CVE-2024-35787

What it actually does

Incorrect slot offset handling in clustered MD bitmap code allows uninitialized or wrong page indexing during bitmap bit operations, leading to invalid memory access and kernel panic in md_bitmap_file_set_bit and related paths.

Why it matters to the business

Clustered storage servers using Linux MD RAID may experience unexpected crashes during I/O, causing service interruptions and potential data access loss until the system is recovered or nodes are restarted.

How an attack unfolds

An attacker with the ability to trigger write operations on a clustered MD device can reach the faulty bitmap code path that never sets the required slot offset, resulting in a crash; the bug was introduced by an earlier commit that removed page index usage but left clustered logic broken.

How to fix it

Update the Linux kernel to a version containing commit 736ad6c577a367834118f57417038d45bb5e0a31 or later; rebuild and deploy the updated kernel across all clustered nodes, then reboot to activate the corrected bitmap slot offset logic.

How to confirm the fix worked

Confirm the running kernel contains commit 736ad6c577a367834118f57417038d45bb5e0a31, reproduce clustered I/O workloads that previously triggered the call trace, and verify absence of the md_bitmap_file_set_bit crash path.

Typical attack path

1. Identify or create a clustered MD RAID1/RAID10 device
2. Issue write I/O that reaches raid1_make_request and md_bitmap_startwrite
3. Execute md_bitmap_file_set_bit without a valid slot offset for the cluster node
4. Trigger kernel panic via invalid memory reference in bitmap handling

How to detect it

Search kernel logs and crash dumps for the partial call trace containing md_bitmap_file_set_bit, md_bitmap_startwrite, raid1_make_request, and md_submit_bio from the md_mod module; correlate with clustered MD device activity.

• md_bitmap_file_set_bit+0x110/0x1d8 [md_mod]
• md_bitmap_startwrite+0x13c/0x240 [md_mod]
• raid1_make_request+0x6b0/0x1c08 [raid1]

What your security team should do

• Prioritize patching clustered MD environments first due to crash risk under normal I/O
• Apply the fixed commit 736ad6c577a367834118f57417038d45bb5e0a31 and test in staging clusters before production rollout
• Monitor kernel logs for md_mod call traces matching the provided stack during any clustered storage activity