CVE-2024-50109: md/raid10: fix null ptr dereference in raid10_size()
In the Linux kernel, the following vulnerability has been resolved:
md/raid10: fix null ptr dereference in raid10size()
In raid10run() if raid10setqueuelimits() succeed, the return value is set to zero, and if following procedures failed raid10run() will return zero while mddev->private is still NULL, causing null ptr dereference in raid10size().
Fix the problem by only overwrite the return value if raid10setqueuelimits() failed.
Other sources
In the Linux kernel, the following vulnerability has been resolved:
md/raid10: fix null ptr dereference in raid10size()
In raid10run() if raid10setqueuelimits() succeed, the return value is set to zero, and if following procedures failed raid10run() will return zero while mddev->private is still NULL, causing null ptr dereference in raid10size().
Fix the problem by only overwrite the return value if raid10setqueuelimits() failed.
— NVD
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-50109?
CVE-2024-50109 has not been assigned a specific severity rating but involves a null pointer dereference vulnerability in the Linux kernel.
How do I fix CVE-2024-50109?
To resolve CVE-2024-50109, users should upgrade to the latest patched version of the Linux kernel that addresses this vulnerability.
Which versions of Linux kernel are affected by CVE-2024-50109?
CVE-2024-50109 affects Linux kernel versions from 6.9 up to 6.11.6 and specific release candidates for 6.12.
What components are involved in CVE-2024-50109?
CVE-2024-50109 specifically involves the md (multiple devices) subsystem and the raid10 (Redundant Array of Independent Disks) functionality.
Is CVE-2024-50109 exploitable remotely?
The specific details on remote exploitability are not mentioned, but vulnerabilities related to kernel operations could potentially be leveraged for local privilege escalation.