CVE-2024-57929

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

dm array: fix releasing a faulty array block twice in dm_array_cursor_end

When dm_bm_read_lock() fails due to locking or checksum errors, it

releases the faulty block implicitly while leaving an invalid output

pointer behind. The caller of dm_bm_read_lock() should not operate on

this invalid dm_block pointer, or it will lead to undefined result.

For example, the dm_array_cursor incorrectly caches the invalid pointer

on reading a faulty array block, causing a double release in

dm_array_cursor_end(), then hitting the BUG_ON in dm-bufio cache_put().

Reproduce steps:

1. initialize a cache device

dmsetup create cmeta --table "0 8192 linear /dev/sdc 0"

dmsetup create cdata --table "0 65536 linear /dev/sdc 8192"

dmsetup create corig --table "0 524288 linear /dev/sdc $262144"

dd if=/dev/zero of=/dev/mapper/cmeta bs=4k count=1

dmsetup create cache --table "0 524288 cache /dev/mapper/cmeta \

/dev/mapper/cdata /dev/mapper/co

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References