CVE-2024-45023
Severity CVSS v4.0:
Pending analysis
Type:
CWE-787
Out-of-bounds Write
Publication date:
11/09/2024
Last modified:
13/09/2024
Description
In the Linux kernel, the following vulnerability has been resolved:<br />
<br />
md/raid1: Fix data corruption for degraded array with slow disk<br />
<br />
read_balance() will avoid reading from slow disks as much as possible,<br />
however, if valid data only lands in slow disks, and a new normal disk<br />
is still in recovery, unrecovered data can be read:<br />
<br />
raid1_read_request<br />
read_balance<br />
raid1_should_read_first<br />
-> return false<br />
choose_best_rdev<br />
-> normal disk is not recovered, return -1<br />
choose_bb_rdev<br />
-> missing the checking of recovery, return the normal disk<br />
-> read unrecovered data<br />
<br />
Root cause is that the checking of recovery is missing in<br />
choose_bb_rdev(). Hence add such checking to fix the problem.<br />
<br />
Also fix similar problem in choose_slow_rdev().
Impact
Base Score 3.x
7.10
Severity 3.x
HIGH
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 6.9 (including) | 6.10.7 (excluding) |
| cpe:2.3:o:linux:linux_kernel:6.11:rc1:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:6.11:rc2:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:6.11:rc3:*:*:*:*:*:* |
To consult the complete list of CPE names with products and versions, see this page



