CVE-2024-38384: blk-cgroup: fix list corruption from reorder of WRITE ->lqueued
In the Linux kernel, the following vulnerability has been resolved:
blk-cgroup: fix list corruption from reorder of WRITE ->lqueued
blkcgrstatflush() can be run anytime, especially when blkcgroupbiostart is being executed.
If WRITE of ->lqueued is re-ordered with READ of 'bisc->lnode.next' in the loop of blkcgrstatflush(), nextbisc can be assigned with one stat instance being added in blkcgroupbiostart(), then the local list in blkcgrstatflush() could be corrupted.
Fix the issue by adding one barrier.
Other sources
In the Linux kernel, the following vulnerability has been resolved:
blk-cgroup: fix list corruption from reorder of WRITE ->lqueued
The Linux kernel CVE team has assigned CVE-2024-38384 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024062455-CVE-2024-38384-47e5@gregkh/T
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.6.33 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.9.4 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.10 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-38384?
CVE-2024-38384 is considered a medium-severity vulnerability in the Linux kernel.
How do I fix CVE-2024-38384?
To fix CVE-2024-38384, update to the kernel versions 6.6.33, 6.9.4, 6.10, or the specific versions recommended for Debian Linux.
What does CVE-2024-38384 affect?
CVE-2024-38384 affects the Linux kernel specifically related to blk-cgroup list corruption.
Is my system vulnerable to CVE-2024-38384?
If you are running an affected version of the Linux kernel, your system may be vulnerable to CVE-2024-38384.
What type of vulnerability is CVE-2024-38384?
CVE-2024-38384 is a vulnerability related to list corruption in the block control group within the Linux kernel.