In the Linux kernel, the following vulnerability has been resolved:
kyber: fix out of bounds access when preempted
__blk_mq_sched_bio_merge() gets the ctx and hctx for the current CPU and passes the hctx to ->bio_merge(). kyber_bio_merge() then gets the ctx for the current CPU again and uses that to get the corresponding Kyber context in the passed hctx. However, the thread may be preempted between the two calls to blk_mq_get_ctx(), and the ctx returned the second time may no longer correspond to the passed hctx. This "works" accidentally most of the time, but it can cause us to read garbage if the second ctx came from an hctx with more ctx's than the first one (i.e., if ctx->index_hw[hctx->type] > hctx->nr_ctx).
This manifested as this UBSAN array index out of bounds error reported by Jakub:
UBSAN: array-index-out-of-bounds in ../kernel/locking/qspinlock.c:130:9 index 13106 is out of range for type 'long unsigned int [128]' Call Trace: dump_stack+0xa4/0xe5 ubsan_epilogue+0x5/0x40 __ubsan_handle_out_of_bounds.cold.13+0x2a/0x34 queued_spin_lock_slowpath+0x476/0x480 do_raw_spin_lock+0x1c2/0x1d0 kyber_bio_merge+0x112/0x180 blk_mq_submit_bio+0x1f5/0x1100 submit_bio_noacct+0x7b0/0x870 submit_bio+0xc2/0x3a0 btrfs_map_bio+0x4f0/0x9d0 btrfs_submit_data_bio+0x24e/0x310 submit_one_bio+0x7f/0xb0 submit_extent_page+0xc4/0x440 __extent_writepage_io+0x2b8/0x5e0 __extent_writepage+0x28d/0x6e0 extent_write_cache_pages+0x4d7/0x7a0 extent_writepages+0xa2/0x110 do_writepages+0x8f/0x180 __writeback_single_inode+0x99/0x7f0 writeback_sb_inodes+0x34e/0x790 __writeback_inodes_wb+0x9e/0x120 wb_writeback+0x4d2/0x660 wb_workfn+0x64d/0xa10 process_one_work+0x53a/0xa80 worker_thread+0x69/0x5b0 kthread+0x20b/0x240 ret_from_fork+0x1f/0x30
Only Kyber uses the hctx, so fix it by passing the request_queue to ->bio_merge() instead. BFQ and mq-deadline just use that, and Kyber can map the queues itself to avoid the mismatch.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-coreUpgrade kernel-headersUpgrade kernel-zfcpdumpUpgrade kernel-tools-libs-develUpgrade kernelUpgrade kernel-rt-debug-kvmUpgrade kernel-debug-develUpgrade kernel-abi-stablelistsUpgrade kernel-debug-modulesUpgrade kernel-rt-debug-modulesUpgrade kernel-tools-libsUpgrade kernel-debug-modules-extraUpgrade kernel-rt-debug-coreUpgrade kernel-zfcpdump-modulesUpgrade kernel-rt-debug-develUpgrade kernel-zfcpdump-develUpgrade kernel-rt-modules-extraUpgrade kernel-zfcpdump-coreUpgrade kernel-cross-headersUpgrade kernel-modules-extraUpgrade kernel-rtUpgrade kernel-rt-coreUpgrade kernel-debugUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-rt-debugUpgrade perfUpgrade kernel-modulesUpgrade bpftoolUpgrade kernel-rt-develUpgrade kernel-debug-coreUpgrade kernel-rt-debug-modules-extraUpgrade kernel-rt-modulesUpgrade python3-perfUpgrade kernel-develUpgrade kernel-rt-kvmUpgrade kernel-docUpgrade kernel-tools | Sep 26, 2024 | Feb 28, 2024 |
| Amazon Linux Ami 2 | — | Upgrade python-perf-debuginfoUpgrade kernel-toolsUpgrade kernel-debuginfo-common-x86_64Upgrade bpftoolUpgrade bpftool-debuginfoUpgrade python-perfUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-headersUpgrade kernel-tools-debuginfoUpgrade kernelUpgrade perfUpgrade kernel-tools-develUpgrade perf-debuginfoUpgrade kernel-develUpgrade kernel-debuginfo | Mar 4, 2025 | Feb 28, 2024 |
| Debian | — | Upgrade linux | Jul 30, 2024 | Feb 28, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade kernel-toolsUpgrade kernel-tools-libsUpgrade python3-perfUpgrade kernelUpgrade kernel-abi-stablelists | Jul 16, 2024 | Feb 28, 2024 |
| Oracle_linux | — | Upgrade kernel | Oct 16, 2024 | Feb 28, 2024 |
| Redhat_linux | — | Upgrade kernel-rtNo solution existsUpgrade kernel | Sep 25, 2024 | Feb 28, 2024 |
| Rocky_linux | — | Upgrade kernel-headersUpgrade kernel-debug-develUpgrade kernel-rt-modulesUpgrade kernel-rt-debug-kvmUpgrade kernel-rt-debuginfoUpgrade python3-perfUpgrade kernel-rt-coreUpgrade kernel-rt-debug-develUpgrade kernel-rt-debug-modules-extraUpgrade kernel-debuginfoUpgrade kernel-modulesUpgrade perf-debuginfoUpgrade perfUpgrade kernel-toolsUpgrade kernel-rtUpgrade kernel-tools-libs-develUpgrade kernel-develUpgrade kernel-rt-debug-debuginfoUpgrade kernel-debugUpgrade kernel-coreUpgrade kernel-rt-debugUpgrade bpftoolUpgrade kernel-rt-kvmUpgrade kernel-rt-debuginfo-common-x86_64Upgrade kernel-cross-headersUpgrade kernel-tools-debuginfoUpgrade kernel-debug-coreUpgrade bpftool-debuginfoUpgrade kernel-debug-debuginfoUpgrade kernel-debug-modulesUpgrade kernelUpgrade kernel-rt-develUpgrade kernel-rt-debug-coreUpgrade kernel-rt-debug-modulesUpgrade kernel-modules-extraUpgrade kernel-tools-libsUpgrade kernel-rt-modules-extraUpgrade python3-perf-debuginfoUpgrade kernel-debug-modules-extraUpgrade kernel-debuginfo-common-x86_64 | Oct 2, 2024 | Feb 28, 2024 |
| Suse | — | Upgrade kernel-develUpgrade kernel-64kbUpgrade kernel-symsUpgrade kernel-macrosUpgrade kernel-docsUpgrade kernel-64kb-develUpgrade kernel-zfcpdumpUpgrade reiserfs-kmp-defaultUpgrade kernel-preemptUpgrade kernel-preempt-develUpgrade kernel-defaultUpgrade kernel-default-baseUpgrade kernel-default-develUpgrade kernel-obs-buildUpgrade kernel-source | Aug 9, 2024 | Feb 28, 2024 |
| Ubuntu | — | Upgrade linux-aws-fipsUpgrade linux-gkeopUpgrade linux-gcp-5.4Upgrade linux-gcpUpgrade linux-kvmUpgrade linux-oracleUpgrade linux-azure-5.4Upgrade linux-azure-fipsUpgrade linux-hwe-5.4Upgrade linux-gcp-fipsUpgrade linux-azureUpgrade linux-raspi-5.4Upgrade linuxUpgrade linux-raspiUpgrade linux-fipsUpgrade linux-oracle-5.4Upgrade linux-aws-5.4Upgrade linux-bluefieldUpgrade linux-aws | Nov 19, 2024 | Feb 28, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub