| From bippy-1.1.0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@kernel.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2024-50280: dm cache: fix flushing uninitialized delayed_work on cache_ctr error |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| dm cache: fix flushing uninitialized delayed_work on cache_ctr error |
| |
| An unexpected WARN_ON from flush_work() may occur when cache creation |
| fails, caused by destroying the uninitialized delayed_work waker in the |
| error path of cache_create(). For example, the warning appears on the |
| superblock checksum error. |
| |
| Reproduce steps: |
| |
| dmsetup create cmeta --table "0 8192 linear /dev/sdc 0" |
| dmsetup create cdata --table "0 65536 linear /dev/sdc 8192" |
| dmsetup create corig --table "0 524288 linear /dev/sdc 262144" |
| dd if=/dev/urandom of=/dev/mapper/cmeta bs=4k count=1 oflag=direct |
| dmsetup create cache --table "0 524288 cache /dev/mapper/cmeta \ |
| /dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 writethrough smq 0" |
| |
| Kernel logs: |
| |
| (snip) |
| WARNING: CPU: 0 PID: 84 at kernel/workqueue.c:4178 __flush_work+0x5d4/0x890 |
| |
| Fix by pulling out the cancel_delayed_work_sync() from the constructor's |
| error path. This patch doesn't affect the use-after-free fix for |
| concurrent dm_resume and dm_destroy (commit 6a459d8edbdb ("dm cache: Fix |
| UAF in destroy()")) as cache_dtr is not changed. |
| |
| The Linux kernel CVE team has assigned CVE-2024-50280 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Issue introduced in 5.10.163 with commit 2b17026685a270b2beaf1cdd9857fcedd3505c7e and fixed in 5.10.237 with commit 40fac0271c7aedf60d81ed8214e80851e5b26312 |
| Issue introduced in 5.15.87 with commit d2a0b298ebf83ab6236f66788a3541e91ce75a70 and fixed in 5.15.181 with commit d154b333a5667b6c1b213a11a41ad7aaccd10c3d |
| Issue introduced in 6.1.4 with commit 6a3e412c2ab131c54945327a7676b006f000a209 and fixed in 6.1.117 with commit 5a754d3c771280f2d06bf8ab716d6a0d36ca256e |
| Issue introduced in 6.2 with commit 6a459d8edbdbe7b24db42a5a9f21e6aa9e00c2aa and fixed in 6.6.61 with commit 8cc12dab635333c4ea28e72d7b947be7d0543c2c |
| Issue introduced in 6.2 with commit 6a459d8edbdbe7b24db42a5a9f21e6aa9e00c2aa and fixed in 6.11.8 with commit aee3ecda73ce13af7c3e556383342b57e6bd0718 |
| Issue introduced in 6.2 with commit 6a459d8edbdbe7b24db42a5a9f21e6aa9e00c2aa and fixed in 6.12 with commit 135496c208ba26fd68cdef10b64ed7a91ac9a7ff |
| Issue introduced in 4.9.337 with commit 034cbc8d3b47a56acd89453c29632a9c117de09d |
| Issue introduced in 4.14.303 with commit 993406104d2b28fe470126a062ad37a1e21e792e |
| Issue introduced in 4.19.270 with commit 4d20032dd90664de09f2902a7ea49ae2f7771746 |
| Issue introduced in 5.4.229 with commit 2f097dfac7579fd84ff98eb1d3acd41d53a485f3 |
| Issue introduced in 6.0.18 with commit 6ac4f36910764cb510bafc4c3768544f86ca48ca |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2024-50280 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| drivers/md/dm-cache-target.c |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/40fac0271c7aedf60d81ed8214e80851e5b26312 |
| https://git.kernel.org/stable/c/d154b333a5667b6c1b213a11a41ad7aaccd10c3d |
| https://git.kernel.org/stable/c/5a754d3c771280f2d06bf8ab716d6a0d36ca256e |
| https://git.kernel.org/stable/c/8cc12dab635333c4ea28e72d7b947be7d0543c2c |
| https://git.kernel.org/stable/c/aee3ecda73ce13af7c3e556383342b57e6bd0718 |
| https://git.kernel.org/stable/c/135496c208ba26fd68cdef10b64ed7a91ac9a7ff |
