Executive brief
A vulnerability in the Linux kernel's RAID management system can cause a system to freeze or become unresponsive (soft lockup) during storage synchronization tasks. This occurs when a storage array is resized or synchronized while using specific RAID configurations. An attacker or a system error could trigger this state, leading to a denial of service that disrupts business operations and data availability.
Technical details
A regression in the Linux kernel's MD (Multiple Device) driver, specifically within the RAID10 implementation, causes a soft lockup during resync operations. The root cause is located in 'md_bitmap_get_counter()', which was modified in a previous commit to return early without properly setting the 'blocks' return value. When 'md_do_sync' calls 'raid10_sync_request', the lack of updated block counts results in an infinite loop where the sector offset 'j' never increments. This vulnerability is triggered during 'dm-raid10' operations such as 'lvextend' followed by a sync action. Patches have been released across multiple stable kernel branches to ensure 'blocks' is always initialized.
Affected products
- Linux Linux Kernel 4.19.291 to 4.19.316, 5.4.251 to 5.4.278, 5.10.188 to 5.10.219, 5.15.121 to 5.15.161, 6.1.39 to 6.1.93, 6.5 to 6.6.33, 6.7 to 6.8.12, 6.9 to 6.9.3
Timeline
- 2024-06-19: advisory: CVE published by NVD
- 2024-06-16: patched: Fixes committed to various stable kernel trees
References
- https://git.kernel.org/stable/c/3f5b73ef8fd6268cbc968b308d8eafe56fda97f3
- https://git.kernel.org/stable/c/43771597feba89a839c5f893716df88ae5c237ce
- https://git.kernel.org/stable/c/5817f43ae1a118855676f57ef7ab50e37eac7482
- https://git.kernel.org/stable/c/69296914bfd508c85935bf5f711cad9b0fe78492
- https://git.kernel.org/stable/c/71e8e4f288e74a896b6d9cd194f3bab12bd7a10f
- https://git.kernel.org/stable/c/8bbc71315e0ae4bb7e37f8d43b915e1cb01a481b
- https://git.kernel.org/stable/c/c9566b812c8f66160466cc1e29df6d3646add0b1