CVE-2024-50184: virtio_pmem: Check device status before requesting flush
In the Linux kernel, the following vulnerability has been resolved:
virtiopmem: Check device status before requesting flush
If a pmem device is in a bad status, the driver side could wait for host ack forever in virtiopmemflush(), causing the system to hang.
So add a status check in the beginning of virtiopmemflush() to return early if the device is not activated.
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.129-1~deb11u1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.15.173.1-1 - Configuration
Apply the fix to virtio_pmem: add a device status check at the beginning of virtio_pmem_flush() to return early if the pmem device is not activated. This prevents waiting for host ack forever when the device is in a bad status.
Linux kernel virtio_pmem driver virtio_pmem_flush() device status check = return early when device is not activated
Event History
Frequently Asked Questions
What is the severity of CVE-2024-50184?
CVE-2024-50184 is considered a high-severity vulnerability due to its potential to cause system hangs.
How do I fix CVE-2024-50184?
To fix CVE-2024-50184, update to the latest kernel versions that include the patch, such as 6.1.123-1 or 6.12.11-1.
Which Linux kernel versions are affected by CVE-2024-50184?
CVE-2024-50184 affects Linux kernel versions from 5.3 to below 5.4.285, and versions below 6.2.
How does CVE-2024-50184 impact system performance?
CVE-2024-50184 can cause significant performance issues by causing the system to hang indefinitely during flush operations.
Is CVE-2024-50184 specific to certain distributions?
Yes, CVE-2024-50184 specifically affects Debian-based systems using the vulnerable kernel versions.