CVE-2024-50278

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

dm cache: fix potential out-of-bounds access on the first resume

Out-of-bounds access occurs if the fast device is expanded unexpectedly

before the first-time resume of the cache table. This happens because

expanding the fast device requires reloading the cache table for

cache_create to allocate new in-core data structures that fit the new

size, and the check in cache_preresume is not performed during the

first resume, leading to the issue.

Reproduce steps:

1. prepare component devices:

dmsetup create cmeta --table "0 8192 linear /dev/sdc 0"

dmsetup create cdata --table "0 65536 linear /dev/sdc 8192"

dmsetup create corig --table "0 524288 linear /dev/sdc 262144"

dd if=/dev/zero of=/dev/mapper/cmeta bs=4k count=1 oflag=direct

2. load a cache table of 512 cache blocks, and deliberately expand the

fast device before resuming the cache, making the in-core data

structures inadequate.

dmsetup create cache --nota

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References