7.8

CVE-2024-50280

dm cache: fix flushing uninitialized delayed_work on cache_ctr error

In the Linux kernel, the following vulnerability has been resolved:

dm cache: fix flushing uninitialized delayed_work on cache_ctr error

An unexpected WARN_ON from flush_work() may occur when cache creation
fails, caused by destroying the uninitialized delayed_work waker in the
error path of cache_create(). For example, the warning appears on the
superblock checksum error.

Reproduce steps:

dmsetup create cmeta --table "0 8192 linear /dev/sdc 0"
dmsetup create cdata --table "0 65536 linear /dev/sdc 8192"
dmsetup create corig --table "0 524288 linear /dev/sdc 262144"
dd if=/dev/urandom of=/dev/mapper/cmeta bs=4k count=1 oflag=direct
dmsetup create cache --table "0 524288 cache /dev/mapper/cmeta \
/dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 writethrough smq 0"

Kernel logs:

(snip)
WARNING: CPU: 0 PID: 84 at kernel/workqueue.c:4178 __flush_work+0x5d4/0x890

Fix by pulling out the cancel_delayed_work_sync() from the constructor's
error path. This patch doesn't affect the use-after-free fix for
concurrent dm_resume and dm_destroy (commit 6a459d8edbdb ("dm cache: Fix
UAF in destroy()")) as cache_dtr is not changed.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Linux ≫ Linux Kernel Version >= 4.9.337 < 4.10
Linux ≫ Linux Kernel Version >= 4.14.303 < 4.15
Linux ≫ Linux Kernel Version >= 4.19.270 < 4.20
Linux ≫ Linux Kernel Version >= 5.4.229 < 5.5
Linux ≫ Linux Kernel Version >= 5.10.163 < 5.11
Linux ≫ Linux Kernel Version >= 5.15.87 < 5.16
Linux ≫ Linux Kernel Version >= 6.0.18 < 6.1
Linux ≫ Linux Kernel Version >= 6.1.4 < 6.1.117
Linux ≫ Linux Kernel Version >= 6.2 < 6.6.61
Linux ≫ Linux Kernel Version >= 6.7 < 6.11.8
Linux ≫ Linux Kernel Version6.12 Updaterc1
Linux ≫ Linux Kernel Version6.12 Updaterc2
Linux ≫ Linux Kernel Version6.12 Updaterc3
Linux ≫ Linux Kernel Version6.12 Updaterc4
Linux ≫ Linux Kernel Version6.12 Updaterc5
Linux ≫ Linux Kernel Version6.12 Updaterc6
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.25% 0.163
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
134c704f-9b21-4f2e-91b3-4a467353bcc0 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-416 Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

https://git.kernel.org/stable/c/135496c208ba26fd68cdef10b64ed7a91ac9a7ff
Patch
https://git.kernel.org/stable/c/5a754d3c771280f2d06bf8ab716d6a0d36ca256e
Patch
https://git.kernel.org/stable/c/8cc12dab635333c4ea28e72d7b947be7d0543c2c
Patch
https://git.kernel.org/stable/c/aee3ecda73ce13af7c3e556383342b57e6bd0718
Patch
https://git.kernel.org/stable/c/40fac0271c7aedf60d81ed8214e80851e5b26312
https://git.kernel.org/stable/c/d154b333a5667b6c1b213a11a41ad7aaccd10c3d
https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html
https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html