CVE-2024-38663

What it actually does

The vulnerability allows blkcg_reset_stats() to corrupt the percpu llist of iostat instances by using memset() instead of resetting only the counter fields, breaking the list structure maintained since the blkcg_rstat_flush() optimization.

Why it matters to the business

Linux systems may experience kernel memory corruption leading to crashes, I/O statistic inaccuracies, or unpredictable block device behavior, increasing downtime risk for servers and embedded devices using the affected kernel versions.

How an attack unfolds

An attacker with local access triggers repeated blkcg stat resets (via cgroup operations or I/O workloads) to corrupt the percpu list, potentially enabling further memory manipulation or denial of service; no widespread in-the-wild exploitation is indicated despite the listed Android kernel reference.

How to fix it

Upgrade the Linux kernel to the commit d4a60298ac34f027a09f8f893fdbd9e06279bb24 or later stable releases that apply the targeted counter-only reset instead of memset().

How to confirm the fix worked

Confirm the kernel source contains the fix commit d4a60298ac34f027a09f8f893fdbd9e06279bb24, rebuild, and verify that blkcg_reset_stats() no longer performs full memset on iostat instances.

Typical attack path

1. Obtain local access on a vulnerable Linux kernel
2. Perform operations that invoke blkcg_reset_stats()
3. Trigger list corruption via repeated stat resets
4. Leverage resulting memory state for further attacks or cause crash

How to detect it

Inspect kernel logs for list corruption warnings or oops related to blkcg percpu lists; no public exploit artifacts are known, so focus on post-reset memory integrity checks.

What your security team should do

• Prioritize kernel updates on all production Linux systems within standard patch cycles
• Monitor for kernel oops or list corruption warnings in dmesg after applying the fix
• Review cgroup I/O workloads for any custom stat reset paths