CVE-2024-26764 fs/aio: Restrict kiocb_set_cancel_fn() to I/O submitted via libaio
A local attacker can trigger a kernel warning and potential instability by submitting specific I/O operations via io_uring, requiring a kernel patch.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-26764?
CVE-2024-26764 is a low-severity denial of service vulnerability in Debian Debian Linux, published on 3 Apr 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
fs/aio: Restrict kiocb_set_cancel_fn() to I/O submitted via libaio
If kiocb_set_cancel_fn() is called for I/O submitted via io_uring, the following kernel warning appears:
WARNING: CPU: 3 PID: 368 at fs/aio.c:598 kiocb_set_cancel_fn+0x9c/0xa8 Call trace: kiocb_set_cancel_fn+0x9c/0xa8 ffs_epfile_read_iter+0x144/0x1d0 io_read+0x19c/0x498 io_issue_sqe+0x118/0x27c io_submit_sqes+0x25c/0x5fc __arm64_sys_io_uring_enter+0x104/0xab0 invoke_syscall+0x58/0x11c el0_svc_common+0xb4/0xf4 do_el0_svc+0x2c/0xb0 el0_svc+0x2c/0xa4 el0t_64_sync_handler+0x68/0xb4 el0t_64_sync+0x1a4/0x1a8
Fix this by setting the IOCB_AIO_RW flag for read and write I/O that is submitted by libaio.
Which versions are affected by CVE-2024-26764?
It affects 2 products.
Products include Debian Debian Linux, Linux kernel.
How do I fix CVE-2024-26764?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-26764 being exploited?
There is no known exploitation of CVE-2024-26764 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as BELL-CVE-2024-26764, DEBIAN-CVE-2024-26764, GHSA-6fm7-55mm-8gfh, UBUNTU-CVE-2024-26764.