CVE-2024-50279

What it actually does

Out-of-bounds memory read in the dm-cache target when shrinking a cache device due to an off-by-one index error during dirty bitset iteration in cache_preresume.

Why it matters to the business

Systems using device-mapper caching may experience kernel crashes, memory corruption, or information disclosure during cache resizing operations, leading to downtime or data exposure on storage servers and virtualized environments.

How an attack unfolds

An attacker with local privileges to create and manage dm-cache devices crafts a cache with a specific block count, then performs a shrink operation on the fast device to trigger the faulty bitset indexing and cause out-of-bounds access.

How to fix it

Update the Linux kernel to a version containing the fix for the dirty bitset index post-increment in dm-cache resize handling. Rebuild and reboot with the patched kernel; avoid manual cache resizing on unpatched systems.

How to confirm the fix worked

Verify the kernel version contains the upstream commit that changes the bitset iteration to post-increment the index, then test cache creation and shrink operations in a lab environment while monitoring for KASAN reports.

Typical attack path

1. Create dm-cache metadata, data, and origin devices with linear mappings
2. Initialize a cache target with a known number of cache blocks
3. Suspend the cache device
4. Reload the data device with a smaller size
5. Resume the cache device to trigger the resize path and OOB read

How to detect it

Review kernel logs for KASAN vmalloc-out-of-bounds reports referencing cache_preresume and dmsetup processes; inspect audit logs for dmsetup commands that create or resize cache devices around the time of any kernel faults.

What your security team should do

• Prioritize kernel updates on all systems using dm-cache
• Audit scripts and automation that perform dmsetup reload or resize operations
• Monitor for kernel oops or KASAN warnings related to cache_preresume
• Consider disabling dm-cache on systems where resizing is not required until patched