CVE-2024-41077: null_blk: fix validation of block size
In the Linux kernel, the following vulnerability has been resolved:
nullblk: fix validation of block size
Block size should be between 512 and PAGESIZE and be a power of 2. The current check does not validate this, so update the check.
Without this patch, nullblk would Oops due to a null pointer deref when loaded with bs=1536 [1].
[axboe: remove unnecessary braces and != 0 check]
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 5.10.223 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 5.15.164 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.1.101 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.6.42 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.9.11 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.10 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.106-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.9.11-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Configuration
Configure the null_blk block size (bs) to a power-of-2 value in the range 512 through PAGE_SIZE; do not use bs=1536.
Linux kernel null_blk bs = A power of 2 between 512 and PAGE_SIZE
Event History
Frequently Asked Questions
What is the severity of CVE-2024-41077?
CVE-2024-41077 is classified as a medium severity vulnerability in the Linux kernel.
How do I fix CVE-2024-41077?
To fix CVE-2024-41077, update the Linux kernel to versions 5.10.223, 5.15.164, 6.1.101, 6.6.42, or later.
What systems are affected by CVE-2024-41077?
CVE-2024-41077 affects various distributions of the Linux kernel, including specific versions listed in the advisory.
What impact does CVE-2024-41077 have on system performance?
CVE-2024-41077 could potentially lead to system instability or crashes if the block size validation is not properly enforced.
Is there a workaround for CVE-2024-41077?
Currently, the recommended solution for CVE-2024-41077 is to apply the available kernel updates, as there are no official workarounds.