CVE-2024-35974 block: fix q->blkg_list corruption during disk rebind
A list corruption in the Linux kernel block layer during disk rebind can lead to memory corruption, potentially causing denial of service or code execution.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-35974?
CVE-2024-35974 is a medium-severity memory corruption vulnerability in Linux kernel, published on 20 May 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
block: fix q->blkg_list corruption during disk rebind
Multiple gendisk instances can allocated/added for single request queue in case of disk rebind. blkg may still stay in q->blkg_list when calling blkcg_init_disk() for rebind, then q->blkg_list becomes corrupted.
Fix the list corruption issue by:
- add blkg_init_queue() to initialize q->blkg_list & q->blkcg_mutex only - move calling blkg_init_queue() into blk_alloc_queue()
The list corruption should be started since commit f1c006f1c685 ("blk-cgroup: synchronize pd_free_fn() from blkg_free_workfn() and blkcg_deactivate_policy()") which delays removing blkg from q->blkg_list into blkg_free_workfn().
Which versions are affected by CVE-2024-35974?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-35974?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2024-35974 being exploited?
There is no known exploitation of CVE-2024-35974 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2024-35974, DEBIAN-CVE-2024-35974, GHSA-vpr8-93r8-xj35, ROOT-OS-DEBIAN-12-CVE-2024-35974, UBUNTU-CVE-2024-35974.