Описание
In the Linux kernel, the following vulnerability has been resolved:
md/raid10: fix writes_pending and barrier reference leaks on discard failures
raid10_make_request() acquires a writes_pending reference with
md_write_start() before calling raid10_handle_discard(). Several failure
paths in raid10_handle_discard() complete the bio and return without
releasing the corresponding reference, causing md_write_end() to be
skipped.
Call md_write_end() before returning from these failure paths to keep
writes_pending accounting balanced.
Additionally, discard split allocation failures can occur after
wait_barrier() succeeds. Those paths return without calling
allow_barrier(), leaking the associated barrier reference.
Release the barrier before returning from those paths.
A flaw was found in the Linux kernel's multiple device (MD) driver, specifically in the RAID10 implementation. This vulnerability occurs due to reference leaks in the writes_pending and barrier mechanisms during discard failures. An attacker could potentially exploit this by triggering discard failures, leading to resource exhaustion and a Denial of Service (DoS) on the affected system.
Отчет
A flaw of moderate severity was found in the Linux kernel's multiple device (md) driver, in the RAID10 implementation. When handling discard requests, several failure paths in raid10_handle_discard() complete the bio without releasing the writes_pending reference acquired by md_write_start(), and allocation failures of discard splits after wait_barrier() can return without calling allow_barrier(), leaking a barrier reference. A local attacker able to trigger discard failures against an md RAID10 array could exploit these reference leaks to leave write accounting or barrier state unbalanced, which can stall later writes or array recovery operations and result in a denial of service for the array. The flaw affects availability only; there is no impact on confidentiality or integrity. Red Hat Enterprise Linux 7 and the RHEL 8.4 and 8.6 update streams are not affected because the vulnerable code is not present in those kernels. The affected RHEL 8, RHEL 9, and RHEL 10 kernel and kernel-rt streams and the Red Hat In-Vehicle OS 2 kernel streams are affected, with the fix deferred to a future update; the residual risk is a local denial of service limited to md RAID10 arrays. Red Hat rates this flaw Moderate severity (CVSS 3.1 score 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) because exploitation requires local access able to issue discard I/O and is not network-reachable. This differs from the upstream CVE record, which assigns a higher score (7.5) using a network attack vector that does not match the verified attack path.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 6 | kernel | Out of support scope | ||
| Red Hat Enterprise Linux 7 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 8 | kernel-rt | Fix deferred | ||
| Red Hat Enterprise Linux 9 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 9 | kernel-rt | Fix deferred |
Показывать по
Дополнительная информация
Статус:
EPSS
5.5 Medium
CVSS3
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: md/raid10: fix writes_pending and barrier reference leaks on discard failures raid10_make_request() acquires a writes_pending reference with md_write_start() before calling raid10_handle_discard(). Several failure paths in raid10_handle_discard() complete the bio and return without releasing the corresponding reference, causing md_write_end() to be skipped. Call md_write_end() before returning from these failure paths to keep writes_pending accounting balanced. Additionally, discard split allocation failures can occur after wait_barrier() succeeds. Those paths return without calling allow_barrier(), leaking the associated barrier reference. Release the barrier before returning from those paths.
In the Linux kernel, the following vulnerability has been resolved: md/raid10: fix writes_pending and barrier reference leaks on discard failures raid10_make_request() acquires a writes_pending reference with md_write_start() before calling raid10_handle_discard(). Several failure paths in raid10_handle_discard() complete the bio and return without releasing the corresponding reference, causing md_write_end() to be skipped. Call md_write_end() before returning from these failure paths to keep writes_pending accounting balanced. Additionally, discard split allocation failures can occur after wait_barrier() succeeds. Those paths return without calling allow_barrier(), leaking the associated barrier reference. Release the barrier before returning from those paths.
md/raid10: fix writes_pending and barrier reference leaks on discard failures
In the Linux kernel, the following vulnerability has been resolved: m ...
In the Linux kernel, the following vulnerability has been resolved: md/raid10: fix writes_pending and barrier reference leaks on discard failures raid10_make_request() acquires a writes_pending reference with md_write_start() before calling raid10_handle_discard(). Several failure paths in raid10_handle_discard() complete the bio and return without releasing the corresponding reference, causing md_write_end() to be skipped. Call md_write_end() before returning from these failure paths to keep writes_pending accounting balanced. Additionally, discard split allocation failures can occur after wait_barrier() succeeds. Those paths return without calling allow_barrier(), leaking the associated barrier reference. Release the barrier before returning from those paths.
EPSS
5.5 Medium
CVSS3