CVE-2024-45023

Severity CVSS v4.0:
Pending analysis
Type:
CWE-787 Out-of-bounds Write
Publication date:
11/09/2024
Last modified:
13/09/2024

Description

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> md/raid1: Fix data corruption for degraded array with slow disk<br /> <br /> read_balance() will avoid reading from slow disks as much as possible,<br /> however, if valid data only lands in slow disks, and a new normal disk<br /> is still in recovery, unrecovered data can be read:<br /> <br /> raid1_read_request<br /> read_balance<br /> raid1_should_read_first<br /> -&gt; return false<br /> choose_best_rdev<br /> -&gt; normal disk is not recovered, return -1<br /> choose_bb_rdev<br /> -&gt; missing the checking of recovery, return the normal disk<br /> -&gt; read unrecovered data<br /> <br /> Root cause is that the checking of recovery is missing in<br /> choose_bb_rdev(). Hence add such checking to fix the problem.<br /> <br /> Also fix similar problem in choose_slow_rdev().

Vulnerable products and versions

CPE From Up to
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 6.9 (including) 6.10.7 (excluding)
cpe:2.3:o:linux:linux_kernel:6.11:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.11:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.11:rc3:*:*:*:*:*:*