CVE-2024-57875

What it actually does

Missing RCU protection on disk->conv_zones_bitmap allows concurrent disk revalidation to free or replace the bitmap while disk_zone_is_conv() reads it, causing invalid memory references.

Why it matters to the business

Systems using zoned block devices may experience crashes or unpredictable behavior during disk revalidation events, leading to downtime and potential data access issues on storage subsystems.

How an attack unfolds

An attacker with local access triggers repeated disk revalidation operations while concurrently invoking helpers that read the conventional zones bitmap, racing the pointer update to access freed memory.

How to fix it

Update to a kernel containing the fix that adds RCU read-side protection in disk_zone_is_conv(), implements disk_set_conv_zones_bitmap() with rcu_replace_pointer(), and correctly frees bitmaps in disk_free_zone_resources().

How to confirm the fix worked

Confirm the running kernel source contains the RCU read lock acquisition in disk_zone_is_conv() and the rcu_replace_pointer() call in disk_set_conv_zones_bitmap(); verify no crashes occur during repeated revalidation under concurrent zone queries.

Typical attack path

1. Obtain local access on a system with zoned block devices
2. Trigger disk revalidation to update conv_zones_bitmap
3. Concurrently call disk_zone_is_conv() under load to race the RCU-unprotected pointer
4. Cause use-after-free or invalid dereference resulting in kernel panic or memory corruption

How to detect it

Inspect kernel logs for oops or warnings involving conv_zones_bitmap or disk_zone_is_conv during revalidation; look for processes triggering blkdev revalidation while zoned I/O occurs.

What your security team should do

• Prioritize kernel updates on systems exposing zoned block devices
• Monitor for kernel oops or warnings referencing zone bitmap handling
• Test revalidation paths in staging environments before production rollout