CVE-2024-35808: md/dm-raid: don't call md_reap_sync_thread() directly
In the Linux kernel, the following vulnerability has been resolved:
md/dm-raid: don't call mdreapsyncthread() directly
Currently mdreapsyncthread() is called from raidmessage() directly without holding 'reconfigmutex', this is definitely unsafe because mdreapsyncthread() can change many fields that is protected by 'reconfigmutex'.
However, hold 'reconfigmutex' here is still problematic because this will cause deadlock, for example, commit 130443d60b1b ("md: refactor idle/frozensyncthread() to fix deadlock").
Fix this problem by using stopsyncthread() to unregister syncthread, like md/raid did.
Other sources
In the Linux kernel, the following vulnerability has been resolved:
md/dm-raid: don't call mdreapsyncthread() directly
The Linux kernel CVE team has assigned CVE-2024-35808 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024051740-CVE-2024-35808-2bf6@gregkh/T
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.7.12 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.8.3 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.9 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.35.1-1 - Configuration
Modify md/dm-raid code so that raid_message() no longer calls md_reap_sync_thread() directly; instead, unregister/stop the sync_thread using stop_sync_thread() (as md/raid does). Ensure reconfig_mutex is not held in a way that would trigger deadlock (e.g., avoid the deadlock scenario addressed by commit 130443d60b1b in md: refactor idle/frozen_sync_thread() to fix deadlock).
Linux kernel md/dm-raid md/dm-raid sync_thread handling (use stop_sync_thread() instead of calling md_reap_sync_thread() directly) = Use stop_sync_thread() to unregister sync_thread rather than calling md_reap_sync_thread() directly from raid_message()
Event History
Frequently Asked Questions
What is the severity of CVE-2024-35808?
CVE-2024-35808 has been rated with high severity due to its potential to lead to data corruption or system instability.
How do I fix CVE-2024-35808?
To resolve CVE-2024-35808, you should upgrade to kernel versions 6.7.12, 6.8.3, 6.9, or the specified Debian versions 5.10.223-1, 5.10.226-1, 6.1.123-1, 6.1.119-1.
What systems are affected by CVE-2024-35808?
CVE-2024-35808 affects specific versions of the Linux kernel, including Red Hat kernel and Debian Linux packages.
What causes CVE-2024-35808?
CVE-2024-35808 is caused by a race condition due to the unsafe direct call of md_reap_sync_thread() without holding 'reconfig_mutex'.
Is there a workaround for CVE-2024-35808?
There is no recommended workaround for CVE-2024-35808, so applying the available patches is essential.