CVE-2024-43854

What it actually does

Kernel block integrity metadata allocated via kmalloc without __GFP_ZERO causes uninitialized kernel memory (including app tags for PI and full buffers for non-PI) to be written to storage media during bio_integrity_prep for write operations.

Why it matters to the business

Potential leakage of sensitive kernel memory contents onto persistent media across a very large number of systems and downstream dependents; requires local access and media inspection to exploit, with low immediate urgency due to absence from KEV and stable low EPSS.

How an attack unfolds

An attacker with local access triggers write operations that invoke bio_integrity_prep, causing uninitialized kernel memory to be persisted; the attacker later inspects the media or forensic images to recover the leaked contents. Mentioned threat actors in Linux kernel uninitialized resource and out-of-bounds write campaigns could leverage similar local vectors.

How to fix it

Upgrade the Linux kernel to a version containing commit 9f4af4cf08f9a0329ade3d938f55d2220c40d0a6 or later stable releases that initialize integrity buffers with __GFP_ZERO; apply vendor backports where available.

How to confirm the fix worked

Verify the running kernel contains the referenced commit or equivalent initialization change; inspect source for __GFP_ZERO on kmalloc calls in bio integrity paths and confirm via code review or kernel build configuration checks.

Typical attack path

1. Obtain local user or process execution on a vulnerable Linux kernel system
2. Trigger I/O writes that engage block integrity features and bio_integrity_prep
3. Allow the write to complete, persisting uninitialized memory to media
4. Access the storage media or image offline to extract and analyze leaked kernel contents

How to detect it

Examine kernel logs and audit trails for unexpected bio integrity allocations or write patterns on systems prior to patching; forensic analysis of storage media for anomalous non-zero or unexpected metadata patterns may indicate prior exposure. Threat actor mentions of Linux kernel campaigns provide context for hunting similar activity.

What your security team should do

• Prioritize kernel updates on systems using block integrity or PI metadata features given the high ecosystem prevalence
• Review and restrict local access where possible until patches are applied
• Monitor for future Linux kernel advisories related to integrity and memory initialization