In the Linux kernel, the following vulnerability has been resolved: dm cache: fix out-of-bounds access to the dirty bitset when resizing dm-cache checks the dirty bits of the cache blocks to be dropped when shrinking the fast device, but an index bug in bitset iteration causes out-of-bounds access. Reproduce steps: 1. create a cache device of 1024 cache blocks (128 bytes dirty bitset) dmsetup create cmeta --table "0 8192 linear /dev/sdc 0" dmsetup create cdata --table "0 131072 linear /dev/sdc 8192" dmsetup create corig --table "0 524288 linear /dev/sdc 262144" dd if=/dev/zero of=/dev/mapper/cmeta bs=4k count=1 oflag=direct dmsetup create cache --table "0 524288 cache /dev/mapper/cmeta \ /dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 writethrough smq 0" 2. shrink the fast device to 512 cache blocks, triggering out-of-bounds access to the dirty bitset (offset 0x80) dmsetup suspend cache dmsetup reload cdata --table "0 65536 linear /dev/sdc 8192" dmsetup resume cdata dmsetup resume cache KASAN reports: BUG: KASAN: vmalloc-out-of-bounds in cachepreresume+0x269/0x7b0 Read of size 8 at addr ffffc900000f3080 by task dmsetup/131 (...snip...) The buggy address belongs to the virtual mapping at [ffffc900000f3000, ffffc900000f5000) created by: cachectr+0x176a/0x35f0 (...snip...) Memory state around the buggy address: ffffc900000f2f80: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 ffffc900000f3000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffffc900000f3080: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 ^ ffffc900000f3100: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 ffffc900000f3180: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 Fix by making the index post-incremented.
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "binary_version": "6.11.0-18.18", "binary_name": "linux-bpf-dev" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-buildinfo-6.11.0-18-generic" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-buildinfo-6.11.0-18-generic-64k" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-cloud-tools-6.11.0-18" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-cloud-tools-6.11.0-18-generic" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-cloud-tools-common" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-doc" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-headers-6.11.0-18" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-headers-6.11.0-18-generic" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-headers-6.11.0-18-generic-64k" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-image-6.11.0-18-generic" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-image-6.11.0-18-generic-dbgsym" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-image-unsigned-6.11.0-18-generic" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-image-unsigned-6.11.0-18-generic-64k" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-image-unsigned-6.11.0-18-generic-64k-dbgsym" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-image-unsigned-6.11.0-18-generic-dbgsym" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-lib-rust-6.11.0-18-generic" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-libc-dev" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-modules-6.11.0-18-generic" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-modules-6.11.0-18-generic-64k" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-modules-extra-6.11.0-18-generic" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-modules-ipu6-6.11.0-18-generic" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-modules-ipu7-6.11.0-18-generic" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-modules-iwlwifi-6.11.0-18-generic" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-modules-usbio-6.11.0-18-generic" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-modules-vision-6.11.0-18-generic" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-source-6.11.0" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-tools-6.11.0-18" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-tools-6.11.0-18-generic" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-tools-6.11.0-18-generic-64k" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-tools-common" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-tools-host" } ] }
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "binary_version": "6.11.0-1009.10", "binary_name": "linux-aws-cloud-tools-6.11.0-1009" }, { "binary_version": "6.11.0-1009.10", "binary_name": "linux-aws-headers-6.11.0-1009" }, { "binary_version": "6.11.0-1009.10", "binary_name": "linux-aws-tools-6.11.0-1009" }, { "binary_version": "6.11.0-1009.10", "binary_name": "linux-buildinfo-6.11.0-1009-aws" }, { "binary_version": "6.11.0-1009.10", "binary_name": "linux-cloud-tools-6.11.0-1009-aws" }, { "binary_version": "6.11.0-1009.10", "binary_name": "linux-headers-6.11.0-1009-aws" }, { "binary_version": "6.11.0-1009.10", "binary_name": "linux-image-unsigned-6.11.0-1009-aws" }, { "binary_version": "6.11.0-1009.10", "binary_name": "linux-image-unsigned-6.11.0-1009-aws-dbgsym" }, { "binary_version": "6.11.0-1009.10", "binary_name": "linux-modules-6.11.0-1009-aws" }, { "binary_version": "6.11.0-1009.10", "binary_name": "linux-modules-extra-6.11.0-1009-aws" }, { "binary_version": "6.11.0-1009.10", "binary_name": "linux-tools-6.11.0-1009-aws" } ] }
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "binary_version": "6.11.0-1009.9", "binary_name": "linux-azure-cloud-tools-6.11.0-1009" }, { "binary_version": "6.11.0-1009.9", "binary_name": "linux-azure-headers-6.11.0-1009" }, { "binary_version": "6.11.0-1009.9", "binary_name": "linux-azure-tools-6.11.0-1009" }, { "binary_version": "6.11.0-1009.9", "binary_name": "linux-buildinfo-6.11.0-1009-azure" }, { "binary_version": "6.11.0-1009.9", "binary_name": "linux-cloud-tools-6.11.0-1009-azure" }, { "binary_version": "6.11.0-1009.9", "binary_name": "linux-headers-6.11.0-1009-azure" }, { "binary_version": "6.11.0-1009.9", "binary_name": "linux-image-unsigned-6.11.0-1009-azure" }, { "binary_version": "6.11.0-1009.9", "binary_name": "linux-image-unsigned-6.11.0-1009-azure-dbgsym" }, { "binary_version": "6.11.0-1009.9", "binary_name": "linux-modules-6.11.0-1009-azure" }, { "binary_version": "6.11.0-1009.9", "binary_name": "linux-modules-extra-6.11.0-1009-azure" }, { "binary_version": "6.11.0-1009.9", "binary_name": "linux-modules-iwlwifi-6.11.0-1009-azure" }, { "binary_version": "6.11.0-1009.9", "binary_name": "linux-tools-6.11.0-1009-azure" } ] }
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "binary_version": "6.11.0-1009.9", "binary_name": "linux-buildinfo-6.11.0-1009-gcp" }, { "binary_version": "6.11.0-1009.9", "binary_name": "linux-gcp-headers-6.11.0-1009" }, { "binary_version": "6.11.0-1009.9", "binary_name": "linux-gcp-tools-6.11.0-1009" }, { "binary_version": "6.11.0-1009.9", "binary_name": "linux-headers-6.11.0-1009-gcp" }, { "binary_version": "6.11.0-1009.9", "binary_name": "linux-image-unsigned-6.11.0-1009-gcp" }, { "binary_version": "6.11.0-1009.9", "binary_name": "linux-image-unsigned-6.11.0-1009-gcp-dbgsym" }, { "binary_version": "6.11.0-1009.9", "binary_name": "linux-modules-6.11.0-1009-gcp" }, { "binary_version": "6.11.0-1009.9", "binary_name": "linux-modules-extra-6.11.0-1009-gcp" }, { "binary_version": "6.11.0-1009.9", "binary_name": "linux-tools-6.11.0-1009-gcp" } ] }
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "binary_version": "6.11.0-1010.11", "binary_name": "linux-buildinfo-6.11.0-1010-lowlatency" }, { "binary_version": "6.11.0-1010.11", "binary_name": "linux-buildinfo-6.11.0-1010-lowlatency-64k" }, { "binary_version": "6.11.0-1010.11", "binary_name": "linux-cloud-tools-6.11.0-1010-lowlatency" }, { "binary_version": "6.11.0-1010.11", "binary_name": "linux-headers-6.11.0-1010-lowlatency" }, { "binary_version": "6.11.0-1010.11", "binary_name": "linux-headers-6.11.0-1010-lowlatency-64k" }, { "binary_version": "6.11.0-1010.11", "binary_name": "linux-image-unsigned-6.11.0-1010-lowlatency" }, { "binary_version": "6.11.0-1010.11", "binary_name": "linux-image-unsigned-6.11.0-1010-lowlatency-64k" }, { "binary_version": "6.11.0-1010.11", "binary_name": "linux-image-unsigned-6.11.0-1010-lowlatency-64k-dbgsym" }, { "binary_version": "6.11.0-1010.11", "binary_name": "linux-image-unsigned-6.11.0-1010-lowlatency-dbgsym" }, { "binary_version": "6.11.0-1010.11", "binary_name": "linux-lowlatency-cloud-tools-6.11.0-1010" }, { "binary_version": "6.11.0-1010.11", "binary_name": "linux-lowlatency-headers-6.11.0-1010" }, { "binary_version": "6.11.0-1010.11", "binary_name": "linux-lowlatency-lib-rust-6.11.0-1010-lowlatency" }, { "binary_version": "6.11.0-1010.11", "binary_name": "linux-lowlatency-tools-6.11.0-1010" }, { "binary_version": "6.11.0-1010.11", "binary_name": "linux-modules-6.11.0-1010-lowlatency" }, { "binary_version": "6.11.0-1010.11", "binary_name": "linux-modules-6.11.0-1010-lowlatency-64k" }, { "binary_version": "6.11.0-1010.11", "binary_name": "linux-modules-iwlwifi-6.11.0-1010-lowlatency" }, { "binary_version": "6.11.0-1010.11", "binary_name": "linux-tools-6.11.0-1010-lowlatency" }, { "binary_version": "6.11.0-1010.11", "binary_name": "linux-tools-6.11.0-1010-lowlatency-64k" } ] }
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "binary_version": "6.11.0-1011.12", "binary_name": "linux-buildinfo-6.11.0-1011-oracle" }, { "binary_version": "6.11.0-1011.12", "binary_name": "linux-buildinfo-6.11.0-1011-oracle-64k" }, { "binary_version": "6.11.0-1011.12", "binary_name": "linux-headers-6.11.0-1011-oracle" }, { "binary_version": "6.11.0-1011.12", "binary_name": "linux-headers-6.11.0-1011-oracle-64k" }, { "binary_version": "6.11.0-1011.12", "binary_name": "linux-image-unsigned-6.11.0-1011-oracle" }, { "binary_version": "6.11.0-1011.12", "binary_name": "linux-image-unsigned-6.11.0-1011-oracle-64k" }, { "binary_version": "6.11.0-1011.12", "binary_name": "linux-image-unsigned-6.11.0-1011-oracle-64k-dbgsym" }, { "binary_version": "6.11.0-1011.12", "binary_name": "linux-image-unsigned-6.11.0-1011-oracle-dbgsym" }, { "binary_version": "6.11.0-1011.12", "binary_name": "linux-modules-6.11.0-1011-oracle" }, { "binary_version": "6.11.0-1011.12", "binary_name": "linux-modules-6.11.0-1011-oracle-64k" }, { "binary_version": "6.11.0-1011.12", "binary_name": "linux-modules-extra-6.11.0-1011-oracle" }, { "binary_version": "6.11.0-1011.12", "binary_name": "linux-modules-extra-6.11.0-1011-oracle-64k" }, { "binary_version": "6.11.0-1011.12", "binary_name": "linux-oracle-headers-6.11.0-1011" }, { "binary_version": "6.11.0-1011.12", "binary_name": "linux-oracle-tools-6.11.0-1011" }, { "binary_version": "6.11.0-1011.12", "binary_name": "linux-tools-6.11.0-1011-oracle" }, { "binary_version": "6.11.0-1011.12", "binary_name": "linux-tools-6.11.0-1011-oracle-64k" } ] }
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "binary_version": "6.11.0-1008.8", "binary_name": "linux-buildinfo-6.11.0-1008-raspi" }, { "binary_version": "6.11.0-1008.8", "binary_name": "linux-headers-6.11.0-1008-raspi" }, { "binary_version": "6.11.0-1008.8", "binary_name": "linux-image-6.11.0-1008-raspi" }, { "binary_version": "6.11.0-1008.8", "binary_name": "linux-image-6.11.0-1008-raspi-dbgsym" }, { "binary_version": "6.11.0-1008.8", "binary_name": "linux-modules-6.11.0-1008-raspi" }, { "binary_version": "6.11.0-1008.8", "binary_name": "linux-raspi-headers-6.11.0-1008" }, { "binary_version": "6.11.0-1008.8", "binary_name": "linux-raspi-tools-6.11.0-1008" }, { "binary_version": "6.11.0-1008.8", "binary_name": "linux-tools-6.11.0-1008-raspi" } ] }
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "binary_version": "6.11.0-1005.5", "binary_name": "linux-buildinfo-6.11.0-1005-realtime" }, { "binary_version": "6.11.0-1005.5", "binary_name": "linux-cloud-tools-6.11.0-1005-realtime" }, { "binary_version": "6.11.0-1005.5", "binary_name": "linux-headers-6.11.0-1005-realtime" }, { "binary_version": "6.11.0-1005.5", "binary_name": "linux-image-unsigned-6.11.0-1005-realtime" }, { "binary_version": "6.11.0-1005.5", "binary_name": "linux-image-unsigned-6.11.0-1005-realtime-dbgsym" }, { "binary_version": "6.11.0-1005.5", "binary_name": "linux-modules-6.11.0-1005-realtime" }, { "binary_version": "6.11.0-1005.5", "binary_name": "linux-modules-extra-6.11.0-1005-realtime" }, { "binary_version": "6.11.0-1005.5", "binary_name": "linux-modules-iwlwifi-6.11.0-1005-realtime" }, { "binary_version": "6.11.0-1005.5", "binary_name": "linux-realtime-cloud-tools-6.11.0-1005" }, { "binary_version": "6.11.0-1005.5", "binary_name": "linux-realtime-headers-6.11.0-1005" }, { "binary_version": "6.11.0-1005.5", "binary_name": "linux-realtime-tools-6.11.0-1005" }, { "binary_version": "6.11.0-1005.5", "binary_name": "linux-tools-6.11.0-1005-realtime" } ] }
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "binary_version": "6.11.0-17.17.1", "binary_name": "linux-buildinfo-6.11.0-17-generic" }, { "binary_version": "6.11.0-17.17.1", "binary_name": "linux-headers-6.11.0-17-generic" }, { "binary_version": "6.11.0-17.17.1", "binary_name": "linux-image-6.11.0-17-generic" }, { "binary_version": "6.11.0-17.17.1", "binary_name": "linux-image-6.11.0-17-generic-dbgsym" }, { "binary_version": "6.11.0-17.17.1", "binary_name": "linux-modules-6.11.0-17-generic" }, { "binary_version": "6.11.0-17.17.1", "binary_name": "linux-riscv-headers-6.11.0-17" }, { "binary_version": "6.11.0-17.17.1", "binary_name": "linux-riscv-tools-6.11.0-17" }, { "binary_version": "6.11.0-17.17.1", "binary_name": "linux-tools-6.11.0-17-generic" } ] }
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "binary_version": "6.11.0-17.17~24.04.2", "binary_name": "linux-buildinfo-6.11.0-17-generic" }, { "binary_version": "6.11.0-17.17~24.04.2", "binary_name": "linux-buildinfo-6.11.0-17-generic-64k" }, { "binary_version": "6.11.0-17.17~24.04.2", "binary_name": "linux-cloud-tools-6.11.0-17-generic" }, { "binary_version": "6.11.0-17.17~24.04.2", "binary_name": "linux-headers-6.11.0-17-generic" }, { "binary_version": "6.11.0-17.17~24.04.2", "binary_name": "linux-headers-6.11.0-17-generic-64k" }, { "binary_version": "6.11.0-17.17~24.04.2", "binary_name": "linux-hwe-6.11-cloud-tools-6.11.0-17" }, { "binary_version": "6.11.0-17.17~24.04.2", "binary_name": "linux-hwe-6.11-headers-6.11.0-17" }, { "binary_version": "6.11.0-17.17~24.04.2", "binary_name": "linux-hwe-6.11-lib-rust-6.11.0-17-generic" }, { "binary_version": "6.11.0-17.17~24.04.2", "binary_name": "linux-hwe-6.11-tools-6.11.0-17" }, { "binary_version": "6.11.0-17.17~24.04.2", "binary_name": "linux-image-6.11.0-17-generic" }, { "binary_version": "6.11.0-17.17~24.04.2", "binary_name": "linux-image-6.11.0-17-generic-dbgsym" }, { "binary_version": "6.11.0-17.17~24.04.2", "binary_name": "linux-image-unsigned-6.11.0-17-generic" }, { "binary_version": "6.11.0-17.17~24.04.2", "binary_name": "linux-image-unsigned-6.11.0-17-generic-64k" }, { "binary_version": "6.11.0-17.17~24.04.2", "binary_name": "linux-image-unsigned-6.11.0-17-generic-64k-dbgsym" }, { "binary_version": "6.11.0-17.17~24.04.2", "binary_name": "linux-image-unsigned-6.11.0-17-generic-dbgsym" }, { "binary_version": "6.11.0-17.17~24.04.2", "binary_name": "linux-modules-6.11.0-17-generic" }, { "binary_version": "6.11.0-17.17~24.04.2", "binary_name": "linux-modules-6.11.0-17-generic-64k" }, { "binary_version": "6.11.0-17.17~24.04.2", "binary_name": "linux-modules-extra-6.11.0-17-generic" }, { "binary_version": "6.11.0-17.17~24.04.2", "binary_name": "linux-modules-ipu6-6.11.0-17-generic" }, { "binary_version": "6.11.0-17.17~24.04.2", "binary_name": "linux-modules-ipu7-6.11.0-17-generic" }, { "binary_version": "6.11.0-17.17~24.04.2", "binary_name": "linux-modules-iwlwifi-6.11.0-17-generic" }, { "binary_version": "6.11.0-17.17~24.04.2", "binary_name": "linux-modules-usbio-6.11.0-17-generic" }, { "binary_version": "6.11.0-17.17~24.04.2", "binary_name": "linux-modules-vision-6.11.0-17-generic" }, { "binary_version": "6.11.0-17.17~24.04.2", "binary_name": "linux-tools-6.11.0-17-generic" }, { "binary_version": "6.11.0-17.17~24.04.2", "binary_name": "linux-tools-6.11.0-17-generic-64k" } ] }