CVE-2024-39482

Summary

In the Linux kernel, the following vulnerability has been resolved:

bcache: fix variable length array abuse in btree_iter

btree_iter is used in two ways: either allocated on the stack with a fixed size MAX_BSETS, or from a mempool with a dynamic size based on the specific cache set. Previously, the struct had a fixed-length array of size MAX_BSETS which was indexed out-of-bounds for the dynamically-sized iterators, which causes UBSAN to complain.

This patch uses the same approach as in bcachefs's sort_iter and splits the iterator into a btree_iter with a flexible array member and a btree_iter_stack which embeds a btree_iter as well as a fixed-length data array.

Affected Software

VendorProductVersion RangeStatus
LinuxLinuxcafe563591446cf80bfbc2fe3bc72a2e36cf1060 < 2c3d7b03b658dc8bfa6112b194b67b92a87e081baffected
LinuxLinuxcafe563591446cf80bfbc2fe3bc72a2e36cf1060 < 5a1922adc5798b7ec894cd3f197afb6f9591b023affected
LinuxLinuxcafe563591446cf80bfbc2fe3bc72a2e36cf1060 < 934e1e4331859183a861f396d7dfaf33cb5afb02affected
LinuxLinuxcafe563591446cf80bfbc2fe3bc72a2e36cf1060 < 6479b9f41583b013041943c4602e1ad61cec8148affected
LinuxLinuxcafe563591446cf80bfbc2fe3bc72a2e36cf1060 < 0c31344e22dd8d6b1394c6e4c41d639015bdc671affected
LinuxLinuxcafe563591446cf80bfbc2fe3bc72a2e36cf1060 < 3a861560ccb35f2a4f0a4b8207fa7c2a35fc7f31affected
LinuxLinux3.10affected
LinuxLinux0 < 3.10unaffected
LinuxLinux5.10.221 <= 5.10.*unaffected
LinuxLinux5.15.162 <= 5.15.*unaffected
LinuxLinux6.1.94 <= 6.1.*unaffected
LinuxLinux6.6.34 <= 6.6.*unaffected
LinuxLinux6.9.5 <= 6.9.*unaffected
LinuxLinux6.10 <= *unaffected

Weaknesses

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

CVE Program Container

Additional References

Additional References

References