Data Corruption Vulnerability in Linux Kernel: md/raid1 Package
Summary
DEBIAN-CVE-2024-45023: In the Linux kernel, the following vulnerability has been resolved: md/raid1: Fix data corruption for degraded array with slow disk read_balance() will avoid reading from slow disks as much as possible, however, if valid... Affects linux versions < 6.10.7-1. Fixed in 6.10.7-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing system resources and hardware interactions. It provides essential services for all other parts of the operating system and applications. The md/raid1 subsystem is designed for managing RAID 1 arrays, which mirror data across multiple disks for redundancy. This vulnerability affects the integrity of data in degraded RAID 1 arrays, particularly when slow disks are involved.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified within the md/raid1 subsystem that can lead to data corruption in degraded RAID 1 arrays. The issue arises when valid data is only present on slow disks while a normal disk is still in recovery. The read_balance function attempts to avoid reading from slow disks; however, if it inadvertently reads unrecovered data from the normal disk, it can result in data corruption. The root cause is a missing recovery check in the choose_bb_rdev function, which allows the system to read unrecovered data, compromising data integrity.
How To Fix
Minimum fixed version
6.10.7-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. However, users are advised to monitor their RAID configurations and avoid relying on degraded arrays until the patch is applied.
Conclusion
The vulnerability in the Linux kernel's md/raid1 subsystem poses a significant risk of data corruption in RAID 1 arrays. Users are strongly encouraged to update their systems to the patched version to ensure data integrity and system reliability.
See every vulnerability recorded for linux →
FAQ
The vulnerability can lead to data corruption in RAID 1 arrays, particularly when one or more disks are slow or in recovery.
You can use tools like Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
Yes, a patch is available in version 6.10.7-1 of the Linux kernel. Users should update to this version to mitigate the vulnerability.
While there are no specific workarounds, it is advisable to avoid using degraded RAID configurations until the patch is applied.
More information can be found in the official Debian CVE database or by visiting the source link provided in the vulnerability details.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
