CVE-2024-36966

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

erofs: reliably distinguish block based and fscache mode

When erofs_kill_sb() is called in block dev based mode, s_bdev may not

have been initialised yet, and if CONFIG_EROFS_FS_ONDEMAND is enabled,

it will be mistaken for fscache mode, and then attempt to free an anon_dev

that has never been allocated, triggering the following warning:

============================================

ida_free called for id=0 which is not allocated.

WARNING: CPU: 14 PID: 926 at lib/idr.c:525 ida_free+0x134/0x140

Modules linked in:

CPU: 14 PID: 926 Comm: mount Not tainted 6.9.0-rc3-dirty #630

RIP: 0010:ida_free+0x134/0x140

Call Trace:

<TASK>

erofs_kill_sb+0x81/0x90

deactivate_locked_super+0x35/0x80

get_tree_bdev+0x136/0x1e0

vfs_get_tree+0x2c/0xf0

do_new_mount+0x190/0x2f0

[...]

============================================

Now when erofs_kill_sb() is called, erofs_sb_info must have been

initialised, so use sbi->fsid to distinguish

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References