In the Linux kernel, the following vulnerability has been resolved:
iocost: Fix divide-by-zero on donation from low hweight cgroup
The donation calculation logic assumes that the donor has non-zero after-donation hweight, so the lowest active hweight a donating cgroup can have is 2 so that it can donate 1 while keeping the other 1 for itself. Earlier, we only donated from cgroups with sizable surpluses so this condition was always true. However, with the precise donation algorithm implemented, f1de2439ec43 ("blk-iocost: revamp donation amount determination") made the donation amount calculation exact enabling even low hweight cgroups to donate.
This means that in rare occasions, a cgroup with active hweight of 1 can enter donation calculation triggering the following warning and then a divide-by-zero oops.
WARNING: CPU: 4 PID: 0 at block/blk-iocost.c:1928 transfer_surpluses.cold+0x0/0x53 [884/94867] ... RIP: 0010:transfer_surpluses.cold+0x0/0x53 Code: 92 ff 48 c7 c7 28 d1 ab b5 65 48 8b 34 25 00 ae 01 00 48 81 c6 90 06 00 00 e8 8b 3f fe ff 48 c7 c0 ea ff ff ff e9 95 ff 92 ff <0f> 0b 48 c7 c7 30 da ab b5 e8 71 3f fe ff 4c 89 e8 4d 85 ed 74 0 4 ... Call Trace: <IRQ> ioc_timer_fn+0x1043/0x1390 call_timer_fn+0xa1/0x2c0 __run_timers.part.0+0x1ec/0x2e0 run_timer_softirq+0x35/0x70 ... iocg: invalid donation weights in /a/b: active=1 donating=1 after=0
Fix it by excluding cgroups w/ active hweight < 2 from donating. Excluding these extreme low hweight donations shouldn't affect work conservation in any meaningful way.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernel-debuginfo-common-x86_64Upgrade kernel-tools-debuginfoUpgrade kernelUpgrade kernel-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade bpftoolUpgrade kernel-livepatch-5.10.93-87.444Upgrade kernel-develUpgrade bpftool-debuginfoUpgrade kernel-toolsUpgrade python-perfUpgrade kernel-tools-develUpgrade kernel-headersUpgrade perfUpgrade perf-debuginfoUpgrade python-perf-debuginfo | Aug 2, 2024 | Jun 19, 2024 |
| Debian | — | Upgrade linux | Jul 30, 2024 | Jun 19, 2024 |
| Suse | — | Upgrade gfs2-kmp-rtUpgrade kernel-rtUpgrade kernel-source-azureUpgrade kernel-azure-develUpgrade cluster-md-kmp-azureUpgrade ocfs2-kmp-rtUpgrade kernel-syms-rtUpgrade kernel-azure-livepatch-develUpgrade kernel-devel-azureUpgrade kernel-rt_debugUpgrade kernel-rt-develUpgrade kernel-azure-vdsoUpgrade reiserfs-kmp-azureUpgrade kernel-azure-extraUpgrade kernel-syms-azureUpgrade kernel-rt_debug-vdsoUpgrade kernel-rt-livepatch-develUpgrade kernel-devel-rtUpgrade dlm-kmp-azureUpgrade gfs2-kmp-azureUpgrade kernel-rt_debug-develUpgrade kernel-rt-extraUpgrade kernel-azure-optionalUpgrade kernel-rt-livepatchUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-rt-vdsoUpgrade kernel-rt-optionalUpgrade dlm-kmp-rtUpgrade ocfs2-kmp-azureUpgrade kernel-source-rtUpgrade kernel-azureUpgrade reiserfs-kmp-rtUpgrade kselftests-kmp-rtUpgrade kselftests-kmp-azureUpgrade cluster-md-kmp-rt | Aug 9, 2024 | Jun 19, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Jun 19, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub