PT-2024-9008 · Linux+5 · Linux Kernel+5
Rik Van Riel
·
Published
2024-04-05
·
Updated
2025-02-08
·
CVE-2024-36916
CVSS v3.1
7.1
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H |
Name of the Vulnerable Software and Affected Versions:
Linux kernel versions prior to 6.6.37
Description:
The issue is related to the blk-iocost component in the Linux kernel, where sometimes
iocg->delay is shifted right by a number that is too large, resulting in undefined behavior on some architectures. This can lead to a shift-out-of-bounds error, as indicated by UBSAN. The error occurs in the block/blk-iocost.c file at line 1366. The symptoms of an undefined value delay are not clearly specified, but it is suspected to be annoying to debug.Recommendations:
To resolve the issue, update the Linux kernel to version 6.6.37 or later. As a temporary workaround, consider taking the "delay = 0" branch if the shift is too large to avoid undefined behavior.
Exploit
Fix
Out of bounds Read
Integer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Astra Linux
Linuxmint
Linux Kernel
Red Os
Suse
Ubuntu