In the Linux kernel, the following vulnerability has been resolved:
dm cache: fix potential out-of-bounds access on the first resume
Out-of-bounds access occurs if the fast device is expanded unexpectedly before the first-time resume of the cache table. This happens because expanding the fast device requires reloading the cache table for cachecreate to allocate new in-core data structures that fit the new size, and the check in cachepreresume is not performed during the first resume, leading to the issue.
Reproduce steps:
dmsetup create cmeta --table "0 8192 linear /dev/sdc 0" dmsetup create cdata --table "0 65536 linear /dev/sdc 8192" dmsetup create corig --table "0 524288 linear /dev/sdc 262144" dd if=/dev/zero of=/dev/mapper/cmeta bs=4k count=1 oflag=direct
dmsetup create cache --notable dmsetup reload cache --table "0 524288 cache /dev/mapper/cmeta \ /dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 writethrough smq 0" dmsetup reload cdata --table "0 131072 linear /dev/sdc 8192" dmsetup resume cdata dmsetup resume cache
dmsetup suspend cache
KASAN reports:
BUG: KASAN: vmalloc-out-of-bounds in isdirtycallback+0x2b/0x80 Read of size 8 at addr ffffc90000085040 by task dmsetup/90
(...snip...) The buggy address belongs to the virtual mapping at [ffffc90000085000, ffffc90000087000) created by: cache_ctr+0x176a/0x35f0
(...snip...) Memory state around the buggy address: ffffc90000084f00: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 ffffc90000084f80: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
ffffc90000085000: 00 00 00 00 00 00 00 00 f8 f8 f8 f8 f8 f8 f8 f8 ^ ffffc90000085080: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 ffffc90000085100: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
Fix by checking the size change on the first resume.
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/50xxx/CVE-2024-50278.json"
}"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-50278.json"
[
{
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@036dd6e3d2638103e0092864577ea1d091466b86",
"id": "CVE-2024-50278-3cd5f1b7",
"deprecated": false,
"target": {
"file": "drivers/md/dm-cache-target.c"
},
"signature_version": "v1",
"digest": {
"line_hashes": [
"148335881802719856447914845660899903063",
"254561610284056148013630640949551142157",
"283400542004366593154958787587428788462",
"283138398671710663188641676537294576593",
"175362949799747210507768095876434737345",
"226624021783298083280436356246744271364",
"58907390633272775058869240502182512822",
"32498917870380453524604975699314482452",
"52360737605491614329290960147889960070",
"137459316683004706337650291893761974586",
"274919317766558116658355993114020918770",
"192812816469337728141562992597315943863",
"157111822061546573780078055486156618094",
"294032682950721479695235641760787959920",
"298332339784775304380521800621046534975",
"270524573032897758986864339805129737291",
"105135349804760838859480469610730392589",
"240733255160186569668577817304227168535",
"291227253462334487705968119802408487225",
"269792584968551618609246284194573452789",
"302569091425696028370952345120359493956",
"270838765581324321489922627242877803666",
"112414972509558789460890822969403132804",
"147847668120231576682451523489013260608",
"152876596742004354704436231707028265708",
"141844947879248088657995942021151575883",
"61741372326502031287230868445257602759",
"92582561455118319797646093777223380525",
"87324117921475263414054905525324168216",
"146695415448347332018185010837212624891",
"95750101748958451962539836165530509690"
],
"threshold": 0.9
}
},
{
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@036dd6e3d2638103e0092864577ea1d091466b86",
"id": "CVE-2024-50278-44b50b0f",
"deprecated": false,
"target": {
"function": "cache_preresume",
"file": "drivers/md/dm-cache-target.c"
},
"signature_version": "v1",
"digest": {
"length": 1083.0,
"function_hash": "52577733709285334035338138444922483142"
}
},
{
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@036dd6e3d2638103e0092864577ea1d091466b86",
"id": "CVE-2024-50278-735bc728",
"deprecated": false,
"target": {
"function": "can_resize",
"file": "drivers/md/dm-cache-target.c"
},
"signature_version": "v1",
"digest": {
"length": 577.0,
"function_hash": "165830554838524711495239001326735306298"
}
}
]