{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2024-35808","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2024-05-17T12:19:12.342Z","datePublished":"2024-05-17T13:23:15.515Z","dateUpdated":"2026-08-05T11:30:03.700Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T11:30:03.700Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmd/dm-raid: don't call md_reap_sync_thread() directly\n\nCurrently md_reap_sync_thread() is called from raid_message() directly\nwithout holding 'reconfig_mutex', this is definitely unsafe because\nmd_reap_sync_thread() can change many fields that is protected by\n'reconfig_mutex'.\n\nHowever, hold 'reconfig_mutex' here is still problematic because this\nwill cause deadlock, for example, commit 130443d60b1b (\"md: refactor\nidle/frozen_sync_thread() to fix deadlock\").\n\nFix this problem by using stop_sync_thread() to unregister sync_thread,\nlike md/raid did."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable `raid_message()` handler is reached only through the local `DM_TARGET_MSG` ioctl on /dev/mapper/control (`ctl_ioctl` → `target_message` → `ti->type->message`). No remote or adjacent network path exists.\nAC:L - The attacker controls both sides of the race — it can start a sync/reshape with a `check`/`repair`/`resync` message and then issue concurrent `idle`/`frozen` messages from multiple threads, so two contexts enter `md_reap_sync_thread()` simultaneously; dm-raid is a standard distro module, so no rare configuration is needed.\nPR:L - The device-mapper control ioctl is gated by CAP_SYS_ADMIN, but this is delegated capability rather than exclusive host root in practice — privileged containers, storage-management daemons and LVM helper services hold it — and kernel-CNA scoring consistently treats dm-ioctl-reachable defects as low-privilege local attacks.\nUI:N - The attacker performs every step itself (create/activate the dm-raid target, start the sync thread, issue the racing messages); no action by another user or administrator is required.\nS:U - The corruption is confined to kernel memory and on-disk RAID metadata managed by the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The unlocked reap yields a use-after-free/double-free of `struct md_thread` plus an unsynchronized walk of the `mddev->disks` rdev list, and reclaiming the freed slab object gives an attacker-controlled read primitive over kernel memory.\nI:H - The double `kfree()`/UAF is a classic heap-corruption primitive exploitable for arbitrary write and control-flow hijack, and additionally `md_update_sb()` and `pers->finish_reshape()` run concurrently with the md thread, writing inconsistent RAID superblocks and mutating array geometry mid-reshape.\nA:H - Double-free/UAF of the sync thread reliably produces slab corruption, oops, and kernel panic, and the unsynchronized recovery-flag manipulation can wedge the sync-thread state machine into the deadlock/hang class the commit series explicitly addresses."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/md/dm-raid.c"],"versions":[{"version":"be83651f0050ca8621d58d35dad558e9c45cb18f","lessThan":"347dcdc15a1706f61aa545ae498ededdf31aeebc","status":"affected","versionType":"git"},{"version":"be83651f0050ca8621d58d35dad558e9c45cb18f","lessThan":"9e59b8d76ff511505eb0dd1478329f09e0f04669","status":"affected","versionType":"git"},{"version":"be83651f0050ca8621d58d35dad558e9c45cb18f","lessThan":"cd32b27a66db8776d8b8e82ec7d7dde97a8693b0","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/md/dm-raid.c"],"versions":[{"version":"3.10","status":"affected"},{"version":"0","lessThan":"3.10","status":"unaffected","versionType":"semver"},{"version":"6.7.12","lessThanOrEqual":"6.7.*","status":"unaffected","versionType":"semver"},{"version":"6.8.3","lessThanOrEqual":"6.8.*","status":"unaffected","versionType":"semver"},{"version":"6.9","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.10","versionEndExcluding":"6.7.12"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.10","versionEndExcluding":"6.8.3"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.10","versionEndExcluding":"6.9"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/347dcdc15a1706f61aa545ae498ededdf31aeebc"},{"url":"https://git.kernel.org/stable/c/9e59b8d76ff511505eb0dd1478329f09e0f04669"},{"url":"https://git.kernel.org/stable/c/cd32b27a66db8776d8b8e82ec7d7dde97a8693b0"}],"title":"md/dm-raid: don't call md_reap_sync_thread() directly","x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2024-35808","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2024-05-24T14:17:42.560355Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2024-06-04T17:34:02.913Z"}},{"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-02T03:21:47.484Z"},"title":"CVE Program Container","references":[{"url":"https://git.kernel.org/stable/c/347dcdc15a1706f61aa545ae498ededdf31aeebc","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/9e59b8d76ff511505eb0dd1478329f09e0f04669","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/cd32b27a66db8776d8b8e82ec7d7dde97a8693b0","tags":["x_transferred"]}]}]}}