Overview
About vulnerability
In the Linux kernel, the following vulnerability has been resolved:
md/raid10: fix null-ptr-deref in raid10_sync_request
init_resync() inits mempool and sets conf->have_replacemnt at the beginning of sync, close_sync() frees the mempool when sync is completed.
After [1] recovery might be skipped and init_resync() is called but close_sync() is not. null-ptr-deref occurs with r10bio->dev[i].repl_bio.
The following is one way to reproduce the issue.
- create a array, wait for resync to complete, mddev->recovery_cp is set to MaxSector.
- recovery is woken and it is skipped. conf->have_replacement is set to 0 in init_resync(). close_sync() not called.
- some io errors and rdev A is set to WantReplacement.
- a new device is added and set to A’s replacement.
- recovery is woken, A have replacement, but conf->have_replacemnt is
- r10bio->dev[i].repl_bio will not be alloced and null-ptr-deref occurs.
Fix it by not calling init_resync() if recovery skipped.
[1] commit 7e83ccbecd60 (“md/raid10: Allow skipping recovery when clean arrays are assembled”)
Details
- Affected product:
- AlmaLinux 9.2 ESU , CentOS 8.4 ELS , CentOS 8.5 ELS , CentOS Stream 8 ELS , TuxCare 9.6 ESU
- Affected packages:
- kernel @ 5.14.0 (+4 more)
Fixes
KernelCare state
Live-patch status from KernelCare for each operating system.
| Operating system | Status | Covered kernels |
|---|---|---|
| AlmaLinux 9.2 ESU | Released |
12 kernels
|
| Amazon Linux 2023 | Planned | — |
| Amazon Linux 2 5.10 | Planned | — |
| Amazon Linux 2 5.4 | Planned | — |
| Debian 11 | Planned | — |
| Debian 12 | Planned | — |
| RHEL 8 | Planned | — |
| RHEL 9 | Will Not Fix | — |
| Ubuntu 20.04 | Planned | — |
| Ubuntu 22.04 | Planned | — |