CVE-2024-38663: blk-cgroup: fix list corruption from resetting io stat
In the Linux kernel, the following vulnerability has been resolved:
blk-cgroup: fix list corruption from resetting io stat
Since commit 3b8cc6298724 ("blk-cgroup: Optimize blkcgrstatflush()"), each iostat instance is added to blkcg percpu list, so blkcgresetstats() can't reset the stat instance by memset(), otherwise the llist may be corrupted.
Fix the issue by only resetting the counter part.
Other sources
In the Linux kernel, the following vulnerability has been resolved:
blk-cgroup: fix list corruption from resetting io stat
The Linux kernel CVE team has assigned CVE-2024-38663 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024062457-CVE-2024-38663-a1bc@gregkh/T
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.6.33 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.9.4 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.10 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch CVE-2024-38663
Event History
Frequently Asked Questions
What is the severity of CVE-2024-38663?
CVE-2024-38663 is classified as a moderate severity vulnerability that affects the Linux kernel.
How do I fix CVE-2024-38663?
To fix CVE-2024-38663, update the Linux kernel to version 6.6.33 or later for Red Hat, or version 5.10.223-1, 5.10.226-1, 6.1.119-1, 6.1.123-1, or 6.12.11-1 for Debian.
What systems are affected by CVE-2024-38663?
CVE-2024-38663 affects various versions of the Linux kernel including those used by Red Hat and Debian.
What components of the Linux kernel are impacted by CVE-2024-38663?
CVE-2024-38663 impacts the blk-cgroup functionality related to I/O statistics and list management.
Are there any workarounds for CVE-2024-38663?
No specific workarounds are recommended for CVE-2024-38663; upgrading to a patched version is the best approach.