dm-era Kernel Memory Out-of-Bounds Access in Linux Kernel

Executive Summary

This vulnerability is in the Linux kernel's device mapper era (dm-era) feature. It involves an out-of-bounds memory access when handling non-zero start sectors in device mapper tables. The issue occurs because era_map() calculates the writeset block before applying the target offset, leading to incorrect block numbers being passed to metadata_current_marked(). This can cause KASAN to report a vmalloc-out-of-bounds access if the block is beyond the writeset size.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability is specific to the Linux kernel's device-mapper era target and requires kernel-level inspection. Detection involves checking kernel logs for KASAN out-of-bounds errors or verifying if your system uses dm-era with non-zero start sectors. Commands like dmesg | grep -i kasan or checking dmsetup table for era targets may help identify affected configurations.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow an attacker to cause a kernel memory corruption issue, potentially leading to system crashes, privilege escalation, or other unintended behavior. Systems using dm-era with non-zero start sectors in device mapper tables are particularly affected.

Useful 0 Not Useful 0

Mitigation Strategies

Apply the Linux kernel patch that fixes the dm-era out-of-bounds access. Update to a patched kernel version. If using dm-era, ensure start sectors are zero or validate configurations to avoid passing absolute block numbers to metadata_current_marked().

Useful 0 Not Useful 0