In the Linux kernel, the following vulnerability has been resolved:
dm btree remove: assign new_root only when removal succeeds
remove_raw() in dm_btree_remove() may fail due to IO read error (e.g. read the content of origin block fails during shadowing), and the value of shadow_spine::root is uninitialized, but the uninitialized value is still assign to new_root in the end of dm_btree_remove().
For dm-thin, the value of pmd->details_root or pmd->root will become an uninitialized value, so if trying to read details_info tree again out-of-bound memory may occur as showed below:
general protection fault, probably for non-canonical address 0x3fdcb14c8d7520 CPU: 4 PID: 515 Comm: dmsetup Not tainted 5.13.0-rc6 Hardware name: QEMU Standard PC RIP: 0010:metadata_ll_load_ie+0x14/0x30 Call Trace: sm_metadata_count_is_more_than_one+0xb9/0xe0 dm_tm_shadow_block+0x52/0x1c0 shadow_step+0x59/0xf0 remove_raw+0xb2/0x170 dm_btree_remove+0xf4/0x1c0 dm_pool_delete_thin_device+0xc3/0x140 pool_message+0x218/0x2b0 target_message+0x251/0x290 ctl_ioctl+0x1c4/0x4d0 dm_ctl_ioctl+0xe/0x20 __x64_sys_ioctl+0x7b/0xb0 do_syscall_64+0x40/0xb0 entry_SYSCALL_64_after_hwframe+0x44/0xae
Fixing it by only assign new_root when removal succeeds
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernel-tools-develUpgrade kernel-develUpgrade python-perfUpgrade kernel-livepatch-4.14.241-184.433Upgrade kernel-debuginfo-common-aarch64Upgrade bpftoolUpgrade bpftool-debuginfoUpgrade kernel-livepatch-5.10.59-52.142Upgrade perfUpgrade kernel-toolsUpgrade kernel-headersUpgrade kernel-debuginfoUpgrade kernel-tools-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade python-perf-debuginfoUpgrade perf-debuginfoUpgrade kernel | May 21, 2025 | May 21, 2024 |
| Debian | — | Upgrade linux | Jul 30, 2024 | May 21, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 21, 2024 |
| Suse | — | Upgrade kernel-source-azureUpgrade kernel-obs-buildUpgrade reiserfs-kmp-defaultUpgrade kernel-azureUpgrade kernel-azure-baseUpgrade kernel-preempt-develUpgrade kernel-64kbUpgrade kernel-preemptUpgrade kernel-default-baseUpgrade kernel-sourceUpgrade kernel-develUpgrade kernel-default-develUpgrade kernel-defaultUpgrade kernel-azure-develUpgrade kernel-default-extraUpgrade kernel-devel-azureUpgrade kernel-symsUpgrade kernel-syms-azureUpgrade kernel-zfcpdumpUpgrade kernel-docsUpgrade kernel-64kb-develUpgrade kernel-default-manUpgrade kernel-macros | Aug 9, 2024 | May 21, 2024 |
| Ubuntu | — | Upgrade linuxUpgrade linux-gcpUpgrade linux-gcp-5.4Upgrade linux-oracle-5.4Upgrade linux-awsUpgrade linux-aws-hweUpgrade linux-azure-fipsUpgrade linux-fipsUpgrade linux-raspi-5.4Upgrade linux-azure-fde-5.15Upgrade linux-oracleUpgrade linux-hweUpgrade linux-gcp-fipsUpgrade linux-azure-5.4Upgrade linux-gcp-4.15Upgrade linux-kvmUpgrade linux-gkeopUpgrade linux-aws-fipsUpgrade linux-azure-4.15Upgrade linux-azureUpgrade linux-hwe-5.4Upgrade linux-aws-5.4Upgrade linux-bluefieldUpgrade linux-raspi | Nov 19, 2024 | May 21, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub