CVE-2024-36917: linux-libc-dev - block: fix overflow in blk_ioctl_discard()
Summary
CVE-2024-36917: In the Linux kernel, the following vulnerability has been resolved: block: fix overflow in blk_ioctl_discard() There is no check for overflow of 'start + len' in blk_ioctl_discard(). Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
linux-libc-dev is a package that provides the Linux kernel headers for use by glibc and other C library implementations. It allows developers to compile and build applications that interact with the Linux kernel. The vulnerability in this package, identified as CVE-2024-36917, is related to the blk_ioctl_discard() function in the kernel's block layer. This function lacks proper validation for overflow of the 'start + len' parameters, which can lead to a hung task. The vulnerability has a CVSS score of 5.5, indicating a medium severity level.
Vulnerability Detail
The vulnerability in blk_ioctl_discard() allows an attacker to trigger a hung task by submitting a discard ioctl with specific parameters that cause an overflow. This can potentially lead to a denial of service (DoS) condition. The lack of proper validation for overflow in the function is the root cause of this vulnerability. The issue has been resolved by adding overflow validation to prevent such scenarios.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The linux-libc-dev package is vulnerable to an overflow issue in the blk_ioctl_discard() function. This can lead to a hung task and potential denial of service. It is recommended to update the package to the latest version to mitigate this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for linux →
FAQ
linux-libc-dev is a package that provides the Linux kernel headers for use by glibc and other C library implementations. It allows developers to compile and build applications that interact with the Linux kernel.
blk_ioctl_discard() is a function in the Linux kernel's block layer. It is used for discarding blocks on a block device.
The vulnerability can lead to a hung task and potentially cause a denial of service (DoS) condition.
The CVSS score of this vulnerability is 5.5, indicating a medium severity level.
To fix this vulnerability, update the linux-libc-dev package to version 6.1.90-1 or later.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
