CVE-2024-35787 md/md-bitmap: fix incorrect usage for sb_index
A logic error in the Linux kernel's md-bitmap module causes crashes in clustered environments due to incorrect slot offset handling.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-35787?
CVE-2024-35787 is a high-severity vulnerability in Linux kernel, published on 17 May 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
md/md-bitmap: fix incorrect usage for sb_index
Commit d7038f951828 ("md-bitmap: don't use ->index for pages backing the bitmap file") removed page->index from bitmap code, but left wrong code logic for clustered-md. current code never set slot offset for cluster nodes, will sometimes cause crash in clustered env.
Call trace (partly): md_bitmap_file_set_bit+0x110/0x1d8 [md_mod] md_bitmap_startwrite+0x13c/0x240 [md_mod] raid1_make_request+0x6b0/0x1c08 [raid1] md_handle_request+0x1dc/0x368 [md_mod] md_submit_bio+0x80/0xf8 [md_mod] __submit_bio+0x178/0x300 submit_bio_noacct_nocheck+0x11c/0x338 submit_bio_noacct+0x134/0x614 submit_bio+0x28/0xdc submit_bh_wbc+0x130/0x1cc submit_bh+0x1c/0x28
Which versions are affected by CVE-2024-35787?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-35787?
Apply the vendor's patch.
Is CVE-2024-35787 being exploited?
There is no known exploitation of CVE-2024-35787 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2024-35787, DEBIAN-CVE-2024-35787, GHSA-5xh2-79x5-2x6c, UBUNTU-CVE-2024-35787.