lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <2024111940-CVE-2024-50280-068b@gregkh> Date: Tue, 19 Nov 2024 02:32:35 +0100 From: Greg Kroah-Hartman <gregkh@...uxfoundation.org> To: linux-cve-announce@...r.kernel.org Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org> Subject: CVE-2024-50280: dm cache: fix flushing uninitialized delayed_work on cache_ctr error Description =========== In the Linux kernel, the following vulnerability has been resolved: dm cache: fix flushing uninitialized delayed_work on cache_ctr error An unexpected WARN_ON from flush_work() may occur when cache creation fails, caused by destroying the uninitialized delayed_work waker in the error path of cache_create(). For example, the warning appears on the superblock checksum error. Reproduce steps: dmsetup create cmeta --table "0 8192 linear /dev/sdc 0" dmsetup create cdata --table "0 65536 linear /dev/sdc 8192" dmsetup create corig --table "0 524288 linear /dev/sdc 262144" dd if=/dev/urandom of=/dev/mapper/cmeta bs=4k count=1 oflag=direct dmsetup create cache --table "0 524288 cache /dev/mapper/cmeta \ /dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 writethrough smq 0" Kernel logs: (snip) WARNING: CPU: 0 PID: 84 at kernel/workqueue.c:4178 __flush_work+0x5d4/0x890 Fix by pulling out the cancel_delayed_work_sync() from the constructor's error path. This patch doesn't affect the use-after-free fix for concurrent dm_resume and dm_destroy (commit 6a459d8edbdb ("dm cache: Fix UAF in destroy()")) as cache_dtr is not changed. The Linux kernel CVE team has assigned CVE-2024-50280 to this issue. Affected and fixed versions =========================== Issue introduced in 6.1.4 with commit 6a3e412c2ab1 and fixed in 6.1.117 with commit 5a754d3c7712 Issue introduced in 6.2 with commit 6a459d8edbdb and fixed in 6.6.61 with commit 8cc12dab6353 Issue introduced in 6.2 with commit 6a459d8edbdb and fixed in 6.11.8 with commit aee3ecda73ce Issue introduced in 6.2 with commit 6a459d8edbdb and fixed in 6.12 with commit 135496c208ba Issue introduced in 4.9.337 with commit 034cbc8d3b47 Issue introduced in 4.14.303 with commit 993406104d2b Issue introduced in 4.19.270 with commit 4d20032dd906 Issue introduced in 5.4.229 with commit 2f097dfac757 Issue introduced in 5.10.163 with commit 2b17026685a2 Issue introduced in 5.15.87 with commit d2a0b298ebf8 Issue introduced in 6.0.18 with commit 6ac4f3691076 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2024-50280 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/md/dm-cache-target.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/5a754d3c771280f2d06bf8ab716d6a0d36ca256e https://git.kernel.org/stable/c/8cc12dab635333c4ea28e72d7b947be7d0543c2c https://git.kernel.org/stable/c/aee3ecda73ce13af7c3e556383342b57e6bd0718 https://git.kernel.org/stable/c/135496c208ba26fd68cdef10b64ed7a91ac9a7ff
Powered by blists - more mailing lists