CVE-2024-27036

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

cifs: Fix writeback data corruption

cifs writeback doesn't correctly handle the case where

cifs_extend_writeback() hits a point where it is considering an additional

folio, but this would overrun the wsize - at which point it drops out of

the xarray scanning loop and calls xas_pause(). The problem is that

xas_pause() advances the loop counter - thereby skipping that page.

What needs to happen is for xas_reset() to be called any time we decide we

don't want to process the page we're looking at, but rather send the

request we are building and start a new one.

Fix this by copying and adapting the netfslib writepages code as a

temporary measure, with cifs writeback intending to be offloaded to

netfslib in the near future.

This also fixes the issue with the use of filemap_get_folios_tag() causing

retry of a bunch of pages which the extender already dealt with.

This can be tested by creating, say, a 64K file somewhere

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References