Junglewise Threat Intelligence

CVE-2024-26880: Linux Kernel list corruption in Device Mapper internal suspend

CVE-2024-26880 · Severity: medium · CVSS 5.5 · Published 2024-04-17

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's Device Mapper component can cause a system crash. This component is responsible for managing storage devices, such as those used in LVM2 (Logical Volume Manager). An exploit could lead to a complete denial of service, impacting system availability and operations.

Technical details

A vulnerability in the Linux kernel Device Mapper (DM) arises from the incorrect pairing of 'postsuspend' and 'resume' methods during internal suspend operations. Specifically, consecutive calls to 'origin_postsuspend' occur without an intervening resume, causing the system to attempt to remove a 'hash_list' entry that has already been removed. This results in kernel list corruption and a subsequent kernel BUG (invalid opcode) at lib/list_debug.c. The fix ensures that '__dm_internal_resume' correctly invokes the 'preresume' and 'resume' methods of the table's targets. If 'preresume' fails, the system now fakes a normal suspend state to maintain method pairing and prevent the crash.

Affected products

  • Linux Linux Kernel 3.19 to 4.19.311, 4.20 to 5.4.273, 5.5 to 5.10.214, 5.11 to 5.15.153, 5.16 to 6.1.83, 6.2 to 6.6.23, 6.7 to 6.7.11, 6.8 to 6.8.2

Timeline

  • 2024-03-11: patched: Initial fix authored by Mikulas Patocka
  • 2024-04-17: advisory: CVE-2024-26880 published

References

Related threats