PT-2024-28108 · Linux+7 · Linux Kernel+7
Ming Lei
·
Published
2024-06-12
·
Updated
2025-09-29
·
CVE-2024-38663
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to 6.6.37
Description
The issue is related to the blk-cgroup component in the Linux kernel, where list corruption can occur when resetting io stat. This happens because each iostat instance is added to the blkcg percpu list, and the
blkcg reset stats() function cannot reset the stat instance using memset(), which may cause the llist to be corrupted. The problem is fixed by only resetting the counter part.Recommendations
To resolve the issue, update the Linux kernel to version 6.6.37 or later. As a temporary workaround, consider restricting access to the vulnerable
blkcg reset stats() function until a patch is available.Exploit
Fix
Buffer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Almalinux
Linuxmint
Linux Kernel
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu