| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <2024051737-CVE-2024-35826-c17f@gregkh> Date: Fri, 17 May 2024 15:27:38 +0200 From: Greg Kroah-Hartman <gregkh@...uxfoundation.org> To: linux-cve-announce@...r.kernel.org Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org> Subject: CVE-2024-35826: block: Fix page refcounts for unaligned buffers in __bio_release_pages() Description =========== In the Linux kernel, the following vulnerability has been resolved: block: Fix page refcounts for unaligned buffers in __bio_release_pages() Fix an incorrect number of pages being released for buffers that do not start at the beginning of a page. The Linux kernel CVE team has assigned CVE-2024-35826 to this issue. Affected and fixed versions =========================== Issue introduced in 6.1.75 with commit 9025ee107929 and fixed in 6.1.84 with commit 242006996d15 Issue introduced in 6.6.14 with commit 8955324cc9f9 and fixed in 6.6.24 with commit 7d3765550374 Issue introduced in 6.7.2 with commit d198c15d181c and fixed in 6.7.12 with commit ecbd9ced84dd Issue introduced in 6.8 with commit 1b151e2435fc and fixed in 6.8.3 with commit c9d3d2fbde9b Issue introduced in 6.8 with commit 1b151e2435fc and fixed in 6.9 with commit 38b43539d64b Issue introduced in 4.19.307 with commit d2d0b95ca1b5 Issue introduced in 5.4.269 with commit 3f4e660144ed Issue introduced in 5.10.210 with commit bfc0647791d7 Issue introduced in 5.15.148 with commit 0f2dca516541 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2024-35826 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: block/bio.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/242006996d15f5ca62e22f8c7de077d9c4a8f367 https://git.kernel.org/stable/c/7d3765550374f71248c55e6206ea1d6fd4537e65 https://git.kernel.org/stable/c/ecbd9ced84dd655a8f4cd49d2aad0e80dbf6bf35 https://git.kernel.org/stable/c/c9d3d2fbde9b8197bce88abcbe8ee8e713ffe7c2 https://git.kernel.org/stable/c/38b43539d64b2fa020b3b9a752a986769f87f7a6
Powered by blists - more mailing lists