{"id":"CVE-2024-50278","summary":"dm cache: fix potential out-of-bounds access on the first resume","details":"In the Linux kernel, the following vulnerability has been resolved:\n\ndm cache: fix potential out-of-bounds access on the first resume\n\nOut-of-bounds access occurs if the fast device is expanded unexpectedly\nbefore the first-time resume of the cache table. This happens because\nexpanding the fast device requires reloading the cache table for\ncache_create to allocate new in-core data structures that fit the new\nsize, and the check in cache_preresume is not performed during the\nfirst resume, leading to the issue.\n\nReproduce steps:\n\n1. prepare component devices:\n\ndmsetup create cmeta --table \"0 8192 linear /dev/sdc 0\"\ndmsetup create cdata --table \"0 65536 linear /dev/sdc 8192\"\ndmsetup create corig --table \"0 524288 linear /dev/sdc 262144\"\ndd if=/dev/zero of=/dev/mapper/cmeta bs=4k count=1 oflag=direct\n\n2. load a cache table of 512 cache blocks, and deliberately expand the\n   fast device before resuming the cache, making the in-core data\n   structures inadequate.\n\ndmsetup create cache --notable\ndmsetup reload cache --table \"0 524288 cache /dev/mapper/cmeta \\\n/dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 writethrough smq 0\"\ndmsetup reload cdata --table \"0 131072 linear /dev/sdc 8192\"\ndmsetup resume cdata\ndmsetup resume cache\n\n3. suspend the cache to write out the in-core dirty bitset and hint\n   array, leading to out-of-bounds access to the dirty bitset at offset\n   0x40:\n\ndmsetup suspend cache\n\nKASAN reports:\n\n  BUG: KASAN: vmalloc-out-of-bounds in is_dirty_callback+0x2b/0x80\n  Read of size 8 at addr ffffc90000085040 by task dmsetup/90\n\n  (...snip...)\n  The buggy address belongs to the virtual mapping at\n   [ffffc90000085000, ffffc90000087000) created by:\n   cache_ctr+0x176a/0x35f0\n\n  (...snip...)\n  Memory state around the buggy address:\n   ffffc90000084f00: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8\n   ffffc90000084f80: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8\n  \u003effffc90000085000: 00 00 00 00 00 00 00 00 f8 f8 f8 f8 f8 f8 f8 f8\n                                             ^\n   ffffc90000085080: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8\n   ffffc90000085100: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8\n\nFix by checking the size change on the first resume.","modified":"2026-04-02T12:21:22.815148Z","published":"2024-11-19T01:30:19.352Z","related":["SUSE-SU-2024:4367-1","SUSE-SU-2025:0035-1","SUSE-SU-2025:0117-1","SUSE-SU-2025:0153-1","SUSE-SU-2025:0154-1","SUSE-SU-2025:0201-1","SUSE-SU-2025:0201-2","SUSE-SU-2025:0229-1","SUSE-SU-2025:0236-1","SUSE-SU-2025:0289-1","SUSE-SU-2025:20165-1","SUSE-SU-2025:20166-1","SUSE-SU-2025:20248-1","SUSE-SU-2025:20249-1","USN-7276-1","USN-7277-1"],"database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/50xxx/CVE-2024-50278.json"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/036dd6e3d2638103e0092864577ea1d091466b86"},{"type":"WEB","url":"https://git.kernel.org/stable/c/13ed3624c6ef283acefa4cc42cc8ae54fd4391a4"},{"type":"WEB","url":"https://git.kernel.org/stable/c/2222b0929d00e2d13732b799b63be391b5de4492"},{"type":"WEB","url":"https://git.kernel.org/stable/c/483b7261b35a9d369082ab298a6670912243f0be"},{"type":"WEB","url":"https://git.kernel.org/stable/c/c0ade5d98979585d4f5a93e4514c2e9a65afa08d"},{"type":"WEB","url":"https://git.kernel.org/stable/c/c52ec00cb2f9bebfada22edcc0db385b910a1cdb"},{"type":"WEB","url":"https://git.kernel.org/stable/c/e492f71854ce03474d49e87fd98b8df1f7cd1d2d"},{"type":"WEB","url":"https://git.kernel.org/stable/c/fdef3b94dfebd57e3077a578b6e309a2bb6fa688"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/50xxx/CVE-2024-50278.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50278"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"f494a9c6b1b6dd9a9f21bbb75d9210d478eeb498"},{"fixed":"e492f71854ce03474d49e87fd98b8df1f7cd1d2d"},{"fixed":"2222b0929d00e2d13732b799b63be391b5de4492"},{"fixed":"483b7261b35a9d369082ab298a6670912243f0be"},{"fixed":"fdef3b94dfebd57e3077a578b6e309a2bb6fa688"},{"fixed":"c52ec00cb2f9bebfada22edcc0db385b910a1cdb"},{"fixed":"036dd6e3d2638103e0092864577ea1d091466b86"},{"fixed":"13ed3624c6ef283acefa4cc42cc8ae54fd4391a4"},{"fixed":"c0ade5d98979585d4f5a93e4514c2e9a65afa08d"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-50278.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"}]}