CVE-2024-50279

dm cache: fix out-of-bounds access to the dirty bitset when resizing

State: Published
Severity: 7.1 High
Published: Nov 19, 2024
Updated: May 11, 2026
Reserved: Oct 21, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

dm cache: fix out-of-bounds access to the dirty bitset when resizing

dm-cache checks the dirty bits of the cache blocks to be dropped when shrinking the fast device, but an index bug in bitset iteration causes out-of-bounds access.

Reproduce steps:

1. create a cache device of 1024 cache blocks (128 bytes dirty bitset)

dmsetup create cmeta --table "0 8192 linear /dev/sdc 0" dmsetup create cdata --table "0 131072 linear /dev/sdc 8192" dmsetup create corig --table "0 524288 linear /dev/sdc 262144" dd if=/dev/zero of=/dev/mapper/cmeta bs=4k count=1 oflag=direct dmsetup create cache --table "0 524288 cache /dev/mapper/cmeta \ /dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 writethrough smq 0"

2. shrink the fast device to 512 cache blocks, triggering out-of-bounds access to the dirty bitset (offset 0x80)

dmsetup suspend cache dmsetup reload cdata --table "0 65536 linear /dev/sdc 8192" dmsetup resume cdata dmsetup resume cache

KASAN reports:

BUG: KASAN: vmalloc-out-of-bounds in cache_preresume+0x269/0x7b0 Read of size 8 at addr ffffc900000f3080 by task dmsetup/131

(...snip...) The buggy address belongs to the virtual mapping at [ffffc900000f3000, ffffc900000f5000) created by: cache_ctr+0x176a/0x35f0

(...snip...) Memory state around the buggy address: ffffc900000f2f80: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 ffffc900000f3000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffffc900000f3080: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 ^ ffffc900000f3100: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 ffffc900000f3180: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8

Fix by making the index post-incremented.

Scores

CVSS	Score	Vector	Source
3.1	7.1 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H	CISA-ADP

Weaknesses

CWE-125 Out-of-bounds Read

Affected Products

Product	Versions
LinuxLinux	f494a9c6b1b6dd9a9f21bbb75d9210d478eeb498 to before 4fa4feb873cea0e9d6ff883b37cca6f33169d8b4Affected f494a9c6b1b6dd9a9f21bbb75d9210d478eeb498 to before 8501e38dc9e0060814c4085815fc83da3e6d43bfAffected f494a9c6b1b6dd9a9f21bbb75d9210d478eeb498 to before ee1f74925717ab36f6a091104c170639501ce818Affected f494a9c6b1b6dd9a9f21bbb75d9210d478eeb498 to before ff1dd8a04c30e8d4e2fd5c83198ca672eb6a9e7fAffected f494a9c6b1b6dd9a9f21bbb75d9210d478eeb498 to before 56507203e1b6127967ec2b51fb0b23a0d4af1334Affected f494a9c6b1b6dd9a9f21bbb75d9210d478eeb498 to before e57648ce325fa405fe6bbd0e6a618ced7c301a2dAffected f494a9c6b1b6dd9a9f21bbb75d9210d478eeb498 to before 3b02c40ff10fdf83cc545850db208de855ebe22cAffected f494a9c6b1b6dd9a9f21bbb75d9210d478eeb498 to before 792227719725497ce10a8039803bec13f89f8910Affected
LinuxLinux	3.13Affected before 3.13Not affected 4.19.324 through 4.19.Not affected 5.4.286 through 5.4.Not affected 5.10.230 through 5.10.Not affected 5.15.172 through 5.15.Not affected 6.1.117 through 6.1.Not affected 6.6.61 through 6.6.Not affected 6.11.8 through 6.11.*Not affected 6.12 and laterNot affected

Product

Versions

LinuxLinux

f494a9c6b1b6dd9a9f21bbb75d9210d478eeb498 to before 4fa4feb873cea0e9d6ff883b37cca6f33169d8b4Affected
f494a9c6b1b6dd9a9f21bbb75d9210d478eeb498 to before 8501e38dc9e0060814c4085815fc83da3e6d43bfAffected
f494a9c6b1b6dd9a9f21bbb75d9210d478eeb498 to before ee1f74925717ab36f6a091104c170639501ce818Affected
f494a9c6b1b6dd9a9f21bbb75d9210d478eeb498 to before ff1dd8a04c30e8d4e2fd5c83198ca672eb6a9e7fAffected
f494a9c6b1b6dd9a9f21bbb75d9210d478eeb498 to before 56507203e1b6127967ec2b51fb0b23a0d4af1334Affected
f494a9c6b1b6dd9a9f21bbb75d9210d478eeb498 to before e57648ce325fa405fe6bbd0e6a618ced7c301a2dAffected
f494a9c6b1b6dd9a9f21bbb75d9210d478eeb498 to before 3b02c40ff10fdf83cc545850db208de855ebe22cAffected
f494a9c6b1b6dd9a9f21bbb75d9210d478eeb498 to before 792227719725497ce10a8039803bec13f89f8910Affected

LinuxLinux

3.13Affected
before 3.13Not affected
4.19.324 through 4.19.*Not affected
5.4.286 through 5.4.*Not affected
5.10.230 through 5.10.*Not affected
5.15.172 through 5.15.*Not affected
6.1.117 through 6.1.*Not affected
6.6.61 through 6.6.*Not affected
6.11.8 through 6.11.*Not affected
6.12 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.