CVE-2024-50280: dm cache: fix flushing uninitialized delayed_work on cache_ctr error
In the Linux kernel, the following vulnerability has been resolved:
dm cache: fix flushing uninitialized delayedwork on cachectr error
An unexpected WARNON from flushwork() may occur when cache creation fails, caused by destroying the uninitialized delayedwork waker in the error path of cachecreate(). For example, the warning appears on the superblock checksum error.
Reproduce steps:
dmsetup create cmeta --table "0 8192 linear /dev/sdc 0" dmsetup create cdata --table "0 65536 linear /dev/sdc 8192" dmsetup create corig --table "0 524288 linear /dev/sdc 262144" dd if=/dev/urandom of=/dev/mapper/cmeta bs=4k count=1 oflag=direct dmsetup create cache --table "0 524288 cache /dev/mapper/cmeta \ /dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 writethrough smq 0"
Kernel logs:
(snip) WARNING: CPU: 0 PID: 84 at kernel/workqueue.c:4178 flushwork+0x5d4/0x890
Fix by pulling out the canceldelayedworksync() from the constructor's error path. This patch doesn't affect the use-after-free fix for concurrent dmresume and dmdestroy (commit 6a459d8edbdb ("dm cache: Fix UAF in destroy()")) as cachedtr is not changed.
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-50280?
The severity of CVE-2024-50280 is categorized as moderate due to potential instability in the Linux kernel.
How do I fix CVE-2024-50280?
To fix CVE-2024-50280, ensure you update to the latest version of the Linux kernel where the vulnerability has been addressed.
What impact does CVE-2024-50280 have on system security?
CVE-2024-50280 could lead to system instability and unexpected warnings during cache creation failures in the Linux kernel.
Which versions of the Linux kernel are affected by CVE-2024-50280?
CVE-2024-50280 affects multiple versions of the Linux kernel, particularly those before the patch release that resolves the issue.
Is CVE-2024-50280 remotely exploitable?
CVE-2024-50280 does not appear to be remotely exploitable, focusing instead on local kernel operations.