Log in Start free

Vulnerability · Published May 17, 2024 · Assigned by Linux

CVE-2024-35787md/md-bitmap: fix incorrect usage for sb_index

High 7.8

In plain English

A high-severity security flaw in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.2%top 86.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In the Linux kernel, the following vulnerability has been resolved: md/md-bitmap: fix incorrect usage for sb_index Commit d7038f951828 ("md-bitmap: don't use ->index for pages backing the bitmap file") removed page->index from bitmap code, but left wrong code logic for clustered-md. current code never set slot offset for cluster nodes, will sometimes cause crash in clustered env. Call trace (partly): md_bitmap_file_set_bit+0x110/0x1d8 [md_mod] md_bitmap_startwrite+0x13c/0x240 [md_mod] raid1_make_request+0x6b0/0x1c08 [raid1] md_handle_request+0x1dc/0x368 [md_mod] md_submit_bio+0x80/0xf8 [md_mod] __submit_bio+0x178/0x300 submit_bio_noacct_nocheck+0x11c/0x338 submit_bio_noacct+0x134/0x614 submit_bio+0x28/0xdc submit_bh_wbc+0x130/0x1cc submit_bh+0x1c/0x28

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:13linux6.7.12-1DEBIAN-CVE-2024-35787
Debian:14linux6.7.12-1DEBIAN-CVE-2024-35787
Ubuntu:24.04:LTSlinux6.8.0-35.35UBUNTU-CVE-2024-35787
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2024-35787
Ubuntu:24.04:LTSlinux-aws6.8.0-1009.9UBUNTU-CVE-2024-35787
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2024-35787
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2024-35787
Ubuntu:24.04:LTSlinux-azure6.8.0-1008.8UBUNTU-CVE-2024-35787
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2024-35787
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2024-35787
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2024-35787
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2024-35787
Ubuntu:24.04:LTSlinux-gcp6.8.0-1008.9UBUNTU-CVE-2024-35787
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2024-35787
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2024-35787
Ubuntu:24.04:LTSlinux-gke6.8.0-1004.7UBUNTU-CVE-2024-35787
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2024-35787
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2024-35787
Ubuntu:24.04:LTSlinux-ibm6.8.0-1006.6UBUNTU-CVE-2024-35787
Ubuntu:22.04:LTSlinux-intel-iot-realtimeno fix listedUBUNTU-CVE-2024-35787
Ubuntu:24.04:LTSlinux-lowlatency6.8.0-35.35.1UBUNTU-CVE-2024-35787
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2024-35787
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2024-35787
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2024-35787
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2024-35787
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2024-35787
Ubuntu:22.04:LTSlinux-oem-6.1no fix listedUBUNTU-CVE-2024-35787
Ubuntu:24.04:LTSlinux-oem-6.86.8.0-1006.6UBUNTU-CVE-2024-35787
Ubuntu:24.04:LTSlinux-oracle6.8.0-1006.6UBUNTU-CVE-2024-35787
Ubuntu:24.04:LTSlinux-raspi6.8.0-1005.5UBUNTU-CVE-2024-35787
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2024-35787
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2024-35787
Ubuntu:24.04:LTSlinux-riscv6.8.0-35.35.1UBUNTU-CVE-2024-35787
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2024-35787
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2024-35787
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2024-35787

Affected products (as reported)

VendorProductVersions
Linux Linux d7038f951828da19fa9aafddfa087b69032c9687 – before 736ad6c577a367834118f57417038d45bb5e0a31d7038f951828da19fa9aafddfa087b69032c9687 – before 55e55eb65fd5e09faf5a0e49ffcdd37905aaf4dad7038f951828da19fa9aafddfa087b69032c9687 – before 5a95815b17428ce2f56ec18da5e0d1b2a1a15240d7038f951828da19fa9aafddfa087b69032c9687 – before ecbd8ebb51bf7e4939d83b9e6022a55cac44ef06
Linux Linux 6.6

References