In the Linux kernel, the following vulnerability has been resolved:
dm cache: fix potential out-of-bounds access on the first resume
Out-of-bounds access occurs if the fast device is expanded unexpectedly before the first-time resume of the cache table. This happens because expanding the fast device requires reloading the cache table for cachecreate to allocate new in-core data structures that fit the new size, and the check in cachepreresume is not performed during the first resume, leading to the issue.
Reproduce steps:
dmsetup create cmeta --table "0 8192 linear /dev/sdc 0" dmsetup create cdata --table "0 65536 linear /dev/sdc 8192" dmsetup create corig --table "0 524288 linear /dev/sdc 262144" dd if=/dev/zero of=/dev/mapper/cmeta bs=4k count=1 oflag=direct
dmsetup create cache --notable dmsetup reload cache --table "0 524288 cache /dev/mapper/cmeta \ /dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 writethrough smq 0" dmsetup reload cdata --table "0 131072 linear /dev/sdc 8192" dmsetup resume cdata dmsetup resume cache
dmsetup suspend cache
KASAN reports:
BUG: KASAN: vmalloc-out-of-bounds in isdirtycallback+0x2b/0x80 Read of size 8 at addr ffffc90000085040 by task dmsetup/90
(...snip...) The buggy address belongs to the virtual mapping at [ffffc90000085000, ffffc90000087000) created by: cache_ctr+0x176a/0x35f0
(...snip...) Memory state around the buggy address: ffffc90000084f00: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 ffffc90000084f80: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
ffffc90000085000: 00 00 00 00 00 00 00 00 f8 f8 f8 f8 f8 f8 f8 f8 ^ ffffc90000085080: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 ffffc90000085100: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
Fix by checking the size change on the first resume.
[
{
"deprecated": false,
"target": {
"file": "drivers/md/dm-cache-target.c",
"function": "cache_preresume"
},
"digest": {
"function_hash": "52577733709285334035338138444922483142",
"length": 1083.0
},
"id": "CVE-2024-50278-161f91bc",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fdef3b94dfebd57e3077a578b6e309a2bb6fa688",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "drivers/md/dm-cache-target.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"148335881802719856447914845660899903063",
"254561610284056148013630640949551142157",
"283400542004366593154958787587428788462",
"283138398671710663188641676537294576593",
"175362949799747210507768095876434737345",
"226624021783298083280436356246744271364",
"58907390633272775058869240502182512822",
"32498917870380453524604975699314482452",
"52360737605491614329290960147889960070",
"137459316683004706337650291893761974586",
"274919317766558116658355993114020918770",
"192812816469337728141562992597315943863",
"157111822061546573780078055486156618094",
"294032682950721479695235641760787959920",
"298332339784775304380521800621046534975",
"270524573032897758986864339805129737291",
"105135349804760838859480469610730392589",
"240733255160186569668577817304227168535",
"291227253462334487705968119802408487225",
"269792584968551618609246284194573452789",
"302569091425696028370952345120359493956",
"270838765581324321489922627242877803666",
"112414972509558789460890822969403132804",
"147847668120231576682451523489013260608",
"152876596742004354704436231707028265708",
"141844947879248088657995942021151575883",
"61741372326502031287230868445257602759",
"92582561455118319797646093777223380525",
"87324117921475263414054905525324168216",
"146695415448347332018185010837212624891",
"95750101748958451962539836165530509690"
]
},
"id": "CVE-2024-50278-2295890e",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e492f71854ce03474d49e87fd98b8df1f7cd1d2d",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "drivers/md/dm-cache-target.c",
"function": "cache_preresume"
},
"digest": {
"function_hash": "52577733709285334035338138444922483142",
"length": 1083.0
},
"id": "CVE-2024-50278-23acf82e",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@13ed3624c6ef283acefa4cc42cc8ae54fd4391a4",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "drivers/md/dm-cache-target.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"148335881802719856447914845660899903063",
"254561610284056148013630640949551142157",
"283400542004366593154958787587428788462",
"283138398671710663188641676537294576593",
"175362949799747210507768095876434737345",
"226624021783298083280436356246744271364",
"58907390633272775058869240502182512822",
"32498917870380453524604975699314482452",
"52360737605491614329290960147889960070",
"137459316683004706337650291893761974586",
"274919317766558116658355993114020918770",
"192812816469337728141562992597315943863",
"157111822061546573780078055486156618094",
"294032682950721479695235641760787959920",
"298332339784775304380521800621046534975",
"270524573032897758986864339805129737291",
"105135349804760838859480469610730392589",
"240733255160186569668577817304227168535",
"291227253462334487705968119802408487225",
"269792584968551618609246284194573452789",
"302569091425696028370952345120359493956",
"270838765581324321489922627242877803666",
"112414972509558789460890822969403132804",
"147847668120231576682451523489013260608",
"152876596742004354704436231707028265708",
"141844947879248088657995942021151575883",
"61741372326502031287230868445257602759",
"92582561455118319797646093777223380525",
"87324117921475263414054905525324168216",
"146695415448347332018185010837212624891",
"95750101748958451962539836165530509690"
]
},
"id": "CVE-2024-50278-3cd5f1b7",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@036dd6e3d2638103e0092864577ea1d091466b86",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "drivers/md/dm-cache-target.c",
"function": "cache_preresume"
},
"digest": {
"function_hash": "52577733709285334035338138444922483142",
"length": 1083.0
},
"id": "CVE-2024-50278-44b50b0f",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@036dd6e3d2638103e0092864577ea1d091466b86",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "drivers/md/dm-cache-target.c",
"function": "can_resize"
},
"digest": {
"function_hash": "165830554838524711495239001326735306298",
"length": 577.0
},
"id": "CVE-2024-50278-6f594855",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@13ed3624c6ef283acefa4cc42cc8ae54fd4391a4",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "drivers/md/dm-cache-target.c",
"function": "can_resize"
},
"digest": {
"function_hash": "165830554838524711495239001326735306298",
"length": 577.0
},
"id": "CVE-2024-50278-735bc728",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@036dd6e3d2638103e0092864577ea1d091466b86",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "drivers/md/dm-cache-target.c",
"function": "can_resize"
},
"digest": {
"function_hash": "165830554838524711495239001326735306298",
"length": 577.0
},
"id": "CVE-2024-50278-74758d7e",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e492f71854ce03474d49e87fd98b8df1f7cd1d2d",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "drivers/md/dm-cache-target.c",
"function": "can_resize"
},
"digest": {
"function_hash": "165830554838524711495239001326735306298",
"length": 577.0
},
"id": "CVE-2024-50278-8955398f",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c52ec00cb2f9bebfada22edcc0db385b910a1cdb",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "drivers/md/dm-cache-target.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"148335881802719856447914845660899903063",
"254561610284056148013630640949551142157",
"283400542004366593154958787587428788462",
"283138398671710663188641676537294576593",
"175362949799747210507768095876434737345",
"226624021783298083280436356246744271364",
"58907390633272775058869240502182512822",
"32498917870380453524604975699314482452",
"52360737605491614329290960147889960070",
"137459316683004706337650291893761974586",
"274919317766558116658355993114020918770",
"192812816469337728141562992597315943863",
"157111822061546573780078055486156618094",
"294032682950721479695235641760787959920",
"298332339784775304380521800621046534975",
"270524573032897758986864339805129737291",
"105135349804760838859480469610730392589",
"240733255160186569668577817304227168535",
"291227253462334487705968119802408487225",
"269792584968551618609246284194573452789",
"302569091425696028370952345120359493956",
"270838765581324321489922627242877803666",
"112414972509558789460890822969403132804",
"147847668120231576682451523489013260608",
"152876596742004354704436231707028265708",
"141844947879248088657995942021151575883",
"61741372326502031287230868445257602759",
"92582561455118319797646093777223380525",
"87324117921475263414054905525324168216",
"146695415448347332018185010837212624891",
"95750101748958451962539836165530509690"
]
},
"id": "CVE-2024-50278-8a2c0c53",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fdef3b94dfebd57e3077a578b6e309a2bb6fa688",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "drivers/md/dm-cache-target.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"148335881802719856447914845660899903063",
"254561610284056148013630640949551142157",
"283400542004366593154958787587428788462",
"283138398671710663188641676537294576593",
"175362949799747210507768095876434737345",
"226624021783298083280436356246744271364",
"58907390633272775058869240502182512822",
"32498917870380453524604975699314482452",
"52360737605491614329290960147889960070",
"137459316683004706337650291893761974586",
"274919317766558116658355993114020918770",
"192812816469337728141562992597315943863",
"157111822061546573780078055486156618094",
"294032682950721479695235641760787959920",
"298332339784775304380521800621046534975",
"270524573032897758986864339805129737291",
"105135349804760838859480469610730392589",
"240733255160186569668577817304227168535",
"291227253462334487705968119802408487225",
"269792584968551618609246284194573452789",
"302569091425696028370952345120359493956",
"270838765581324321489922627242877803666",
"112414972509558789460890822969403132804",
"147847668120231576682451523489013260608",
"152876596742004354704436231707028265708",
"141844947879248088657995942021151575883",
"61741372326502031287230868445257602759",
"92582561455118319797646093777223380525",
"87324117921475263414054905525324168216",
"146695415448347332018185010837212624891",
"95750101748958451962539836165530509690"
]
},
"id": "CVE-2024-50278-906f3018",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@13ed3624c6ef283acefa4cc42cc8ae54fd4391a4",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "drivers/md/dm-cache-target.c",
"function": "cache_preresume"
},
"digest": {
"function_hash": "52577733709285334035338138444922483142",
"length": 1083.0
},
"id": "CVE-2024-50278-93199671",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c0ade5d98979585d4f5a93e4514c2e9a65afa08d",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "drivers/md/dm-cache-target.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"148335881802719856447914845660899903063",
"254561610284056148013630640949551142157",
"283400542004366593154958787587428788462",
"283138398671710663188641676537294576593",
"175362949799747210507768095876434737345",
"226624021783298083280436356246744271364",
"58907390633272775058869240502182512822",
"32498917870380453524604975699314482452",
"52360737605491614329290960147889960070",
"137459316683004706337650291893761974586",
"274919317766558116658355993114020918770",
"192812816469337728141562992597315943863",
"157111822061546573780078055486156618094",
"294032682950721479695235641760787959920",
"298332339784775304380521800621046534975",
"270524573032897758986864339805129737291",
"105135349804760838859480469610730392589",
"240733255160186569668577817304227168535",
"291227253462334487705968119802408487225",
"269792584968551618609246284194573452789",
"302569091425696028370952345120359493956",
"270838765581324321489922627242877803666",
"112414972509558789460890822969403132804",
"147847668120231576682451523489013260608",
"152876596742004354704436231707028265708",
"141844947879248088657995942021151575883",
"61741372326502031287230868445257602759",
"92582561455118319797646093777223380525",
"87324117921475263414054905525324168216",
"146695415448347332018185010837212624891",
"95750101748958451962539836165530509690"
]
},
"id": "CVE-2024-50278-a689f0e5",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c0ade5d98979585d4f5a93e4514c2e9a65afa08d",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "drivers/md/dm-cache-target.c",
"function": "cache_preresume"
},
"digest": {
"function_hash": "52577733709285334035338138444922483142",
"length": 1083.0
},
"id": "CVE-2024-50278-c7259beb",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c52ec00cb2f9bebfada22edcc0db385b910a1cdb",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "drivers/md/dm-cache-target.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"148335881802719856447914845660899903063",
"254561610284056148013630640949551142157",
"283400542004366593154958787587428788462",
"283138398671710663188641676537294576593",
"175362949799747210507768095876434737345",
"226624021783298083280436356246744271364",
"58907390633272775058869240502182512822",
"32498917870380453524604975699314482452",
"52360737605491614329290960147889960070",
"137459316683004706337650291893761974586",
"274919317766558116658355993114020918770",
"192812816469337728141562992597315943863",
"157111822061546573780078055486156618094",
"294032682950721479695235641760787959920",
"298332339784775304380521800621046534975",
"270524573032897758986864339805129737291",
"105135349804760838859480469610730392589",
"240733255160186569668577817304227168535",
"291227253462334487705968119802408487225",
"269792584968551618609246284194573452789",
"302569091425696028370952345120359493956",
"270838765581324321489922627242877803666",
"112414972509558789460890822969403132804",
"147847668120231576682451523489013260608",
"152876596742004354704436231707028265708",
"141844947879248088657995942021151575883",
"61741372326502031287230868445257602759",
"92582561455118319797646093777223380525",
"87324117921475263414054905525324168216",
"146695415448347332018185010837212624891",
"95750101748958451962539836165530509690"
]
},
"id": "CVE-2024-50278-ea50e75e",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c52ec00cb2f9bebfada22edcc0db385b910a1cdb",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "drivers/md/dm-cache-target.c",
"function": "can_resize"
},
"digest": {
"function_hash": "165830554838524711495239001326735306298",
"length": 577.0
},
"id": "CVE-2024-50278-f87d9f5c",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fdef3b94dfebd57e3077a578b6e309a2bb6fa688",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "drivers/md/dm-cache-target.c",
"function": "cache_preresume"
},
"digest": {
"function_hash": "52577733709285334035338138444922483142",
"length": 1083.0
},
"id": "CVE-2024-50278-f9d29a1e",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e492f71854ce03474d49e87fd98b8df1f7cd1d2d",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "drivers/md/dm-cache-target.c",
"function": "can_resize"
},
"digest": {
"function_hash": "165830554838524711495239001326735306298",
"length": 577.0
},
"id": "CVE-2024-50278-fd4c46e9",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c0ade5d98979585d4f5a93e4514c2e9a65afa08d",
"signature_version": "v1"
}
]