{"dataType":"CVE_RECORD","cveMetadata":{"cveId":"CVE-2024-26763","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2024-02-19T14:20:24.172Z","datePublished":"2024-04-03T17:00:46.308Z","dateUpdated":"2026-08-05T11:27:05.449Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T11:27:05.449Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndm-crypt: don't modify the data when using authenticated encryption\n\nIt was said that authenticated encryption could produce invalid tag when\nthe data that is being encrypted is modified [1]. So, fix this problem by\ncopying the data into the clone bio first and then encrypt them inside the\nclone bio.\n\nThis may reduce performance, but it is needed to prevent the user from\ncorrupting the device by writing data with O_DIRECT and modifying them at\nthe same time.\n\n[1] https://lore.kernel.org/all/20240207004723.GA35324@sol.localdomain/T/"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","baseScore":7.1,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - Triggering requires issuing local block I/O (an `O_DIRECT` write, or dirty-page writeback) against a dm-crypt target while concurrently mutating the submitting process's own memory pages, which is only possible with local code execution on the machine. No remote peer can modify an in-flight kernel source buffer, so there is no network or adjacent path.\nAC:L - The attacker owns both sides of the race — one thread submits the `O_DIRECT` write while another rewrites the same buffer in a tight loop — and can repeat it across many pages until the AEAD reads inconsistent plaintext; public PoCs exist for this exact class (Mikulas Patocka's `blk-auth-modify` testcases cited by the sibling dm-verity/dm-integrity recheck fixes). Nothing depends on memory layout or on state the attacker cannot influence.\nPR:L - Any unprivileged local account with write access to a file or device backed by a dm-crypt target in AEAD mode can do this; `O_DIRECT` needs no capability and the target configuration is the deployment's, not something the attacker must set up. No root, CAP_SYS_ADMIN, or namespace trickery is needed.\nUI:N - The attacker's own two threads perform the entire sequence; no other user must mount, open, or touch anything for the corrupt tag to be committed to disk.\nS:U - The damage is confined to the storage stack managed by the same kernel and the same security authority that already permits the write; no VM, IOMMU, or sandbox boundary is crossed.\nC:N - The operation only produces a tag inconsistent with the ciphertext — the plaintext involved is the attacker's own, no kernel memory is read out of bounds, and no state is disclosed to the attacker.\nI:H - The write completes successfully yet commits data whose authentication tag is invalid, silently and permanently corrupting the device — the commit message states the fix is needed \"to prevent the user from corrupting the device.\" This directly defeats the integrity guarantee dm-crypt's authenticated-encryption mode exists to provide, letting an unprivileged user manufacture arbitrary tamper-detection failures (`INTEGRITY AEAD ERROR`, `dm_audit_log_bio`) that are indistinguishable from genuine attacks and can be used to mask or discredit real tampering.\nA:H - Every subsequent read of an affected sector fails permanently with `BLK_STS_PROTECTION`/EILSEQ; the data is unrecoverable, and the attack can be repeated at will to render large regions of a shared encrypted volume unreadable, with metadata read failures capable of forcing a filesystem read-only or into its error policy."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/md/dm-crypt.c"],"versions":[{"version":"ef43aa38063a6b2b3c6618e28ab35794f4f1fe29","lessThan":"43a202bd552976497474ae144942e32cc5f34d7e","status":"affected","versionType":"git"},{"version":"ef43aa38063a6b2b3c6618e28ab35794f4f1fe29","lessThan":"0dccbb93538fe89a86c6de31d4b1c8c560848eaa","status":"affected","versionType":"git"},{"version":"ef43aa38063a6b2b3c6618e28ab35794f4f1fe29","lessThan":"3c652f6fa1e1f9f02c3fbf359d260ad153ec5f90","status":"affected","versionType":"git"},{"version":"ef43aa38063a6b2b3c6618e28ab35794f4f1fe29","lessThan":"1a4371db68a31076afbe56ecce34fbbe6c80c529","status":"affected","versionType":"git"},{"version":"ef43aa38063a6b2b3c6618e28ab35794f4f1fe29","lessThan":"e08c2a8d27e989f0f5b0888792643027d7e691e6","status":"affected","versionType":"git"},{"version":"ef43aa38063a6b2b3c6618e28ab35794f4f1fe29","lessThan":"64ba01a365980755732972523600a961c4266b75","status":"affected","versionType":"git"},{"version":"ef43aa38063a6b2b3c6618e28ab35794f4f1fe29","lessThan":"d9e3763a505e50ba3bd22846f2a8db99429fb857","status":"affected","versionType":"git"},{"version":"ef43aa38063a6b2b3c6618e28ab35794f4f1fe29","lessThan":"50c70240097ce41fe6bce6478b80478281e4d0f7","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/md/dm-crypt.c"],"versions":[{"version":"4.12","status":"affected"},{"version":"0","lessThan":"4.12","status":"unaffected","versionType":"semver"},{"version":"4.19.308","lessThanOrEqual":"4.19.*","status":"unaffected","versionType":"semver"},{"version":"5.4.270","lessThanOrEqual":"5.4.*","status":"unaffected","versionType":"semver"},{"version":"5.10.211","lessThanOrEqual":"5.10.*","status":"unaffected","versionType":"semver"},{"version":"5.15.150","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.80","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.19","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.7.7","lessThanOrEqual":"6.7.*","status":"unaffected","versionType":"semver"},{"version":"6.8","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.12","versionEndExcluding":"4.19.308"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.12","versionEndExcluding":"5.4.270"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.12","versionEndExcluding":"5.10.211"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.12","versionEndExcluding":"5.15.150"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.12","versionEndExcluding":"6.1.80"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.12","versionEndExcluding":"6.6.19"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.12","versionEndExcluding":"6.7.7"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.12","versionEndExcluding":"6.8"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/43a202bd552976497474ae144942e32cc5f34d7e"},{"url":"https://git.kernel.org/stable/c/0dccbb93538fe89a86c6de31d4b1c8c560848eaa"},{"url":"https://git.kernel.org/stable/c/3c652f6fa1e1f9f02c3fbf359d260ad153ec5f90"},{"url":"https://git.kernel.org/stable/c/1a4371db68a31076afbe56ecce34fbbe6c80c529"},{"url":"https://git.kernel.org/stable/c/e08c2a8d27e989f0f5b0888792643027d7e691e6"},{"url":"https://git.kernel.org/stable/c/64ba01a365980755732972523600a961c4266b75"},{"url":"https://git.kernel.org/stable/c/d9e3763a505e50ba3bd22846f2a8db99429fb857"},{"url":"https://git.kernel.org/stable/c/50c70240097ce41fe6bce6478b80478281e4d0f7"}],"title":"dm-crypt: don't modify the data when using authenticated encryption","x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-02T00:14:13.305Z"},"title":"CVE Program Container","references":[{"url":"https://git.kernel.org/stable/c/43a202bd552976497474ae144942e32cc5f34d7e","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/0dccbb93538fe89a86c6de31d4b1c8c560848eaa","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/3c652f6fa1e1f9f02c3fbf359d260ad153ec5f90","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/1a4371db68a31076afbe56ecce34fbbe6c80c529","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/e08c2a8d27e989f0f5b0888792643027d7e691e6","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/64ba01a365980755732972523600a961c4266b75","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/d9e3763a505e50ba3bd22846f2a8db99429fb857","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/50c70240097ce41fe6bce6478b80478281e4d0f7","tags":["x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html","tags":["x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html","tags":["x_transferred"]}]},{"metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2024-26763","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2024-09-10T15:51:31.262032Z"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2024-09-11T17:33:13.692Z"}}]},"dataVersion":"5.2"}