Bug 2293367 (CVE-2024-38598)

Summary:	CVE-2024-38598 kernel: md: fix resync softlockup when bitmap size is less than array size
Product:	[Other] Security Response	Reporter:	Patrick Del Bello <pdelbell>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	dfreiber, drow, jburrell, mbenatto, rhel-process-autobot, vkumar, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	kernel 4.19.316, kernel 5.4.278, kernel 5.10.219, kernel 5.15.161, kernel 6.1.93, kernel 6.6.33, kernel 6.8.12, kernel 6.9.3, kernel 6.10-rc1	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in the Linux kernel's Multiple Device (md) subsystem. A local user could exploit this vulnerability to cause a Denial of Service (DoS) by triggering a system hang. The issue occurs during Redundant Array of Independent Disks (RAID) resynchronization when the tracking bitmap size is smaller than the array size, creating an infinite loop that locks up the processor.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2293462

Description Patrick Del Bello 2024-06-20 14:29:29 UTC

In the Linux kernel, the following vulnerability has been resolved:

md: fix resync softlockup when bitmap size is less than array size

The Linux kernel CVE team has assigned CVE-2024-38598 to this issue.

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024061956-CVE-2024-38598-8629@gregkh/T

Comment 10 errata-xmlrpc 2024-08-08 04:57:35 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2024:5101 https://access.redhat.com/errata/RHSA-2024:5101

Comment 12 errata-xmlrpc 2024-09-24 01:14:40 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Extended Update Support

Via RHSA-2024:6993 https://access.redhat.com/errata/RHSA-2024:6993

Comment 13 errata-xmlrpc 2024-11-12 09:35:26 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2024:9315 https://access.redhat.com/errata/RHSA-2024:9315

Comment 14 errata-xmlrpc 2025-01-08 01:33:38 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Extended Update Support

Via RHSA-2025:0057 https://access.redhat.com/errata/RHSA-2025:0057