git.kernel.org
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git CVE-2024-38384
HIGH
blk-cgroup: fix list corruption from reorder of WRITE ->lqueued
Record summary
CVE-2024-38384 has a selected CVSS score of 7.8 (high).
Description
In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: fix list corruption from reorder of WRITE ->lqueued __blkcg_rstat_flush() can be run anytime, especially when blk_cgroup_bio_start is being executed. If WRITE of `->lqueued` is re-ordered with READ of 'bisc->lnode.next' in the loop of __blkcg_rstat_flush(), `next_bisc` can be assigned with one stat instance being added in blk_cgroup_bio_start(), then the local list in __blkcg_rstat_flush() could be corrupted. Fix the issue by adding one barrier.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationNone
AutomatableNo
Technical impactTotal
CISA Coordinator · SSVC 2.0.3 · Evaluated Jun 25, 2024 · Source: CVE List
Affected products and versions
3| Product | Source | Version range | Status |
|---|---|---|---|
LinuxBrowse Linux / LinuxDefault status: unaffected, affected | CVE List | 3b8cc6298724021da845f2f9fd7dd4b6829a6817 to < 714e59b5456e4d6e4295a9968c564abe193f461c | affected |
| 3b8cc6298724021da845f2f9fd7dd4b6829a6817 to < 785298ab6b802afa75089239266b6bbea590809c | affected | ||
| 3b8cc6298724021da845f2f9fd7dd4b6829a6817 to < d0aac2363549e12cc79b8e285f13d5a9f42fd08e | affected | ||
| 6.2 | affected | ||
| Before 6.2 | unaffected | ||
| 6.6.33 to ≤ 6.6.* | unaffected | ||
| 6.9.4 to ≤ 6.9.* | unaffected | ||
| 6.10 to ≤ * | unaffected | ||
linux_kernelBrowse linux / linux_kernelDefault status: unknown | CVE List | 3b8cc6298724 to < 714e59b5456e | affected |
| 3b8cc6298724 to < 785298ab6b80 | affected | ||
| 3b8cc6298724 to < d0aac2363549 | affected | ||
| 6.2 | affected | ||
| Before 6.2 | unaffected | ||
| 6.6.33 to ≤ 6.7 | unaffected | ||
| 6.9.4 to ≤ 6.10 | unaffected | ||
| 6.10-rc1 | unaffected | ||
KernelBrowse Linux / Kernel | OSV | 6.2.0 to < 6.6.33 · Fixed in 6.6.33 | affected |
| 6.7.0 to < 6.9.4 · Fixed in 6.9.4 | affected |
References
6git.kernel.org
https://git.kernel.org/stable/c/714e59b5456e4d6e4295a9968c564abe193f461c git.kernel.org
https://git.kernel.org/stable/c/785298ab6b802afa75089239266b6bbea590809c git.kernel.org
https://git.kernel.org/stable/c/d0aac2363549e12cc79b8e285f13d5a9f42fd08e github.com
https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/38xxx/CVE-2024-38384.json nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2024-38384