Impact Analysis

This vulnerability can lead to out-of-bounds writes in kernel memory, which may cause the Linux kernel to crash. Such crashes can result in system instability, data loss, or denial of service.

Because the issue occurs in the device-mapper subsystem, systems using device-mapper targets with very large sizes and small region sizes are particularly at risk.

An attacker with local access could potentially trigger this vulnerability to cause a denial of service by crashing the kernel.

Useful 0 Not Useful 0

Executive Summary

This vulnerability exists in the Linux kernel's device-mapper log (dm log) subsystem. It is caused by an out-of-bounds write due to an overflow in the region_count variable. Specifically, region_count is a 32-bit unsigned integer, but it is assigned a value from a 64-bit division result without proper handling. When the device-mapper target length is very large and the region size is small, the division result can exceed the maximum value of a 32-bit integer, causing truncation.

Because of this truncation, memory allocations for bitsets (clean_bits, sync_bits, recovering_bits) are smaller than needed. Later operations that use region indices based on the full 64-bit value write outside the allocated memory bounds, leading to out-of-bounds kernel heap writes. This can cause kernel crashes.

The issue can be reproduced by creating a mirror target with a region_count that overflows 32 bits, which results in incorrect status output and eventually a kernel crash.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking for the creation of device-mapper targets with region_count values that overflow 32 bits. Specifically, you can reproduce or detect the issue by creating a mirror target with a very large length and a small region size, which causes the region_count to overflow.

The following commands demonstrate how to create such targets and check their status, which can help detect the vulnerability:

• dmsetup create bigzero --table '0 8589934594 zero'
• dmsetup create mymirror --table '0 8589934594 mirror core 2 2 nosync 2 /dev/mapper/bigzero 0 /dev/mapper/bigzero 0'
• dmsetup status mymirror

The status output will show a truncated sync_count (e.g., 1 instead of 4294967297), indicating the overflow and presence of the vulnerability.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation involves applying the fix that widens the local region_count variable to 64 bits (sector_t) and adds an explicit overflow check before assigning the value. This fix prevents out-of-bounds writes and kernel crashes.

Until the fix is applied, avoid creating device-mapper targets with very large lengths and small region sizes that could cause the region_count to overflow 32 bits.

Additionally, monitor kernel logs for crashes related to dm_log, such as BUG messages involving core_in_sync and scheduling while atomic errors.

Useful 0 Not Useful 0