?
CVE-2024-35787 has been classified with a moderate severity level due to its potential impact on the Linux kernel.
How do I fix CVE-2024-35787?
To mitigate CVE-2024-35787, update the Linux kernel to version 6.6.24 or any of the specified remedial versions listed in the vulnerability details.
Which software is affected by CVE-2024-35787?
CVE-2024-35787 affects several versions of the Linux kernel, specifically those prior to versions 6.6.24, 6.7.12, 6.8.3, and 6.9.
What issue does CVE-2024-35787 address?
CVE-2024-35787 addresses incorrect logic in the bitmap code of the Linux kernel's multi-device (md) subsystem.
Can CVE-2024-35787 affect system stability?
Yes, exploiting CVE-2024-35787 could potentially impact the stability of systems running vulnerable versions of the Linux kernel.