Описание
In the Linux kernel, the following vulnerability has been resolved:
md/raid10: reset read_slot when reusing r10bio for discard
put_all_bios() always drops devs[i].bio, but it only drops
devs[i].repl_bio when r10_bio->read_slot < 0. If discard reuses an
r10bio that was previously used for a read, read_slot can still be
non-negative, and discard cleanup can skip bio_put() on repl_bio.
Reset read_slot to -1 when preparing an r10bio for discard so the
replacement bio is always released correctly.
A flaw was found in the Linux kernel's md/raid10 component. This vulnerability occurs when a specific internal data structure, used for disk operations, is reused for a discard operation without properly resetting a critical flag. This oversight can lead to improper release of system resources, potentially causing system instability or a denial of service (DoS).
Отчет
A flaw of low impact was found in the Linux kernel's md/raid10 driver in Red Hat Enterprise Linux 8, 9, and 10 and Red Hat In-Vehicle OS 2. When a discard operation reuses an r10bio structure that was previously used for a read request, the read_slot field is not reset, so cleanup in put_all_bios() can skip bio_put() on the replacement bio. Repeated discard operations on an md/raid10 array can therefore leak bios and associated memory, resulting in resource exhaustion and a local denial of service. Triggering the flaw requires local access to a system performing discard operations on an md/raid10 array; there is no impact on confidentiality or integrity and the flaw is not network-reachable. The vulnerable code is not present in Red Hat Enterprise Linux 7 Extended Lifecycle Support (kernel and kernel-rt), which is therefore not affected. Because the issue is limited to availability impact from a local actor, with no privilege escalation, information disclosure, or memory corruption involved, the fix is currently deferred for the affected Red Hat products; the residual risk is a local denial of service through resource exhaustion on systems that perform frequent discard operations on md/raid10 arrays. The CVE.org record scores this issue 9.8 CRITICAL, which assumes network-reachable, unauthenticated exploitation with confidentiality and integrity impact; Red Hat assesses this flaw as LOW severity (CVSS 3.1 score 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) because exploitation requires local access and only availability is affected.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 6 | kernel | Out of support scope | ||
| Red Hat Enterprise Linux 7 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 8 | kernel-rt | Fix deferred | ||
| Red Hat Enterprise Linux 9 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 9 | kernel-rt | Fix deferred |
Показывать по
Дополнительная информация
Статус:
EPSS
5.5 Medium
CVSS3
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: md/raid10: reset read_slot when reusing r10bio for discard put_all_bios() always drops devs[i].bio, but it only drops devs[i].repl_bio when r10_bio->read_slot < 0. If discard reuses an r10bio that was previously used for a read, read_slot can still be non-negative, and discard cleanup can skip bio_put() on repl_bio. Reset read_slot to -1 when preparing an r10bio for discard so the replacement bio is always released correctly.
In the Linux kernel, the following vulnerability has been resolved: md/raid10: reset read_slot when reusing r10bio for discard put_all_bios() always drops devs[i].bio, but it only drops devs[i].repl_bio when r10_bio->read_slot < 0. If discard reuses an r10bio that was previously used for a read, read_slot can still be non-negative, and discard cleanup can skip bio_put() on repl_bio. Reset read_slot to -1 when preparing an r10bio for discard so the replacement bio is always released correctly.
In the Linux kernel, the following vulnerability has been resolved: m ...
EPSS
5.5 Medium
CVSS3