CVE-2024-39482

What it actually does

Out-of-bounds array indexing in btree_iter when dynamically allocated from mempool exceeds the fixed MAX_BSETS size, triggering UBSAN reports and potential memory corruption.

Why it matters to the business

Systems using bcache may experience kernel instability or denial of service during cache operations, affecting storage performance and availability on Linux servers and embedded devices.

How an attack unfolds

An attacker with local access triggers bcache operations that allocate a dynamic btree_iter larger than MAX_BSETS, causing the out-of-bounds access during iteration or sorting.

How to fix it

Update the Linux kernel to include commit 2c3d7b03b658dc8bfa6112b194b67b92a87e081b which separates btree_iter into a flexible-array version and a stack-allocated wrapper.

How to confirm the fix worked

Verify the presence of commit 2c3d7b03b658dc8bfa6112b194b67b92a87e081b in the kernel source or confirm the patched btree_iter structure definition; test bcache workloads under UBSAN.

Typical attack path

1. Obtain local user access on a system with bcache enabled
2. Perform cache set operations that require mempool-allocated iterators exceeding fixed size
3. Trigger btree iteration paths that index beyond the fixed array
4. Observe kernel fault or UBSAN violation leading to potential crash

How to detect it

Review kernel logs for UBSAN array-index-out-of-bounds reports mentioning btree_iter or bcache; inspect stack traces from oops or panic events involving bcache iteration paths.

What your security team should do

• Apply the referenced kernel commit or upgrade to a stable branch containing the fix as highest priority
• Monitor for bcache-related kernel panics or UBSAN warnings in production workloads
• Limit bcache usage on unpatched systems until remediation is complete