CVE-2024-35979: raid1: fix use-after-free for original bio in raid1_write_request()
In the Linux kernel, the following vulnerability has been resolved:
raid1: fix use-after-free for original bio in raid1writerequest()
r1bio->bios[] is used to record new bios that will be issued to underlying disks, however, in raid1writerequest(), r1bio->bios[] will set to the original bio temporarily. Meanwhile, if blocked rdev is set, freer1bio() will be called causing that all r1bio->bios[] to be freed:
raid1writerequest() r1bio = allocr1bio(mddev, bio); -> r1bio->bios[] is NULL for (i = 0; i < disks; i++) -> for each rdev in conf // first rdev is normal r1bio->bios[0] = bio; -> set to original bio // second rdev is blocked if (testbit(Blocked, &rdev->flags)) break
if (blockedrdev) freer1bio() putallbios() bioput(r1bio->bios[0]) -> original bio is freed
Test scripts:
mdadm -CR /dev/md0 -l1 -n4 /dev/sd[abcd] --assume-clean fio -filename=/dev/md0 -ioengine=libaio -rw=write -bs=4k -numjobs=1 \ -iodepth=128 -name=test -direct=1 echo blocked > /sys/block/md0/md/rd2/state
Test result:
BUG bio-264 (Not tainted): Object already free -----------------------------------------------------------------------------
Allocated in mempoolallocslab+0x24/0x50 age=1 cpu=1 pid=869 kmemcachealloc+0x324/0x480 mempoolallocslab+0x24/0x50 mempoolalloc+0x6e/0x220 bioallocbioset+0x1af/0x4d0 blkdevdirectIO+0x164/0x8a0 blkdevwriteiter+0x309/0x440 aiowrite+0x139/0x2f0 iosubmitone+0x5ca/0xb70 dosysiosubmit+0x86/0x270 x64sysiosubmit+0x22/0x30 dosyscall64+0xb1/0x210 entrySYSCALL64afterhwframe+0x6c/0x74 Freed in mempoolfreeslab+0x1f/0x30 age=1 cpu=1 pid=869 kmemcachefree+0x28c/0x550 mempoolfreeslab+0x1f/0x30 mempoolfree+0x40/0x100 biofree+0x59/0x80 bioput+0xf0/0x220 freer1bio+0x74/0xb0 raid1makerequest+0xadf/0x1150 mdhandlerequest+0xc7/0x3b0 mdsubmitbio+0x76/0x130 submitbio+0xd8/0x1d0 submitbionoacctnocheck+0x1eb/0x5c0 submitbionoacct+0x169/0xd40 submitbio+0xee/0x1d0 blkdevdirectIO+0x322/0x8a0 blkdevwriteiter+0x309/0x440 aiowrite+0x139/0x2f0
Since that bios for underlying disks are not allocated yet, fix this problem by using mempoolfree() directly to free the r1bio.
Other sources
In the Linux kernel, the following vulnerability has been resolved:
raid1: fix use-after-free for original bio in raid1writerequest()
The Linux kernel CVE team has assigned CVE-2024-35979 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024052025-CVE-2024-35979-2618@gregkh/T
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.22-1Fixed in 6.12.25-1 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.6.28 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.8.7 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.9
Event History
Frequently Asked Questions
What is the severity of CVE-2024-35979?
CVE-2024-35979 has a high severity rating due to the potential for use-after-free vulnerabilities in the Linux kernel.
How do I fix CVE-2024-35979?
To fix CVE-2024-35979, update the kernel to version 6.6.28 or later, 6.8.7 or later, or 6.9.
Which versions of the Linux kernel are affected by CVE-2024-35979?
CVE-2024-35979 affects versions of the Linux kernel prior to 6.6.28, 6.8.7, and 6.9.
What components are specifically impacted by CVE-2024-35979?
CVE-2024-35979 specifically impacts the raid1 subsystem in the Linux kernel.
Is there an exploit associated with CVE-2024-35979?
Yes, CVE-2024-35979 allows for potential exploitation that can lead to system instability or unauthorized access.