CVE-2024-53155: ocfs2: fix uninitialized value in ocfs2_file_read_iter()
In the Linux kernel, the following vulnerability has been resolved:
ocfs2: fix uninitialized value in ocfs2filereaditer()
Syzbot has reported the following KMSAN splat:
BUG: KMSAN: uninit-value in ocfs2filereaditer+0x9a4/0xf80 ocfs2filereaditer+0x9a4/0xf80 ioread+0x8d4/0x20f0 ioread+0x3e/0xf0 ioissuesqe+0x42b/0x22c0 iowqsubmitwork+0xaf9/0xdc0 ioworkerhandlework+0xd13/0x2110 iowqworker+0x447/0x1410 retfromfork+0x6f/0x90 retfromforkasm+0x1a/0x30
Uninit was created at: allocpagesnoprof+0x9a7/0xe00 allocpagesmpolnoprof+0x299/0x990 allocpagesnoprof+0x1bf/0x1e0 allocateslab+0x33a/0x1250 slaballoc+0x12ef/0x35e0 kmemcacheallocbulknoprof+0x486/0x1330 ioallocreqrefill+0x84/0x560 iosubmitsqes+0x172f/0x2f30 sesysiouringenter+0x406/0x41c0 x64sysiouringenter+0x11f/0x1a0 x64syscall+0x2b54/0x3ba0 dosyscall64+0xcd/0x1e0 entrySYSCALL64afterhwframe+0x77/0x7f
Since an instance of 'struct kiocb' may be passed from the block layer with 'private' field uninitialized, introduce 'ocfs2iocbinitrwlocked()' and use it from where 'ocfs2dioendio()' might take care, i.e. in 'ocfs2filereaditer()' and 'ocfs2filewriteiter()'.
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-53155?
CVE-2024-53155 is classified as a medium severity vulnerability in the Linux kernel.
How do I fix CVE-2024-53155?
To fix CVE-2024-53155, update to the latest version of the Linux kernel that addresses this vulnerability.
Which versions of the Linux kernel are affected by CVE-2024-53155?
CVE-2024-53155 affects Linux kernel versions between 2.6.22 and 4.19.325, 4.20 and 5.4.287, 5.5 and 5.10.231, 5.11 and 5.15.174, 5.16 and 6.1.120, 6.2 and 6.6.64, 6.7 and 6.11.11, and 6.12 and 6.12.2.
What type of vulnerability is CVE-2024-53155?
CVE-2024-53155 is a use of uninitialized value vulnerability in the ocfs2 file system code of the Linux kernel.
What impact does CVE-2024-53155 have on systems?
The impact of CVE-2024-53155 may include potential data corruption or system instability due to uninitialized values being used during file read operations.