CVE-2024-50250

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

fsdax: dax_unshare_iter needs to copy entire blocks

The code that copies data from srcmap to iomap in dax_unshare_iter is

very very broken, which bfoster's recent fsx changes have exposed.

If the pos and len passed to dax_file_unshare are not aligned to an

fsblock boundary, the iter pos and length in the _iter function will

reflect this unalignment.

dax_iomap_direct_access always returns a pointer to the start of the

kmapped fsdax page, even if its pos argument is in the middle of that

page. This is catastrophic for data integrity when iter->pos is not

aligned to a page, because daddr/saddr do not point to the same byte in

the file as iter->pos. Hence we corrupt user data by copying it to the

wrong place.

If iter->pos + iomap_length() in the _iter function not aligned to a

page, then we fail to copy a full block, and only partially populate the

destination block. This is catastrophic for data confidentiality

be

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References