CVE-2024-50278

dm cache: fix potential out-of-bounds access on the first resume

State: Published
Severity: 7.1 High
Published: Nov 19, 2024
Updated: May 11, 2026
Reserved: Oct 21, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

dm cache: fix potential out-of-bounds access on the first resume

Out-of-bounds access occurs if the fast device is expanded unexpectedly before the first-time resume of the cache table. This happens because expanding the fast device requires reloading the cache table for cache_create to allocate new in-core data structures that fit the new size, and the check in cache_preresume is not performed during the first resume, leading to the issue.

Reproduce steps:

1. prepare component devices:

dmsetup create cmeta --table "0 8192 linear /dev/sdc 0" dmsetup create cdata --table "0 65536 linear /dev/sdc 8192" dmsetup create corig --table "0 524288 linear /dev/sdc 262144" dd if=/dev/zero of=/dev/mapper/cmeta bs=4k count=1 oflag=direct

2. load a cache table of 512 cache blocks, and deliberately expand the fast device before resuming the cache, making the in-core data structures inadequate.

dmsetup create cache --notable dmsetup reload cache --table "0 524288 cache /dev/mapper/cmeta \ /dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 writethrough smq 0" dmsetup reload cdata --table "0 131072 linear /dev/sdc 8192" dmsetup resume cdata dmsetup resume cache

3. suspend the cache to write out the in-core dirty bitset and hint array, leading to out-of-bounds access to the dirty bitset at offset 0x40:

dmsetup suspend cache

KASAN reports:

BUG: KASAN: vmalloc-out-of-bounds in is_dirty_callback+0x2b/0x80 Read of size 8 at addr ffffc90000085040 by task dmsetup/90

(...snip...) The buggy address belongs to the virtual mapping at [ffffc90000085000, ffffc90000087000) created by: cache_ctr+0x176a/0x35f0

(...snip...) Memory state around the buggy address: ffffc90000084f00: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 ffffc90000084f80: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 >ffffc90000085000: 00 00 00 00 00 00 00 00 f8 f8 f8 f8 f8 f8 f8 f8 ^ ffffc90000085080: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 ffffc90000085100: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8

Fix by checking the size change on the first resume.

Scores

CVSS	Score	Vector	Source
3.1	7.1 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H	CISA-ADP

Weaknesses

CWE-125 Out-of-bounds Read

Affected Products

Product	Versions
LinuxLinux	f494a9c6b1b6dd9a9f21bbb75d9210d478eeb498 to before e492f71854ce03474d49e87fd98b8df1f7cd1d2dAffected f494a9c6b1b6dd9a9f21bbb75d9210d478eeb498 to before 2222b0929d00e2d13732b799b63be391b5de4492Affected f494a9c6b1b6dd9a9f21bbb75d9210d478eeb498 to before 483b7261b35a9d369082ab298a6670912243f0beAffected f494a9c6b1b6dd9a9f21bbb75d9210d478eeb498 to before fdef3b94dfebd57e3077a578b6e309a2bb6fa688Affected f494a9c6b1b6dd9a9f21bbb75d9210d478eeb498 to before c52ec00cb2f9bebfada22edcc0db385b910a1cdbAffected f494a9c6b1b6dd9a9f21bbb75d9210d478eeb498 to before 036dd6e3d2638103e0092864577ea1d091466b86Affected f494a9c6b1b6dd9a9f21bbb75d9210d478eeb498 to before 13ed3624c6ef283acefa4cc42cc8ae54fd4391a4Affected f494a9c6b1b6dd9a9f21bbb75d9210d478eeb498 to before c0ade5d98979585d4f5a93e4514c2e9a65afa08dAffected
LinuxLinux	3.13Affected before 3.13Not affected 4.19.324 through 4.19.Not affected 5.4.286 through 5.4.Not affected 5.10.230 through 5.10.Not affected 5.15.172 through 5.15.Not affected 6.1.117 through 6.1.Not affected 6.6.61 through 6.6.Not affected 6.11.8 through 6.11.*Not affected 6.12 and laterNot affected

Product

Versions

LinuxLinux

f494a9c6b1b6dd9a9f21bbb75d9210d478eeb498 to before e492f71854ce03474d49e87fd98b8df1f7cd1d2dAffected
f494a9c6b1b6dd9a9f21bbb75d9210d478eeb498 to before 2222b0929d00e2d13732b799b63be391b5de4492Affected
f494a9c6b1b6dd9a9f21bbb75d9210d478eeb498 to before 483b7261b35a9d369082ab298a6670912243f0beAffected
f494a9c6b1b6dd9a9f21bbb75d9210d478eeb498 to before fdef3b94dfebd57e3077a578b6e309a2bb6fa688Affected
f494a9c6b1b6dd9a9f21bbb75d9210d478eeb498 to before c52ec00cb2f9bebfada22edcc0db385b910a1cdbAffected
f494a9c6b1b6dd9a9f21bbb75d9210d478eeb498 to before 036dd6e3d2638103e0092864577ea1d091466b86Affected
f494a9c6b1b6dd9a9f21bbb75d9210d478eeb498 to before 13ed3624c6ef283acefa4cc42cc8ae54fd4391a4Affected
f494a9c6b1b6dd9a9f21bbb75d9210d478eeb498 to before c0ade5d98979585d4f5a93e4514c2e9a65afa08dAffected

LinuxLinux

3.13Affected
before 3.13Not affected
4.19.324 through 4.19.*Not affected
5.4.286 through 5.4.*Not affected
5.10.230 through 5.10.*Not affected
5.15.172 through 5.15.*Not affected
6.1.117 through 6.1.*Not affected
6.6.61 through 6.6.*Not affected
6.11.8 through 6.11.*Not affected
6.12 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.