{ "schema_version": "1.6.1", "id": "RPI-CVE-2024-38384", "modified": "2026-10-09T11:39:44Z", "upstream": [ "CVE-2024-38384" ], "published": "2024-06-24T13:51:08Z", "summary": "blk-cgroup: fix list corruption from reorder of WRITE ->lqueued", "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nblk-cgroup: fix list corruption from reorder of WRITE ->lqueued\n\n__blkcg_rstat_flush() can be run anytime, especially when blk_cgroup_bio_start\nis being executed.\n\nIf WRITE of `->lqueued` is re-ordered with READ of 'bisc->lnode.next' in\nthe loop of __blkcg_rstat_flush(), `next_bisc` can be assigned with one\nstat instance being added in blk_cgroup_bio_start(), then the local\nlist in __blkcg_rstat_flush() could be corrupted.\n\nFix the issue by adding one barrier.", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "affected": [ { "package": { "ecosystem": "Raspberry Pi OS:12", "name": "linux" }, "versions": [ "1:6.6.20-1+rpt1", "1:6.6.28-1+rpt1", "1:6.6.31-1+rpt1" ], "ecosystem_specific": { "binaries": [ { "binary_name": "linux-image-6.6.20+rpt-rpi-2712", "binary_version": "1:6.6.20-1+rpt1" }, { "binary_name": "linux-image-6.6.20+rpt-rpi-v6", "binary_version": "1:6.6.20-1+rpt1" }, { "binary_name": "linux-image-6.6.20+rpt-rpi-v7", "binary_version": "1:6.6.20-1+rpt1" }, { "binary_name": "linux-image-6.6.20+rpt-rpi-v7l", "binary_version": "1:6.6.20-1+rpt1" }, { "binary_name": "linux-image-6.6.20+rpt-rpi-v8", "binary_version": "1:6.6.20-1+rpt1" }, { "binary_name": "linux-image-6.6.28+rpt-rpi-2712", "binary_version": "1:6.6.28-1+rpt1" }, { "binary_name": "linux-image-6.6.28+rpt-rpi-v6", "binary_version": "1:6.6.28-1+rpt1" }, { "binary_name": "linux-image-6.6.28+rpt-rpi-v7", "binary_version": "1:6.6.28-1+rpt1" }, { "binary_name": "linux-image-6.6.28+rpt-rpi-v7l", "binary_version": "1:6.6.28-1+rpt1" }, { "binary_name": "linux-image-6.6.28+rpt-rpi-v8", "binary_version": "1:6.6.28-1+rpt1" }, { "binary_name": "linux-image-6.6.31+rpt-rpi-2712", "binary_version": "1:6.6.31-1+rpt1" }, { "binary_name": "linux-image-6.6.31+rpt-rpi-v6", "binary_version": "1:6.6.31-1+rpt1" }, { "binary_name": "linux-image-6.6.31+rpt-rpi-v7", "binary_version": "1:6.6.31-1+rpt1" }, { "binary_name": "linux-image-6.6.31+rpt-rpi-v7l", "binary_version": "1:6.6.31-1+rpt1" }, { "binary_name": "linux-image-6.6.31+rpt-rpi-v8", "binary_version": "1:6.6.31-1+rpt1" } ] }, "database_specific": { "per_version": { "1:6.6.20-1+rpt1": { "linux_commit": "6f16847710cc0502450788b9f12f0a14d3429668", "upstream_version": "6.6.20", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.6.33" }, "1:6.6.28-1+rpt1": { "linux_commit": "0c341f47adc3578cd5f817aa20ee2b7f9ae6b23e", "upstream_version": "6.6.28", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.6.33" }, "1:6.6.31-1+rpt1": { "linux_commit": "c1432b4bae5b6582f4d32ba381459f33c34d1424", "upstream_version": "6.6.31", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.6.33" } } } } ], "references": [ { "type": "ADVISORY", "url": "https://www.cve.org/CVERecord?id=CVE-2024-38384" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/714e59b5456e4d6e4295a9968c564abe193f461c" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/785298ab6b802afa75089239266b6bbea590809c" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/d0aac2363549e12cc79b8e285f13d5a9f42fd08e" } ], "database_specific": { "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git", "upstream_modified": "2026-08-05T11:52:36Z", "severity": { "source": "kernel CNA", "cvss_v3_score": 7.8, "cvss_v3_severity": "High", "scenario": "AV:L - The vulnerable code is reached through local block-I/O submission (`submit_bio_noacct_nocheck` \u2192 `blk_cgroup_bio_start`) and local cgroupfs reads of `io.stat`; there is no network-facing path into blk-cgroup stat accounting.\nAC:L - The attacker drives both sides of the race \u2014 continuous bio submission on multiple CPUs plus a tight loop reading `io.stat` (or removing cgroups) to force `blkcg_rstat_flush` \u2014 and can retry indefinitely with no cost until the reorder window is hit on any weakly-ordered CPU.\nPR:L - No capability check exists on either code path; any unprivileged local user performing ordinary file I/O inside a non-root cgroup-v2 blkcg (the default for every systemd user session and every container) can reach both `blk_cgroup_bio_start()` and, via their delegated subtree's `io.stat`, the flush side.\nUI:N - The attacker triggers everything from its own processes \u2014 I/O submission and stat flushing \u2014 with no action required from any other user or administrator.\nS:U - The corruption is confined to kernel block-cgroup structures within the same security authority; no VM, IOMMU, or hypervisor boundary is crossed.\nC:H - Corruption of the lockless list defeats the `__blkg_release()` flush that guarantees no `blkg_iostat_set` is queued before `free_percpu(blkg->iostat_cpu)`, leaving the list pointing into freed per-CPU memory that is then dereferenced (`bisc->blkg`, `blkg->parent`) \u2014 a use-after-free read that can be leveraged for kernel memory disclosure.\nI:H - The same stale-pointer condition makes `blkcg_iostat_update()` write through a `blkg` pointer read out of freed memory, giving an attacker-influenceable write primitive; the llist `next` pointers themselves are also corrupted with attacker-timed values.\nA:H - Re-adding a node that is still linked creates a cycle in the lockless list, so the next `__blkcg_rstat_flush()` loops forever while holding the `blkg_stat_lock` raw spinlock with interrupts disabled under `cgroup_rstat_lock` \u2014 a hard lockup / kernel panic that wedges the whole system." } } }