CVE-2024-45026

What it actually does

Imprecise error code check in dasd_ese_needs_format allows incorrect length flag from other transport errors to trigger on-demand formatting on ESE volumes, resulting in data corruption during recovery scenarios such as storage server warmstarts.

Why it matters to the business

Organizations using thin-provisioned ESE storage on s390 systems face risk of silent data corruption that can cause application failures, require restores from backups, and disrupt operations; the issue affects Linux kernel deployments handling such devices.

How an attack unfolds

An attacker or environmental condition triggers transport errors with the incorrect length flag set during IO on ESE volumes; the flawed check misinterprets the error, performs incorrect formatting, and corrupts data. No public exploitation is known for this specific flaw.

How to fix it

Update the Linux kernel to a version containing commit 19f60a55b2fda49bc4f6134a5f6356ef62ee69d8 or later stable releases that remove the incorrect-length check and add explicit invalid-track-format validation for ESE handling.

How to confirm the fix worked

Confirm the patched kernel is running, review dasd_ese_needs_format source for removal of incorrect-length check, and test ESE volumes under simulated error conditions such as warmstarts to verify no corruption occurs.

Typical attack path

1. Trigger storage or transport error condition on ESE device
2. dasd_ese_needs_format evaluates imprecise incorrect-length flag
3. Kernel initiates erroneous on-demand formatting
4. Data written to incorrectly formatted tracks becomes corrupted

How to detect it

Examine kernel logs for DASD ESE formatting events coinciding with transport errors or warmstart conditions; look for unexpected track-format changes or data-integrity alerts on affected volumes.

What your security team should do

• Apply the fixed kernel version immediately on all s390 systems using ESE volumes
• Prioritize systems with thin-provisioned storage given data-integrity exposure
• Monitor kernel changelogs for related DASD fixes and schedule staged rollouts
• Validate backup and recovery procedures for ESE-hosted data