In the Linux kernel, the following vulnerability has been resolved:
kyber: fix out of bounds access when preempted
__blk_mq_sched_bio_merge() gets the ctx and hctx for the current CPU and passes the hctx to ->bio_merge(). kyber_bio_merge() then gets the ctx for the current CPU again and uses that to get the corresponding Kyber context in the passed hctx. However, the thread may be preempted between the two calls to blk_mq_get_ctx(), and the ctx returned the second time may no longer correspond to the passed hctx. This "works" accidentally most of the time, but it can cause us to read garbage if the second ctx came from an hctx with more ctx's than the first one (i.e., if ctx->index_hw[hctx->type] > hctx->nr_ctx).
This manifested as this UBSAN array index out of bounds error reported by Jakub:
UBSAN: array-index-out-of-bounds in ../kernel/locking/qspinlock.c:130:9 index 13106 is out of range for type 'long unsigned int [128]' Call Trace: dump_stack+0xa4/0xe5 ubsan_epilogue+0x5/0x40 __ubsan_handle_out_of_bounds.cold.13+0x2a/0x34 queued_spin_lock_slowpath+0x476/0x480 do_raw_spin_lock+0x1c2/0x1d0 kyber_bio_merge+0x112/0x180 blk_mq_submit_bio+0x1f5/0x1100 submit_bio_noacct+0x7b0/0x870 submit_bio+0xc2/0x3a0 btrfs_map_bio+0x4f0/0x9d0 btrfs_submit_data_bio+0x24e/0x310 submit_one_bio+0x7f/0xb0 submit_extent_page+0xc4/0x440 __extent_writepage_io+0x2b8/0x5e0 __extent_writepage+0x28d/0x6e0 extent_write_cache_pages+0x4d7/0x7a0 extent_writepages+0xa2/0x110 do_writepages+0x8f/0x180 __writeback_single_inode+0x99/0x7f0 writeback_sb_inodes+0x34e/0x790 __writeback_inodes_wb+0x9e/0x120 wb_writeback+0x4d2/0x660 wb_workfn+0x64d/0xa10 process_one_work+0x53a/0xa80 worker_thread+0x69/0x5b0 kthread+0x20b/0x240 ret_from_fork+0x1f/0x30
Only Kyber uses the hctx, so fix it by passing the request_queue to ->bio_merge() instead. BFQ and mq-deadline just use that, and Kyber can map the queues itself to avoid the mismatch.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-rt-debug-coreUpgrade kernel-rt-debug-modulesUpgrade kernel-zfcpdump-coreUpgrade kernel-tools-libsUpgrade kernel-cross-headersUpgrade kernel-zfcpdumpUpgrade kernel-debug-modulesUpgrade kernel-tools-libs-develUpgrade kernel-rt-debug-kvmUpgrade kernel-abi-stablelistsUpgrade kernel-zfcpdump-develUpgrade kernel-zfcpdump-modulesUpgrade kernel-coreUpgrade kernel-rt-modules-extraUpgrade kernel-modules-extraUpgrade kernelUpgrade kernel-headersUpgrade kernel-debug-develUpgrade kernel-debug-modules-extraUpgrade kernel-rt-debug-develUpgrade kernel-debug-coreUpgrade kernel-modulesUpgrade kernel-rt-debugUpgrade perfUpgrade kernel-docUpgrade kernel-debugUpgrade kernel-rt-kvmUpgrade kernel-rt-coreUpgrade kernel-toolsUpgrade bpftoolUpgrade kernel-rt-debug-modules-extraUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-rtUpgrade kernel-rt-modulesUpgrade kernel-rt-develUpgrade kernel-develUpgrade python3-perf | Sep 26, 2024 | Feb 28, 2024 |
| Amazon Linux Ami 2 | — | Upgrade perf-debuginfoUpgrade kernel-develUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-tools-debuginfoUpgrade kernel-debuginfoUpgrade kernelUpgrade perfUpgrade kernel-headersUpgrade kernel-tools-develUpgrade bpftool-debuginfoUpgrade python-perfUpgrade bpftoolUpgrade kernel-toolsUpgrade kernel-debuginfo-common-x86_64Upgrade python-perf-debuginfo | Mar 4, 2025 | Feb 28, 2024 |
| Debian | — | Upgrade linux | Jul 30, 2024 | Feb 28, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade kernel-abi-stablelistsUpgrade kernelUpgrade python3-perfUpgrade kernel-tools-libsUpgrade kernel-tools | Jul 16, 2024 | Feb 28, 2024 |
| Oracle_linux | — | Upgrade kernel | Oct 16, 2024 | Feb 28, 2024 |
| Redhat_linux | — | Upgrade kernel-rtNo solution existsUpgrade kernel | Sep 25, 2024 | Feb 28, 2024 |
| Rocky_linux | — | Upgrade kernel-modulesUpgrade perf-debuginfoUpgrade perfUpgrade kernel-toolsUpgrade kernel-tools-libs-develUpgrade kernel-debug-develUpgrade kernel-rt-debug-develUpgrade kernel-debuginfoUpgrade kernel-rt-modulesUpgrade kernel-develUpgrade kernel-headersUpgrade kernel-rt-debuginfoUpgrade kernel-rt-debug-kvmUpgrade python3-perfUpgrade kernel-rt-coreUpgrade kernel-rtUpgrade kernel-rt-debug-modules-extraUpgrade kernelUpgrade kernel-rt-develUpgrade kernel-tools-debuginfoUpgrade kernel-rt-debug-coreUpgrade kernel-rt-kvmUpgrade bpftoolUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-debug-modules-extraUpgrade kernel-debugUpgrade kernel-modules-extraUpgrade kernel-rt-modules-extraUpgrade kernel-tools-libsUpgrade kernel-debug-modulesUpgrade kernel-coreUpgrade kernel-debug-debuginfoUpgrade kernel-rt-debugUpgrade kernel-rt-debuginfo-common-x86_64Upgrade kernel-rt-debug-debuginfoUpgrade kernel-debug-coreUpgrade kernel-cross-headersUpgrade bpftool-debuginfoUpgrade python3-perf-debuginfoUpgrade kernel-rt-debug-modules | Oct 2, 2024 | Feb 28, 2024 |
| Suse | — | Upgrade kernel-zfcpdumpUpgrade kernel-macrosUpgrade kernel-64kb-develUpgrade reiserfs-kmp-defaultUpgrade kernel-64kbUpgrade kernel-docsUpgrade kernel-develUpgrade kernel-symsUpgrade kernel-preempt-develUpgrade kernel-default-develUpgrade kernel-obs-buildUpgrade kernel-preemptUpgrade kernel-defaultUpgrade kernel-default-baseUpgrade kernel-source | Aug 9, 2024 | Feb 28, 2024 |
| Ubuntu | — | Upgrade linux-gcp-5.4Upgrade linux-azureUpgrade linux-azure-5.4Upgrade linux-oracleUpgrade linux-hwe-5.4Upgrade linux-gcpUpgrade linux-gcp-fipsUpgrade linux-kvmUpgrade linux-azure-fipsUpgrade linux-aws-fipsUpgrade linux-gkeopUpgrade linux-raspiUpgrade linux-oracle-5.4Upgrade linux-fipsUpgrade linux-awsUpgrade linuxUpgrade linux-aws-5.4Upgrade linux-bluefieldUpgrade linux-raspi-5.4 | Nov 19, 2024 | Feb 28, 2024 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub