In the Linux kernel, the following vulnerability has been resolved:
dm cache: fix potential out-of-bounds access on the first resume
Out-of-bounds access occurs if the fast device is expanded unexpectedly before the first-time resume of the cache table. This happens because expanding the fast device requires reloading the cache table for cache_create to allocate new in-core data structures that fit the new size, and the check in cache_preresume is not performed during the first resume, leading to the issue.
Reproduce steps:
1. prepare component devices:
dmsetup create cmeta --table "0 8192 linear /dev/sdc 0" dmsetup create cdata --table "0 65536 linear /dev/sdc 8192" dmsetup create corig --table "0 524288 linear /dev/sdc 262144" dd if=/dev/zero of=/dev/mapper/cmeta bs=4k count=1 oflag=direct
2. load a cache table of 512 cache blocks, and deliberately expand the fast device before resuming the cache, making the in-core data structures inadequate.
dmsetup create cache --notable dmsetup reload cache --table "0 524288 cache /dev/mapper/cmeta \ /dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 writethrough smq 0" dmsetup reload cdata --table "0 131072 linear /dev/sdc 8192" dmsetup resume cdata dmsetup resume cache
3. suspend the cache to write out the in-core dirty bitset and hint array, leading to out-of-bounds access to the dirty bitset at offset 0x40:
dmsetup suspend cache
KASAN reports:
BUG: KASAN: vmalloc-out-of-bounds in is_dirty_callback+0x2b/0x80 Read of size 8 at addr ffffc90000085040 by task dmsetup/90
(...snip...) The buggy address belongs to the virtual mapping at [ffffc90000085000, ffffc90000087000) created by: cache_ctr+0x176a/0x35f0
(...snip...) Memory state around the buggy address: ffffc90000084f00: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 ffffc90000084f80: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 >ffffc90000085000: 00 00 00 00 00 00 00 00 f8 f8 f8 f8 f8 f8 f8 f8 ^ ffffc90000085080: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 ffffc90000085100: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
Fix by checking the size change on the first resume.
CVSS Details
- CVSS 3.1 Base Score: 7.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernel-develUpgrade bpftoolUpgrade kernel-tools-debuginfoUpgrade kernel-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-tools-develUpgrade kernelUpgrade perfUpgrade kernel-livepatch-4.14.355-276.639Upgrade kernel-livepatch-5.15.173-118.169Upgrade kernel-debuginfo-common-x86_64Upgrade python-perfUpgrade perf-debuginfoUpgrade bpftool-debuginfoUpgrade kernel-livepatch-5.10.230-223.885Upgrade kernel-toolsUpgrade python-perf-debuginfoUpgrade kernel-headers | Mar 4, 2025 | Nov 19, 2024 |
| Amazon_linux | — | Upgrade kernel | May 22, 2025 | Nov 19, 2024 |
| Amazon_linux_2023 | — | Upgrade kernelUpgrade bpftoolUpgrade kernel-modules-extraUpgrade kernel-debuginfo-common-x86_64Upgrade python3-perf-debuginfoUpgrade kernel-tools-debuginfoUpgrade bpftool-debuginfoUpgrade kernel-libbpf-develUpgrade kernel-libbpf-staticUpgrade kernel-livepatch-6.1.119-129.201Upgrade kernel-debuginfo-common-aarch64Upgrade python3-perfUpgrade kernel-modules-extra-commonUpgrade kernel-develUpgrade perfUpgrade kernel-libbpfUpgrade kernel-debuginfoUpgrade kernel-tools-develUpgrade kernel-toolsUpgrade perf-debuginfoUpgrade kernel-headers | Mar 10, 2025 | Nov 19, 2024 |
| Debian | — | Upgrade linuxUpgrade linux-6.1 | Dec 2, 2024 | Nov 19, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade kernel-toolsUpgrade kernel-tools-libsUpgrade python3-perfUpgrade kernel-abi-stablelistsUpgrade kernel | Jan 14, 2025 | Nov 19, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade python3-perfUpgrade kernel-abi-stablelistsUpgrade bpftoolUpgrade kernelUpgrade kernel-toolsUpgrade kernel-tools-libs | Feb 11, 2025 | Nov 19, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade kernel-abi-stablelistsUpgrade kernel-toolsUpgrade bpftoolUpgrade kernel-tools-libsUpgrade kernelUpgrade python3-perf | Feb 11, 2025 | Nov 19, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade python3-perfUpgrade kernel-tools-libsUpgrade kernel-toolsUpgrade kernel | Jan 15, 2025 | Nov 19, 2024 |
| Oracle_linux | — | Upgrade kernel-uek | Feb 10, 2025 | Nov 19, 2024 |
| Redhat_linux | — | Upgrade kernel-rtNo solution existsUpgrade kernel | May 15, 2025 | Nov 19, 2024 |
| Ubuntu | — | Upgrade linux-image-genericUpgrade linux-image-5.15.0-133-generic-64kUpgrade linux-image-5.4.0-1129-raspiUpgrade linux-image-lowlatency-64kUpgrade linux-image-snapdragon-hwe-18.04Upgrade linux-image-6.11.0-1010-lowlatencyUpgrade linux-image-ibm-lts-20.04Upgrade linux-image-azure-fde-lts-22.04Upgrade linux-image-6.8.0-1026-nvidia-lowlatencyUpgrade linux-image-5.15.0-1033-nvidia-tegra-rtUpgrade linux-image-6.8.0-1026-nvidia-lowlatency-64kUpgrade linux-image-virtual-hwe-20.04Upgrade linux-image-ibm-classicUpgrade linux-image-azure-lts-22.04Upgrade linux-image-generic-64kUpgrade linux-image-oem-22.04Upgrade linux-image-oracle-lts-20.04Upgrade linux-image-5.15.0-1073-intel-iotgUpgrade linux-image-nvidia-tegraUpgrade linux-image-5.15.0-133-genericUpgrade linux-image-oem-24.04aUpgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-nvidia-lowlatencyUpgrade linux-image-realtime-hwe-24.04Upgrade linux-image-5.15.0-1072-raspiUpgrade linux-image-5.15.0-1081-azure-fdeUpgrade linux-image-gkeopUpgrade linux-image-oracle-lts-24.04Upgrade linux-image-6.8.0-58-lowlatencyUpgrade linux-image-5.4.0-1058-xilinx-zynqmpUpgrade linux-image-oem-osp1Upgrade linux-image-azureUpgrade linux-image-nvidia-64kUpgrade linux-image-6.11.0-18-genericUpgrade linux-image-5.15.0-133-generic-lpaeUpgrade linux-image-5.15.0-1076-kvmUpgrade linux-image-oem-20.04cUpgrade linux-image-oem-22.04bUpgrade linux-image-5.4.0-1138-oracleUpgrade linux-image-5.4.0-208-generic-lpaeUpgrade linux-image-azure-fdeUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-nvidiaUpgrade linux-image-5.15.0-1021-nvidia-tegra-igx-rtUpgrade linux-image-6.11.0-1009-azureUpgrade linux-image-6.8.1-1020-realtimeUpgrade linux-image-azure-fde-lts-24.04Upgrade linux-image-6.8.0-1024-ibmUpgrade linux-image-intel-iotgUpgrade linux-image-6.8.0-1027-azure-fdeUpgrade linux-image-gke-5.15Upgrade linux-image-6.8.0-58-genericUpgrade linux-image-6.8.0-1028-gcpUpgrade linux-image-oem-22.04cUpgrade linux-image-generic-lpaeUpgrade linux-image-6.11.0-18-generic-64kUpgrade linux-image-6.8.0-58-generic-64kUpgrade linux-image-azure-lts-24.04Upgrade linux-image-intelUpgrade linux-image-5.15.0-1074-ibmUpgrade linux-image-oracle-64kUpgrade linux-image-5.4.0-1099-bluefieldUpgrade linux-image-5.15.0-1021-nvidia-tegra-igxUpgrade linux-image-6.8.0-1028-gcp-64kUpgrade linux-image-oem-22.04aUpgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-generic-hwe-18.04Upgrade linux-image-raspi2Upgrade linux-image-6.11.0-1015-oemUpgrade linux-image-6.8.0-1026-nvidiaUpgrade linux-image-raspiUpgrade linux-image-6.11.0-1011-oracle-64kUpgrade linux-image-aws-lts-22.04Upgrade linux-image-virtual-hwe-22.04Upgrade linux-image-azure-nvidiaUpgrade linux-image-lowlatencyUpgrade linux-image-5.4.0-1143-gcpUpgrade linux-image-azure-lts-20.04Upgrade linux-image-oem-20.04bUpgrade linux-image-ibmUpgrade linux-image-6.11.0-1009-awsUpgrade linux-image-6.8.0-1026-oemUpgrade linux-image-6.11.0-1008-raspiUpgrade linux-image-5.15.0-1081-azureUpgrade linux-image-gkeop-6.8Upgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-5.15.0-1033-nvidia-tegraUpgrade linux-image-5.4.0-1142-awsUpgrade linux-image-6.11.0-1009-azure-fdeUpgrade linux-image-5.4.0-208-genericUpgrade linux-image-gcp-64kUpgrade linux-image-6.11.0-1011-oracleUpgrade linux-image-6.8.0-1014-azure-nvidiaUpgrade linux-image-5.4.0-1086-ibmUpgrade linux-image-aws-lts-20.04Upgrade linux-image-nvidia-6.8Upgrade linux-image-virtual-hwe-18.04Upgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-5.15.0-1080-awsUpgrade linux-image-5.15.0-1072-nvidiaUpgrade linux-image-6.8.0-58-lowlatency-64kUpgrade linux-image-5.15.0-133-lowlatencyUpgrade linux-image-5.15.0-1072-nvidia-lowlatencyUpgrade linux-image-nvidia-tegra-igx-rtUpgrade linux-image-raspi-nolpaeUpgrade linux-image-5.15.0-1060-gkeopUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-gkeop-5.15Upgrade linux-image-realtimeUpgrade linux-image-5.15.0-1070-ibmUpgrade linux-image-gcp-lts-22.04Upgrade linux-image-raspi-realtimeUpgrade linux-image-oem-20.04Upgrade linux-image-oem-20.04dUpgrade linux-image-6.8.0-1024-oracle-64kUpgrade linux-image-nvidia-tegra-rtUpgrade linux-image-bluefieldUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-5.15.0-134-generic-lpaeUpgrade linux-image-5.15.0-134-generic-64kUpgrade linux-image-azure-cvmUpgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-ibm-lts-24.04Upgrade linux-image-gcp-lts-24.04Upgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-6.11.0-1005-realtimeUpgrade linux-image-fipsUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-oemUpgrade linux-image-6.11.0-1010-lowlatency-64kUpgrade linux-image-5.4.0-1127-kvmUpgrade linux-image-5.4.0-1140-awsUpgrade linux-image-5.15.0-134-genericUpgrade linux-image-5.15.0-1075-oracleUpgrade linux-image-gkeUpgrade linux-image-5.15.0-1044-xilinx-zynqmpUpgrade linux-image-nvidia-tegra-igxUpgrade linux-image-oem-22.04dUpgrade linux-image-oem-24.04bUpgrade linux-image-gcp-lts-20.04Upgrade linux-image-oracle-lts-22.04Upgrade linux-image-6.11.0-1009-gcpUpgrade linux-image-5.15.0-133-lowlatency-64kUpgrade linux-image-raspi-hwe-18.04Upgrade linux-image-5.4.0-1048-iotUpgrade linux-image-6.8.0-1028-raspiUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-aws-lts-24.04Upgrade linux-image-xilinx-zynqmpUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-nvidia-64k-6.8Upgrade linux-image-6.8.0-1026-nvidia-64kUpgrade linux-image-6.8.0-1010-gkeopUpgrade linux-image-5.15.0-1077-gcpUpgrade linux-image-6.8.0-1023-gkeUpgrade linux-image-lowlatency-hwe-18.04Upgrade linux-image-6.8.0-1024-oracleUpgrade linux-image-6.8.0-1027-azureUpgrade linux-image-6.8.0-1027-awsUpgrade linux-image-gcpUpgrade linux-image-generic-hwe-20.04Upgrade linux-image-5.4.0-1145-azureUpgrade linux-image-6.8.0-2023-raspi-realtimeUpgrade linux-image-oem-24.04Upgrade linux-image-5.15.0-1078-awsUpgrade linux-image-5.15.0-1075-gkeUpgrade linux-image-virtualUpgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-oracleUpgrade linux-image-kvmUpgrade linux-image-5.4.0-1116-fipsUpgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-5.4.0-208-lowlatencyUpgrade linux-image-aws | Feb 20, 2025 | Nov 19, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Oct 13, 2025 | Nov 19, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub