Executive brief
A vulnerability exists in the Linux kernel's RAID storage management system, which is used to manage multiple hard drives for data redundancy and performance. An attacker could exploit this flaw to cause a system crash or potentially gain unauthorized access to data. This affects various Linux-based systems, including industrial automation components like the Siemens SIMATIC S7-1500.
Technical details
An integer overflow or wraparound vulnerability exists in the raid5_cache_count() function within the Linux kernel's md/raid5 modules. The root cause is a race condition between raid5_cache_count() and raid5_set_cache_size(), where concurrent execution can lead to inconsistent reads of 'max_nr_stripes' and 'min_nr_stripes'. If 'min_nr_stripes' exceeds 'max_nr_stripes' due to an intermediate update, the subtraction results in an overflow. While some sources categorize this as requiring high privileges over a network, NIST identifies it as a local vector (AV:L) with high impact on confidentiality, integrity, and availability. Patches have been released for various kernel branches including 6.1.84, 6.6.24, 6.7.12, and 6.8.3.
Affected products
- Linux Linux Kernel 4.1 to 6.7.2; 6.1.84; 6.6.24; 6.7.12; 6.8.3
- Siemens SIMATIC S7-1500 TM MFP GNU/Linux subsystem All versions
Timeline
- 2024-01-12: patched: Patch submitted to Linux RAID mailing list
- 2024-01-25: disclosed: Initial CVE publication
- 2024-04-09: advisory: Siemens published advisory SSA-265688 including this CVE