{"id":"CVE-2024-50279","summary":"dm cache: fix out-of-bounds access to the dirty bitset when resizing","details":"In the Linux kernel, the following vulnerability has been resolved:\n\ndm cache: fix out-of-bounds access to the dirty bitset when resizing\n\ndm-cache checks the dirty bits of the cache blocks to be dropped when\nshrinking the fast device, but an index bug in bitset iteration causes\nout-of-bounds access.\n\nReproduce steps:\n\n1. create a cache device of 1024 cache blocks (128 bytes dirty bitset)\n\ndmsetup create cmeta --table \"0 8192 linear /dev/sdc 0\"\ndmsetup create cdata --table \"0 131072 linear /dev/sdc 8192\"\ndmsetup create corig --table \"0 524288 linear /dev/sdc 262144\"\ndd if=/dev/zero of=/dev/mapper/cmeta bs=4k count=1 oflag=direct\ndmsetup create cache --table \"0 524288 cache /dev/mapper/cmeta \\\n/dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 writethrough smq 0\"\n\n2. shrink the fast device to 512 cache blocks, triggering out-of-bounds\n   access to the dirty bitset (offset 0x80)\n\ndmsetup suspend cache\ndmsetup reload cdata --table \"0 65536 linear /dev/sdc 8192\"\ndmsetup resume cdata\ndmsetup resume cache\n\nKASAN reports:\n\n  BUG: KASAN: vmalloc-out-of-bounds in cache_preresume+0x269/0x7b0\n  Read of size 8 at addr ffffc900000f3080 by task dmsetup/131\n\n  (...snip...)\n  The buggy address belongs to the virtual mapping at\n   [ffffc900000f3000, ffffc900000f5000) created by:\n   cache_ctr+0x176a/0x35f0\n\n  (...snip...)\n  Memory state around the buggy address:\n   ffffc900000f2f80: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8\n   ffffc900000f3000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n  \u003effffc900000f3080: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8\n                     ^\n   ffffc900000f3100: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8\n   ffffc900000f3180: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8\n\nFix by making the index post-incremented.","modified":"2026-05-15T11:53:44.898667670Z","published":"2024-11-19T01:30:20.712Z","related":["SUSE-SU-2024:4313-1","SUSE-SU-2024:4314-1","SUSE-SU-2024:4315-1","SUSE-SU-2024:4316-1","SUSE-SU-2024:4317-1","SUSE-SU-2024:4318-1","SUSE-SU-2024:4345-1","SUSE-SU-2024:4346-1","SUSE-SU-2024:4364-1","SUSE-SU-2024:4367-1","SUSE-SU-2024:4376-1","SUSE-SU-2024:4387-1","SUSE-SU-2024:4388-1","SUSE-SU-2025:0035-1","SUSE-SU-2025:0117-1","SUSE-SU-2025:0154-1","SUSE-SU-2025:0201-1","SUSE-SU-2025:0201-2","SUSE-SU-2025:02069-1","SUSE-SU-2025:02070-1","SUSE-SU-2025:02071-1","SUSE-SU-2025:02075-1","SUSE-SU-2025:02076-1","SUSE-SU-2025:02077-1","SUSE-SU-2025:02095-1","SUSE-SU-2025:02096-1","SUSE-SU-2025:02101-1","SUSE-SU-2025:02106-1","SUSE-SU-2025:02107-1","SUSE-SU-2025:02110-1","SUSE-SU-2025:02111-1","SUSE-SU-2025:02113-1","SUSE-SU-2025:02116-1","SUSE-SU-2025:02117-1","SUSE-SU-2025:02124-1","SUSE-SU-2025:02125-1","SUSE-SU-2025:02126-1","SUSE-SU-2025:02127-1","SUSE-SU-2025:02131-1","SUSE-SU-2025:02134-1","SUSE-SU-2025:02136-1","SUSE-SU-2025:02139-1","SUSE-SU-2025:02140-1","SUSE-SU-2025:02142-1","SUSE-SU-2025:02144-1","SUSE-SU-2025:02154-1","SUSE-SU-2025:02157-1","SUSE-SU-2025:02162-1","SUSE-SU-2025:02171-1","SUSE-SU-2025:0229-1","SUSE-SU-2025:0289-1","SUSE-SU-2025:20163-1","SUSE-SU-2025:20164-1","SUSE-SU-2025:20246-1","SUSE-SU-2025:20247-1","SUSE-SU-2025:20431-1","SUSE-SU-2025:20435-1","SUSE-SU-2025:20436-1","SUSE-SU-2025:20437-1","SUSE-SU-2025:20448-1","SUSE-SU-2025:20450-1","SUSE-SU-2025:4123-1","USN-7276-1","USN-7277-1"],"database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/50xxx/CVE-2024-50279.json","cna_assigner":"Linux"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/3b02c40ff10fdf83cc545850db208de855ebe22c"},{"type":"WEB","url":"https://git.kernel.org/stable/c/4fa4feb873cea0e9d6ff883b37cca6f33169d8b4"},{"type":"WEB","url":"https://git.kernel.org/stable/c/56507203e1b6127967ec2b51fb0b23a0d4af1334"},{"type":"WEB","url":"https://git.kernel.org/stable/c/792227719725497ce10a8039803bec13f89f8910"},{"type":"WEB","url":"https://git.kernel.org/stable/c/8501e38dc9e0060814c4085815fc83da3e6d43bf"},{"type":"WEB","url":"https://git.kernel.org/stable/c/e57648ce325fa405fe6bbd0e6a618ced7c301a2d"},{"type":"WEB","url":"https://git.kernel.org/stable/c/ee1f74925717ab36f6a091104c170639501ce818"},{"type":"WEB","url":"https://git.kernel.org/stable/c/ff1dd8a04c30e8d4e2fd5c83198ca672eb6a9e7f"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/50xxx/CVE-2024-50279.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50279"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.13.0"},{"fixed":"4.19.324"}]},{"type":"ECOSYSTEM","events":[{"introduced":"4.20.0"},{"fixed":"5.4.286"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.5.0"},{"fixed":"5.10.230"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.11.0"},{"fixed":"5.15.172"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.16.0"},{"fixed":"6.1.117"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.6.61"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.11.8"}]}],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-50279.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"}]}