CVE-2024-26844
published 2024-04-17CVE-2024-26844: In the Linux kernel, the following vulnerability has been resolved: block: Fix WARNING in _copy_from_iter Syzkaller reports a warning in _copy_from_iter…
PriorityP420medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.22%
13.2th percentile
In the Linux kernel, the following vulnerability has been resolved:
block: Fix WARNING in _copy_from_iter
Syzkaller reports a warning in _copy_from_iter because an
iov_iter is supposedly used in the wrong direction. The reason
is that syzcaller managed to generate a request with
a transfer direction of SG_DXFER_TO_FROM_DEV. This instructs
the kernel to copy user buffers into the kernel, read into
the copied buffers and then copy the data back to user space.
Thus the iovec is used in both directions.
Detect this situation in the block layer and construct a new
iterator with the correct direction for the copy-in.
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.1.82-1 (bookworm) | linux 6.1.82-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= 9124d3fe21b0947b03f4b87bcfb7acd675d6e85b < 8fc80874103a5c20aebdc2401361aa01c817f75b | 8fc80874103a5c20aebdc2401361aa01c817f75b |
| linux | linux | >= 9124d3fe21b0947b03f4b87bcfb7acd675d6e85b < 0f1bae071de9967602807472921829a54b2e5956 | 0f1bae071de9967602807472921829a54b2e5956 |
| linux | linux | >= 9124d3fe21b0947b03f4b87bcfb7acd675d6e85b < cbaf9be337f7da25742acfce325119e3395b1f1b | cbaf9be337f7da25742acfce325119e3395b1f1b |
| linux | linux | >= 9124d3fe21b0947b03f4b87bcfb7acd675d6e85b < 13f3956eb5681a4045a8dfdef48df5dc4d9f58a6 | 13f3956eb5681a4045a8dfdef48df5dc4d9f58a6 |
| linux | linux_kernel | < 6.1.80 | 6.1.80 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 6.1.82-1 | 6.1.82-1 |
| linux | linux_kernel | >= 0 < 6.7.7-1 | 6.7.7-1 |
| linux | linux_kernel | >= 0 < 6.7.7-1 | 6.7.7-1 |
| linux | linux_kernel | >= 6.2 < 6.6.19 | 6.6.19 |
| linux | linux_kernel | >= 6.7 < 6.7.7 | 6.7.7 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-6j6x-q3pw-5hr9: In the Linux kernel, the following vulnerability has been resolved:
block: Fix WARNING in _copy_from_iter
Syzkaller reports a warning in _copy_from_
ghsa_unreviewed·2024-04-17
CVE-2024-26844 [MEDIUM] GHSA-6j6x-q3pw-5hr9: In the Linux kernel, the following vulnerability has been resolved:
block: Fix WARNING in _copy_from_iter
Syzkaller reports a warning in _copy_from_
In the Linux kernel, the following vulnerability has been resolved:
block: Fix WARNING in _copy_from_iter
Syzkaller reports a warning in _copy_from_iter because an
iov_iter is supposedly used in the wrong direction. The reason
is that syzcaller managed to generate a request with
a transfer direction of SG_DXFER_TO_FROM_DEV. This instructs
the kernel to copy user buffers into the kernel, read into
the copied buffers and then copy the data back to user space.
Thus the iovec is used in both directions.
Detect this situation in the block layer and construct a new
iterator with the correct direction for the copy-in.
OSV
CVE-2024-26844: In the Linux kernel, the following vulnerability has been resolved: block: Fix WARNING in _copy_from_iter Syzkaller reports a warning in _copy_from_it
osv·2024-04-17·CVSS 5.5
CVE-2024-26844 [MEDIUM] CVE-2024-26844: In the Linux kernel, the following vulnerability has been resolved: block: Fix WARNING in _copy_from_iter Syzkaller reports a warning in _copy_from_it
In the Linux kernel, the following vulnerability has been resolved: block: Fix WARNING in _copy_from_iter Syzkaller reports a warning in _copy_from_iter because an iov_iter is supposedly used in the wrong direction. The reason is that syzcaller managed to generate a request with a transfer direction of SG_DXFER_TO_FROM_DEV. This instructs the kernel to copy user buffers into the kernel, read into the copied buffers and then copy the data back to user space. Thus the iovec is used in both directions. Detect this situation in the block layer and construct a new iterator with the correct direction for the copy-in.
Red Hat
kernel: block: Fix WARNING in _copy_from_iter
vendor_redhat·2024-04-17·CVSS 5.5
CVE-2024-26844 [MEDIUM] CWE-1098 kernel: block: Fix WARNING in _copy_from_iter
kernel: block: Fix WARNING in _copy_from_iter
In the Linux kernel, the following vulnerability has been resolved:
block: Fix WARNING in _copy_from_iter
Syzkaller reports a warning in _copy_from_iter because an
iov_iter is supposedly used in the wrong direction. The reason
is that syzcaller managed to generate a request with
a transfer direction of SG_DXFER_TO_FROM_DEV. This instructs
the kernel to copy user buffers into the kernel, read into
the copied buffers and then copy the data back to user space.
Thus the iovec is used in both directions.
Detect this situation in the block layer and construct a new
iterator with the correct direction for the copy-in.
Package: kernel (Red Hat Enterprise Linux 6) - Out of support scope
Package: kernel (Red Hat Enterprise Linux 7) - Out of support sc
Debian
CVE-2024-26844: linux - In the Linux kernel, the following vulnerability has been resolved: block: Fix ...
vendor_debian·2024·CVSS 5.5
CVE-2024-26844 [MEDIUM] CVE-2024-26844: linux - In the Linux kernel, the following vulnerability has been resolved: block: Fix ...
In the Linux kernel, the following vulnerability has been resolved: block: Fix WARNING in _copy_from_iter Syzkaller reports a warning in _copy_from_iter because an iov_iter is supposedly used in the wrong direction. The reason is that syzcaller managed to generate a request with a transfer direction of SG_DXFER_TO_FROM_DEV. This instructs the kernel to copy user buffers into the kernel, read into the copied buffers and then copy the data back to user space. Thus the iovec is used in both directions. Detect this situation in the block layer and construct a new iterator with the correct direction for the copy-in.
Scope: local
bookworm: resolved (fixed in 6.1.82-1)
bullseye: open
forky: resolved (fixed in 6.7.7-1)
sid: resolved (fixed in 6.7.7-1)
trixie: resolved (fixed in 6.7.7-1)
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/0f1bae071de9967602807472921829a54b2e5956https://git.kernel.org/stable/c/13f3956eb5681a4045a8dfdef48df5dc4d9f58a6https://git.kernel.org/stable/c/8fc80874103a5c20aebdc2401361aa01c817f75bhttps://git.kernel.org/stable/c/cbaf9be337f7da25742acfce325119e3395b1f1bhttps://git.kernel.org/stable/c/0f1bae071de9967602807472921829a54b2e5956https://git.kernel.org/stable/c/13f3956eb5681a4045a8dfdef48df5dc4d9f58a6https://git.kernel.org/stable/c/8fc80874103a5c20aebdc2401361aa01c817f75bhttps://git.kernel.org/stable/c/cbaf9be337f7da25742acfce325119e3395b1f1b
2024-04-17
Published