CVE-2024-45026

Severity CVSS v4.0:
Pending analysis
Type:
CWE-787 Out-of-bounds Write
Publication date:
11/09/2024
Last modified:
03/11/2025

Description

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> s390/dasd: fix error recovery leading to data corruption on ESE devices<br /> <br /> Extent Space Efficient (ESE) or thin provisioned volumes need to be<br /> formatted on demand during usual IO processing.<br /> <br /> The dasd_ese_needs_format function checks for error codes that signal<br /> the non existence of a proper track format.<br /> <br /> The check for incorrect length is to imprecise since other error cases<br /> leading to transport of insufficient data also have this flag set.<br /> This might lead to data corruption in certain error cases for example<br /> during a storage server warmstart.<br /> <br /> Fix by removing the check for incorrect length and replacing by<br /> explicitly checking for invalid track format in transport mode.<br /> <br /> Also remove the check for file protected since this is not a valid<br /> ESE handling case.

Vulnerable products and versions

CPE From Up to
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 5.3 (including) 5.4.283 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 5.5 (including) 5.10.225 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 5.11 (including) 5.15.166 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 5.16 (including) 6.1.107 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 6.2 (including) 6.6.48 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 6.7 (including) 6.10.7 (excluding)
cpe:2.3:o:linux:linux_kernel:6.11:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.11:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.11:rc3:*:*:*:*:*:*