Critical Vulnerability in Linux Package: md_check_recovery() Read-Only Array Issue
Summary
DEBIAN-CVE-2024-26757: In the Linux kernel, the following vulnerability has been resolved: md: Don't ignore read-only array in md_check_recovery() Usually if the array is not read-write, md_check_recovery() won't register new sync_thread in th... Affects linux versions < 6.7.7-1. Fixed in 6.7.7-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux package is the core component of the operating system, responsible for managing hardware and system resources. It provides essential functionalities such as process management, memory management, and device control. This vulnerability specifically affects the md (multiple devices) subsystem, which is responsible for managing RAID (Redundant Array of Independent Disks) configurations. The issue arises when the read-only status of an array is improperly handled, potentially leading to system hangs during recovery operations.
Vulnerability Detail
In the Linux kernel, a vulnerability exists in the md_check_recovery() function, which fails to properly handle read-only arrays. When an array is set to read-only, the function should not register a new sync_thread. However, due to a flaw introduced by commit f52f5c71f3d4, a race condition can occur where the array is manipulated concurrently, leading to a situation where the sync_thread cannot be unregistered, causing the system to hang. This vulnerability can lead to significant downtime and data integrity issues if not addressed.
How To Fix
Minimum fixed version
6.7.7-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is recommended to apply the patch as soon as it becomes available to mitigate the risk.
Conclusion
The vulnerability in the Linux kernel regarding the md_check_recovery() function poses a significant risk to systems utilizing RAID configurations. It is essential to update to the patched version to prevent potential system hangs and data loss. Users are encouraged to utilize tools like Vulert to monitor for vulnerabilities in their applications.
See every vulnerability recorded for linux →
FAQ
The vulnerability can lead to system hangs during RAID recovery operations, potentially causing downtime and data loss.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without any signup.
The vulnerability affects Linux versions in Debian 13 and 14 prior to the patched version 6.7.7-1.
Yes, if the vulnerability is exploited, it could lead to data integrity issues and potential data loss during RAID operations.
While there are no specific workarounds, it is crucial to monitor your system closely and apply the patch as soon as possible.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
