SECUFOCUSNOW
Home›CVE index›CVE-2024-38384
Review reviewHigh

CVE-2024-38384

Linux Linux, linux_kernel, linux kernel

In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: fix list corruption from reorder of WRITE ->lqueued __blkcg_rstat_flush() can be run anytime, especially when blk_cgroup_bio_start is being executed. If WRITE of `->lqueued` is re-ordered with READ of 'bisc->lnode.next' in the loop of __blkcg_rstat_flush(), `next_bisc` can be assigned with one stat instance being added in blk_cgroup_bio_start(), then the local list in __blkcg_rstat_flush() could be corrupted. Fix the issue by adding one barrier.

CVSS
7.8
EPSS
0.24%
14.6% percentile
CISA KEV
Not listed
Published
2024.06.24
PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV
Exploit probability0.24%
Technical severityCVSS 7.8

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: fix list corruption from reorder of WRITE ->lqueued __blkcg_rstat_flush() can be run anytime, especially when blk_cgroup_bio_start is being executed. If WRITE of `->lqueued` is re-ordered with READ of 'bisc->lnode.next' in the loop of __blkcg_rstat_flush(), `next_bisc` can be assigned with one stat instance being added in blk_cgroup_bio_start(), then the local list in __blkcg_rstat_flush() could be corrupted. Fix the issue by adding one barrier.

Affected product and versions

Product
Linux Linux, linux_kernel, linux kernel
Affected versions
>= 3b8cc6298724021da845f2f9fd7dd4b6829a6817 < 714e59b5456e4d6e4295a9968c564abe193f461c, >= 3b8cc6298724021da845f2f9fd7dd4b6829a6817 < 785298ab6b802afa75089239266b6bbea590809c, >= 3b8cc6298724021da845f2f9fd7dd4b6829a6817 < d0aac2363549e12cc79b8e285f13d5a9f42fd08e, >= 6.2, >= 3b8cc6298724 < 714e59b5456e, >= 3b8cc6298724 < 785298ab6b80, >= 3b8cc6298724 < d0aac2363549, >= 6.2 < 6.6.33, >= 6.7 < 6.9.4
Fixed versions
6.6.33, 6.9.4

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
  1. 1
    Identify

    Confirm that Linux Linux, linux_kernel, linux kernel and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE
CWE-400
CVE-2024-38384 — Linux Linux, linux_kernel, linux kernel | SECUFOCUS NOW