Log in Start free

Vulnerability · Published May 1, 2024 · Assigned by Linux

CVE-2024-27069ovl: relax WARN_ON in ovl_verify_area()

Medium 5.5

In plain English

A medium-severity security flaw in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)5.5Medium
Exploit odds (30 days)0.2%top 90.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In the Linux kernel, the following vulnerability has been resolved: ovl: relax WARN_ON in ovl_verify_area() syzbot hit an assertion in copy up data loop which looks like it is the result of a lower file whose size is being changed underneath overlayfs. This type of use case is documented to cause undefined behavior, so returning EIO error for the copy up makes sense, but it should not be causing a WARN_ON assertion.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Ubuntu:24.04:LTSlinux6.8.0-35.35UBUNTU-CVE-2024-27069
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2024-27069
Ubuntu:24.04:LTSlinux-aws6.8.0-1009.9UBUNTU-CVE-2024-27069
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2024-27069
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2024-27069
Ubuntu:24.04:LTSlinux-azure6.8.0-1008.8UBUNTU-CVE-2024-27069
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2024-27069
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2024-27069
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2024-27069
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2024-27069
Ubuntu:24.04:LTSlinux-gcp6.8.0-1008.9UBUNTU-CVE-2024-27069
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2024-27069
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2024-27069
Ubuntu:24.04:LTSlinux-gke6.8.0-1004.7UBUNTU-CVE-2024-27069
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2024-27069
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2024-27069
Ubuntu:24.04:LTSlinux-ibm6.8.0-1006.6UBUNTU-CVE-2024-27069
Ubuntu:22.04:LTSlinux-intel-iot-realtimeno fix listedUBUNTU-CVE-2024-27069
Ubuntu:24.04:LTSlinux-lowlatency6.8.0-35.35.1UBUNTU-CVE-2024-27069
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2024-27069
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2024-27069
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2024-27069
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2024-27069
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2024-27069
Ubuntu:22.04:LTSlinux-oem-6.1no fix listedUBUNTU-CVE-2024-27069
Ubuntu:24.04:LTSlinux-oem-6.86.8.0-1006.6UBUNTU-CVE-2024-27069
Ubuntu:24.04:LTSlinux-oracle6.8.0-1006.6UBUNTU-CVE-2024-27069
Ubuntu:24.04:LTSlinux-raspi6.8.0-1005.5UBUNTU-CVE-2024-27069
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2024-27069
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2024-27069
Ubuntu:24.04:LTSlinux-riscv6.8.0-35.35.1UBUNTU-CVE-2024-27069
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2024-27069
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2024-27069
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2024-27069

Affected products (as reported)

VendorProductVersions
Linux Linux ca7ab482401cf0a7497dad05f4918dc64115538b – before c3c85aefc0da1e5074a06c682542a54ccc99bdcaca7ab482401cf0a7497dad05f4918dc64115538b – before 77a28aa476873048024ad56daf8f4f17d58ee48e
Linux Linux 6.8

References