CVE-2024-45026: s390/dasd: fix error recovery leading to data corruption on ESE devices
In the Linux kernel, the following vulnerability has been resolved:
s390/dasd: fix error recovery leading to data corruption on ESE devices
Extent Space Efficient (ESE) or thin provisioned volumes need to be formatted on demand during usual IO processing.
The dasdeseneedsformat function checks for error codes that signal the non existence of a proper track format.
The check for incorrect length is to imprecise since other error cases leading to transport of insufficient data also have this flag set. This might lead to data corruption in certain error cases for example during a storage server warmstart.
Fix by removing the check for incorrect length and replacing by explicitly checking for invalid track format in transport mode.
Also remove the check for file protected since this is not a valid ESE handling case.
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.129-1~deb11u1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-45026?
CVE-2024-45026 has a medium severity rating due to potential data corruption risks.
How do I fix CVE-2024-45026?
To fix CVE-2024-45026, update your Linux kernel to versions 6.1.123-1, 6.1.119-1, or any later patch version.
Which systems are affected by CVE-2024-45026?
CVE-2024-45026 affects various versions of the Linux kernel specifically used on ESE devices.
What types of data are at risk due to CVE-2024-45026?
CVE-2024-45026 poses a risk of data corruption during I/O operations on thin provisioned volumes.
Is there a workaround for CVE-2024-45026?
There is no official workaround for CVE-2024-45026; the best approach is to apply the appropriate kernel update.