CVE-2024-26718 (GCVE-0-2024-26718)

Vulnerability from cvelistv5 – Published: 2024-04-03 14:55 – Updated: 2025-05-04 08:54
VLAI?
Title
dm-crypt, dm-verity: disable tasklets
Summary
In the Linux kernel, the following vulnerability has been resolved: dm-crypt, dm-verity: disable tasklets Tasklets have an inherent problem with memory corruption. The function tasklet_action_common calls tasklet_trylock, then it calls the tasklet callback and then it calls tasklet_unlock. If the tasklet callback frees the structure that contains the tasklet or if it calls some code that may free it, tasklet_unlock will write into free memory. The commits 8e14f610159d and d9a02e016aaf try to fix it for dm-crypt, but it is not a sufficient fix and the data corruption can still happen [1]. There is no fix for dm-verity and dm-verity will write into free memory with every tasklet-processed bio. There will be atomic workqueues implemented in the kernel 6.9 [2]. They will have better interface and they will not suffer from the memory corruption problem. But we need something that stops the memory corruption now and that can be backported to the stable kernels. So, I'm proposing this commit that disables tasklets in both dm-crypt and dm-verity. This commit doesn't remove the tasklet support, because the tasklet code will be reused when atomic workqueues will be implemented. [1] https://lore.kernel.org/all/d390d7ee-f142-44d3-822a-87949e14608b@suse.de/T/ [2] https://lore.kernel.org/lkml/20240130091300.2968534-1-tj@kernel.org/
Severity ?
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 39d42fa96ba1b7d2544db3f8ed5da8fb0d5cb877 , < b825e0f9d68c178072bffd32dd34c39e3d2d597a (git)
Affected: 39d42fa96ba1b7d2544db3f8ed5da8fb0d5cb877 , < 30884a44e0cedc3dfda8c22432f3ba4078ec2d94 (git)
Affected: 39d42fa96ba1b7d2544db3f8ed5da8fb0d5cb877 , < 5735a2671ffb70ea29ca83969fe01316ee2ed6fc (git)
Affected: 39d42fa96ba1b7d2544db3f8ed5da8fb0d5cb877 , < 0c45a20cbe68bc4d681734f5c03891124a274257 (git)
Affected: 39d42fa96ba1b7d2544db3f8ed5da8fb0d5cb877 , < 0a9bab391e336489169b95cb0d4553d921302189 (git)
Create a notification for this product.
    Linux Linux Affected: 5.9
Unaffected: 0 , < 5.9 (semver)
Unaffected: 5.15.169 , ≤ 5.15.* (semver)
Unaffected: 6.1.79 , ≤ 6.1.* (semver)
Unaffected: 6.6.18 , ≤ 6.6.* (semver)
Unaffected: 6.7.6 , ≤ 6.7.* (semver)
Unaffected: 6.8 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:14:12.969Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/30884a44e0cedc3dfda8c22432f3ba4078ec2d94"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/5735a2671ffb70ea29ca83969fe01316ee2ed6fc"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/0c45a20cbe68bc4d681734f5c03891124a274257"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/0a9bab391e336489169b95cb0d4553d921302189"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-26718",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T15:52:23.335095Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:33:24.008Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/md/dm-crypt.c",
            "drivers/md/dm-verity-target.c",
            "drivers/md/dm-verity.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b825e0f9d68c178072bffd32dd34c39e3d2d597a",
              "status": "affected",
              "version": "39d42fa96ba1b7d2544db3f8ed5da8fb0d5cb877",
              "versionType": "git"
            },
            {
              "lessThan": "30884a44e0cedc3dfda8c22432f3ba4078ec2d94",
              "status": "affected",
              "version": "39d42fa96ba1b7d2544db3f8ed5da8fb0d5cb877",
              "versionType": "git"
            },
            {
              "lessThan": "5735a2671ffb70ea29ca83969fe01316ee2ed6fc",
              "status": "affected",
              "version": "39d42fa96ba1b7d2544db3f8ed5da8fb0d5cb877",
              "versionType": "git"
            },
            {
              "lessThan": "0c45a20cbe68bc4d681734f5c03891124a274257",
              "status": "affected",
              "version": "39d42fa96ba1b7d2544db3f8ed5da8fb0d5cb877",
              "versionType": "git"
            },
            {
              "lessThan": "0a9bab391e336489169b95cb0d4553d921302189",
              "status": "affected",
              "version": "39d42fa96ba1b7d2544db3f8ed5da8fb0d5cb877",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/md/dm-crypt.c",
            "drivers/md/dm-verity-target.c",
            "drivers/md/dm-verity.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.9"
            },
            {
              "lessThan": "5.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.169",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.79",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.18",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.8",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.169",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.79",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.18",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.6",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm-crypt, dm-verity: disable tasklets\n\nTasklets have an inherent problem with memory corruption. The function\ntasklet_action_common calls tasklet_trylock, then it calls the tasklet\ncallback and then it calls tasklet_unlock. If the tasklet callback frees\nthe structure that contains the tasklet or if it calls some code that may\nfree it, tasklet_unlock will write into free memory.\n\nThe commits 8e14f610159d and d9a02e016aaf try to fix it for dm-crypt, but\nit is not a sufficient fix and the data corruption can still happen [1].\nThere is no fix for dm-verity and dm-verity will write into free memory\nwith every tasklet-processed bio.\n\nThere will be atomic workqueues implemented in the kernel 6.9 [2]. They\nwill have better interface and they will not suffer from the memory\ncorruption problem.\n\nBut we need something that stops the memory corruption now and that can be\nbackported to the stable kernels. So, I\u0027m proposing this commit that\ndisables tasklets in both dm-crypt and dm-verity. This commit doesn\u0027t\nremove the tasklet support, because the tasklet code will be reused when\natomic workqueues will be implemented.\n\n[1] https://lore.kernel.org/all/d390d7ee-f142-44d3-822a-87949e14608b@suse.de/T/\n[2] https://lore.kernel.org/lkml/20240130091300.2968534-1-tj@kernel.org/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-04T08:54:44.383Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b825e0f9d68c178072bffd32dd34c39e3d2d597a"
        },
        {
          "url": "https://git.kernel.org/stable/c/30884a44e0cedc3dfda8c22432f3ba4078ec2d94"
        },
        {
          "url": "https://git.kernel.org/stable/c/5735a2671ffb70ea29ca83969fe01316ee2ed6fc"
        },
        {
          "url": "https://git.kernel.org/stable/c/0c45a20cbe68bc4d681734f5c03891124a274257"
        },
        {
          "url": "https://git.kernel.org/stable/c/0a9bab391e336489169b95cb0d4553d921302189"
        }
      ],
      "title": "dm-crypt, dm-verity: disable tasklets",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-26718",
    "datePublished": "2024-04-03T14:55:18.756Z",
    "dateReserved": "2024-02-19T14:20:24.161Z",
    "dateUpdated": "2025-05-04T08:54:44.383Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/30884a44e0cedc3dfda8c22432f3ba4078ec2d94\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/5735a2671ffb70ea29ca83969fe01316ee2ed6fc\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/0c45a20cbe68bc4d681734f5c03891124a274257\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/0a9bab391e336489169b95cb0d4553d921302189\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T00:14:12.969Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-26718\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T15:52:23.335095Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:16.504Z\"}}], \"cna\": {\"title\": \"dm-crypt, dm-verity: disable tasklets\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"39d42fa96ba1b7d2544db3f8ed5da8fb0d5cb877\", \"lessThan\": \"b825e0f9d68c178072bffd32dd34c39e3d2d597a\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"39d42fa96ba1b7d2544db3f8ed5da8fb0d5cb877\", \"lessThan\": \"30884a44e0cedc3dfda8c22432f3ba4078ec2d94\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"39d42fa96ba1b7d2544db3f8ed5da8fb0d5cb877\", \"lessThan\": \"5735a2671ffb70ea29ca83969fe01316ee2ed6fc\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"39d42fa96ba1b7d2544db3f8ed5da8fb0d5cb877\", \"lessThan\": \"0c45a20cbe68bc4d681734f5c03891124a274257\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"39d42fa96ba1b7d2544db3f8ed5da8fb0d5cb877\", \"lessThan\": \"0a9bab391e336489169b95cb0d4553d921302189\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/md/dm-crypt.c\", \"drivers/md/dm-verity-target.c\", \"drivers/md/dm-verity.h\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.9\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.9\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.15.169\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.79\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.18\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.7.6\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.7.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/md/dm-crypt.c\", \"drivers/md/dm-verity-target.c\", \"drivers/md/dm-verity.h\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/b825e0f9d68c178072bffd32dd34c39e3d2d597a\"}, {\"url\": \"https://git.kernel.org/stable/c/30884a44e0cedc3dfda8c22432f3ba4078ec2d94\"}, {\"url\": \"https://git.kernel.org/stable/c/5735a2671ffb70ea29ca83969fe01316ee2ed6fc\"}, {\"url\": \"https://git.kernel.org/stable/c/0c45a20cbe68bc4d681734f5c03891124a274257\"}, {\"url\": \"https://git.kernel.org/stable/c/0a9bab391e336489169b95cb0d4553d921302189\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndm-crypt, dm-verity: disable tasklets\\n\\nTasklets have an inherent problem with memory corruption. The function\\ntasklet_action_common calls tasklet_trylock, then it calls the tasklet\\ncallback and then it calls tasklet_unlock. If the tasklet callback frees\\nthe structure that contains the tasklet or if it calls some code that may\\nfree it, tasklet_unlock will write into free memory.\\n\\nThe commits 8e14f610159d and d9a02e016aaf try to fix it for dm-crypt, but\\nit is not a sufficient fix and the data corruption can still happen [1].\\nThere is no fix for dm-verity and dm-verity will write into free memory\\nwith every tasklet-processed bio.\\n\\nThere will be atomic workqueues implemented in the kernel 6.9 [2]. They\\nwill have better interface and they will not suffer from the memory\\ncorruption problem.\\n\\nBut we need something that stops the memory corruption now and that can be\\nbackported to the stable kernels. So, I\u0027m proposing this commit that\\ndisables tasklets in both dm-crypt and dm-verity. This commit doesn\u0027t\\nremove the tasklet support, because the tasklet code will be reused when\\natomic workqueues will be implemented.\\n\\n[1] https://lore.kernel.org/all/d390d7ee-f142-44d3-822a-87949e14608b@suse.de/T/\\n[2] https://lore.kernel.org/lkml/20240130091300.2968534-1-tj@kernel.org/\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.169\", \"versionStartIncluding\": \"5.9\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.79\", \"versionStartIncluding\": \"5.9\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.18\", \"versionStartIncluding\": \"5.9\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.7.6\", \"versionStartIncluding\": \"5.9\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8\", \"versionStartIncluding\": \"5.9\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2025-05-04T08:54:44.383Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-26718\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-05-04T08:54:44.383Z\", \"dateReserved\": \"2024-02-19T14:20:24.161Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-04-03T14:55:18.756Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.