{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-38384", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-06-21T11:16:40.612Z", "datePublished": "2024-06-24T13:50:51.033Z", "dateUpdated": "2026-08-05T11:32:34.192Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:32:34.192Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nblk-cgroup: fix list corruption from reorder of WRITE ->lqueued\n\n__blkcg_rstat_flush() can be run anytime, especially when blk_cgroup_bio_start\nis being executed.\n\nIf WRITE of `->lqueued` is re-ordered with READ of 'bisc->lnode.next' in\nthe loop of __blkcg_rstat_flush(), `next_bisc` can be assigned with one\nstat instance being added in blk_cgroup_bio_start(), then the local\nlist in __blkcg_rstat_flush() could be corrupted.\n\nFix the issue by adding one barrier." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerable code is reached through local block-I/O submission (`submit_bio_noacct_nocheck` → `blk_cgroup_bio_start`) and local cgroupfs reads of `io.stat`; there is no network-facing path into blk-cgroup stat accounting.\nAC:L - The attacker drives both sides of the race — continuous bio submission on multiple CPUs plus a tight loop reading `io.stat` (or removing cgroups) to force `blkcg_rstat_flush` — and can retry indefinitely with no cost until the reorder window is hit on any weakly-ordered CPU.\nPR:L - No capability check exists on either code path; any unprivileged local user performing ordinary file I/O inside a non-root cgroup-v2 blkcg (the default for every systemd user session and every container) can reach both `blk_cgroup_bio_start()` and, via their delegated subtree's `io.stat`, the flush side.\nUI:N - The attacker triggers everything from its own processes — I/O submission and stat flushing — with no action required from any other user or administrator.\nS:U - The corruption is confined to kernel block-cgroup structures within the same security authority; no VM, IOMMU, or hypervisor boundary is crossed.\nC:H - Corruption of the lockless list defeats the `__blkg_release()` flush that guarantees no `blkg_iostat_set` is queued before `free_percpu(blkg->iostat_cpu)`, leaving the list pointing into freed per-CPU memory that is then dereferenced (`bisc->blkg`, `blkg->parent`) — a use-after-free read that can be leveraged for kernel memory disclosure.\nI:H - The same stale-pointer condition makes `blkcg_iostat_update()` write through a `blkg` pointer read out of freed memory, giving an attacker-influenceable write primitive; the llist `next` pointers themselves are also corrupted with attacker-timed values.\nA:H - Re-adding a node that is still linked creates a cycle in the lockless list, so the next `__blkcg_rstat_flush()` loops forever while holding the `blkg_stat_lock` raw spinlock with interrupts disabled under `cgroup_rstat_lock` — a hard lockup / kernel panic that wedges the whole system." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "block/blk-cgroup.c" ], "versions": [ { "version": "3b8cc6298724021da845f2f9fd7dd4b6829a6817", "lessThan": "714e59b5456e4d6e4295a9968c564abe193f461c", "status": "affected", "versionType": "git" }, { "version": "3b8cc6298724021da845f2f9fd7dd4b6829a6817", "lessThan": "785298ab6b802afa75089239266b6bbea590809c", "status": "affected", "versionType": "git" }, { "version": "3b8cc6298724021da845f2f9fd7dd4b6829a6817", "lessThan": "d0aac2363549e12cc79b8e285f13d5a9f42fd08e", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "block/blk-cgroup.c" ], "versions": [ { "version": "6.2", "status": "affected" }, { "version": "0", "lessThan": "6.2", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.33", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.9.4", "lessThanOrEqual": "6.9.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.10", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2", "versionEndExcluding": "6.6.33" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2", "versionEndExcluding": "6.9.4" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2", "versionEndExcluding": "6.10" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/714e59b5456e4d6e4295a9968c564abe193f461c" }, { "url": "https://git.kernel.org/stable/c/785298ab6b802afa75089239266b6bbea590809c" }, { "url": "https://git.kernel.org/stable/c/d0aac2363549e12cc79b8e285f13d5a9f42fd08e" } ], "title": "blk-cgroup: fix list corruption from reorder of WRITE ->lqueued", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "problemTypes": [ { "descriptions": [ { "type": "CWE", "cweId": "CWE-400", "lang": "en", "description": "CWE-400 Uncontrolled Resource Consumption" } ] } ], "affected": [ { "vendor": "linux", "product": "linux_kernel", "cpes": [ "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "versions": [ { "version": "3b8cc6298724", "status": "affected", "lessThan": "714e59b5456e", "versionType": "custom" } ] }, { "vendor": "linux", "product": "linux_kernel", "cpes": [ "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "versions": [ { "version": "3b8cc6298724", "status": "affected", "lessThan": "785298ab6b80", "versionType": "custom" } ] }, { "vendor": "linux", "product": "linux_kernel", "cpes": [ "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "versions": [ { "version": "3b8cc6298724", "status": "affected", "lessThan": "d0aac2363549", "versionType": "custom" } ] }, { "vendor": "linux", "product": "linux_kernel", "cpes": [ "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "versions": [ { "version": "6.2", "status": "affected" } ] }, { "vendor": "linux", "product": "linux_kernel", "cpes": [ "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "versions": [ { "version": "0", "status": "unaffected", "lessThan": "6.2", "versionType": "custom" } ] }, { "vendor": "linux", "product": "linux_kernel", "cpes": [ "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "versions": [ { "version": "6.6.33", "status": "unaffected", "lessThanOrEqual": "6.7", "versionType": "custom" } ] }, { "vendor": "linux", "product": "linux_kernel", "cpes": [ "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "versions": [ { "version": "6.9.4", "status": "unaffected", "lessThanOrEqual": "6.10", "versionType": "custom" } ] }, { "vendor": "linux", "product": "linux_kernel", "cpes": [ "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "versions": [ { "version": "6.10-rc1", "status": "unaffected" } ] } ], "metrics": [ { "cvssV3_1": { "scope": "UNCHANGED", "version": "3.1", "baseScore": 8.4, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH" } }, { "other": { "type": "ssvc", "content": { "timestamp": "2024-06-25T13:27:38.979262Z", "id": "CVE-2024-38384", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "total" } ], "role": "CISA Coordinator", "version": "2.0.3" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-25T13:37:27.542Z" } }, { "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T04:04:25.142Z" }, "title": "CVE Program Container", "references": [ { "url": "https://git.kernel.org/stable/c/714e59b5456e4d6e4295a9968c564abe193f461c", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/785298ab6b802afa75089239266b6bbea590809c", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/d0aac2363549e12cc79b8e285f13d5a9f42fd08e", "tags": [ "x_transferred" ] } ] } ] } }