Deadlock Vulnerability in Linux Kernel's dm-raid456 Package: IO Hang During Reshape
Summary
DEBIAN-CVE-2024-26962: In the Linux kernel, the following vulnerability has been resolved: dm-raid456, md/raid456: fix a deadlock for dm-raid456 while io concurrent with reshape For raid456, if reshape is still in progress, then IO across resh... Affects linux versions < 6.7.12-1. Fixed in 6.7.12-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interaction. The dm-raid456 package is part of the device mapper framework, which allows for the creation of logical devices from physical storage. This package is crucial for managing RAID (Redundant Array of Independent Disks) configurations, enabling data redundancy and performance improvements. However, a recent vulnerability has been identified that can lead to a deadlock situation during IO operations when a reshape is in progress, potentially causing system hangs.
Vulnerability Detail
In the Linux kernel, a vulnerability has been discovered in the dm-raid456 component that can lead to a deadlock when IO operations are performed concurrently with a reshape operation. Specifically, if a reshape is ongoing and certain conditions are met—such as the array being read-only or specific recovery flags being set—IO operations can hang indefinitely. This issue arises because the reshape process cannot make progress under these conditions, leading to a situation where IO requests are blocked. The vulnerability was introduced in earlier versions and has been addressed in a patch, but systems running affected versions remain at risk.
How To Fix
Minimum fixed version
6.7.12-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid performing IO operations while a reshape is in progress, especially under conditions that could lead to the deadlock. Monitoring the status of reshape operations and scheduling IO tasks accordingly can help mitigate the risk of encountering this issue.
Conclusion
The deadlock vulnerability in the Linux kernel's dm-raid456 package poses a significant risk to systems utilizing RAID configurations. It is crucial for users to update to the patched version to mitigate this risk. Additionally, employing workarounds can help manage the situation until systems can be fully updated.
See every vulnerability recorded for linux →
FAQ
The vulnerability is a deadlock issue in the dm-raid456 component of the Linux kernel that can cause IO operations to hang during a reshape process.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor for open-source vulnerabilities without requiring a signup.
If exploited, this vulnerability can lead to system hangs, impacting the availability and performance of applications relying on the affected RAID configurations.
Yes, a patch has been released in version 6.7.12-1 of the Linux package, which resolves the deadlock issue.
If an immediate update is not possible, avoid performing IO operations during reshape processes and monitor the system closely to prevent hangs.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
