CVE-2024-35979— raid1: fix use-after-free for original bio in raid1_write_request()
Quick assessment
Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于内存释放后重用。
Possible ATT&CK Techniques 1 AI
T1211 · Exploitation for StealthAffected Version Matrix 8
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | Linux | 992db13a4aee766c8bfbf046ad15c2db5fa7cab8< 3f28d49a328fe20926995d5fbdc92da665596268 |
affected |
992db13a4aee766c8bfbf046ad15c2db5fa7cab8< f423f41b7679c09abb26d2bd54be5cbef23c9446 |
affected | ||
992db13a4aee766c8bfbf046ad15c2db5fa7cab8< fcf3f7e2fc8a53a6140beee46ec782a4c88e4744 |
affected | ||
6.6 |
affected | ||
< 6.6 |
unaffected | ||
6.6.28≤ 6.6.* |
unaffected | ||
6.8.7≤ 6.8.* |
unaffected | ||
6.9≤ * |
unaffected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2024-35979
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
raid1: fix use-after-free for original bio in raid1_write_request()
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved:
raid1: fix use-after-free for original bio in raid1_write_request()
r1_bio->bios[] is used to record new bios that will be issued to
underlying disks, however, in raid1_write_request(), r1_bio->bios[]
will set to the original bio temporarily. Meanwhile, if blocked rdev
is set, free_r1bio() will be called causing that all r1_bio->bios[]
to be freed:
raid1_write_request()
r1_bio = alloc_r1bio(mddev, bio); -> r1_bio->bios[] is NULL
for (i = 0; i < disks; i++) -> for each rdev in conf
// first rdev is normal
r1_bio->bios[0] = bio; -> set to original bio
// second rdev is blocked
if (test_bit(Blocked, &rdev->flags))
break
if (blocked_rdev)
free_r1bio()
put_all_bios()
bio_put(r1_bio->bios[0]) -> original bio is freed
Test scripts:
mdadm -CR /dev/md0 -l1 -n4 /dev/sd[abcd] --assume-clean
fio -filename=/dev/md0 -ioengine=libaio -rw=write -bs=4k -numjobs=1 \
-iodepth=128 -name=test -direct=1
echo blocked > /sys/block/md0/md/rd2/state
Test result:
BUG bio-264 (Not tainted): Object already free
-----------------------------------------------------------------------------
Allocated in mempool_alloc_slab+0x24/0x50 age=1 cpu=1 pid=869
kmem_cache_alloc+0x324/0x480
mempool_alloc_slab+0x24/0x50
mempool_alloc+0x6e/0x220
bio_alloc_bioset+0x1af/0x4d0
blkdev_direct_IO+0x164/0x8a0
blkdev_write_iter+0x309/0x440
aio_write+0x139/0x2f0
io_submit_one+0x5ca/0xb70
__do_sys_io_submit+0x86/0x270
__x64_sys_io_submit+0x22/0x30
do_syscall_64+0xb1/0x210
entry_SYSCALL_64_after_hwframe+0x6c/0x74
Freed in mempool_free_slab+0x1f/0x30 age=1 cpu=1 pid=869
kmem_cache_free+0x28c/0x550
mempool_free_slab+0x1f/0x30
mempool_free+0x40/0x100
bio_free+0x59/0x80
bio_put+0xf0/0x220
free_r1bio+0x74/0xb0
raid1_make_request+0xadf/0x1150
md_handle_request+0xc7/0x3b0
md_submit_bio+0x76/0x130
__submit_bio+0xd8/0x1d0
submit_bio_noacct_nocheck+0x1eb/0x5c0
submit_bio_noacct+0x169/0xd40
submit_bio+0xee/0x1d0
blkdev_direct_IO+0x322/0x8a0
blkdev_write_iter+0x309/0x440
aio_write+0x139/0x2f0
Since that bios for underlying disks are not allocated yet, fix this
problem by using mempool_free() directly to free the r1_bio.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于内存释放后重用。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2024-35979
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-35979
请登录查看更多情报信息。
Other References for CVE-2024-35979 (2)
Same Patch Batch · Linux · 2024-05-20 · 62 CVEs total
| CVE-2024-35969 | 8.8 HIGH | ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr |
| CVE-2024-35980 | 8.4 HIGH | arm64: tlb: Fix TLBI RANGE operand |
| CVE-2024-35987 | 8.4 HIGH | riscv: Fix loading 64-bit NOMMU kernels past the start of RAM |
| CVE-2024-36007 | 7.8 HIGH | mlxsw: spectrum_acl_tcam: Fix warning during rehash |
| CVE-2024-36001 | 7.8 HIGH | netfs: Fix the pre-flush when appending to a file in writethrough mode |
| CVE-2024-35949 | 7.8 HIGH | btrfs: make sure that WRITTEN is set on all metadata blocks |
| CVE-2024-35950 | 7.8 HIGH | drm/client: Fully protect modes[] with dev->mode_config.mutex |
| CVE-2024-35951 | 7.8 HIGH | drm/panfrost: Fix the error path in panfrost_mmu_map_fault_addr() |
| CVE-2024-35954 | 7.8 HIGH | scsi: sg: Avoid sg device teardown race |
| CVE-2024-35948 | 7.8 HIGH | bcachefs: Check for journal entries overruning end of sb clean section |
| CVE-2024-35993 | 7.8 HIGH | mm: turn folio_test_hugetlb into a PageType |
| CVE-2024-35994 | 7.8 HIGH | firmware: qcom: uefisecapp: Fix memory related IO errors and crashes |
| CVE-2024-35990 | 7.8 HIGH | dma: xilinx_dpdma: Fix locking |
| CVE-2024-35958 | 7.8 HIGH | net: ena: Fix incorrect descriptor free behavior |
| CVE-2024-36009 | 7.8 HIGH | ax25: Fix netdev refcount issue |
| CVE-2024-35968 | 7.8 HIGH | pds_core: Fix pdsc_check_pci_health function to use work thread |
| CVE-2024-35998 | 7.5 HIGH | smb3: fix lock ordering potential deadlock in cifs_sync_mid_result |
| CVE-2024-35999 | 7.5 HIGH | smb3: missing lock when picking channel |
| CVE-2024-35971 | 7.5 HIGH | net: ks8851: Handle softirqs at the end of IRQ thread to fix hang |
| CVE-2024-35962 | 7.1 HIGH | netfilter: complete validation of user input |
Showing top 20 of 62 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
-
CVE-2026-98385
sched/cache: Decouple sched_cache_group from mm to fix UAF -
CVE-2026-98384
bpf: Fix out-of-bounds read of sk_protocol in bpf_sock_destr -
CVE-2026-98383
bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL -
CVE-2026-98382
bpf: Reject dev-bound-only programs on other devices -
CVE-2026-98381
veth: manage XDP program pointers during channel resize
Same vendor: Linux
-
CVE-2026-98385
sched/cache: Decouple sched_cache_group from mm to fix UAF -
CVE-2026-98384
bpf: Fix out-of-bounds read of sk_protocol in bpf_sock_destr -
CVE-2026-98383
bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL -
CVE-2026-98382
bpf: Reject dev-bound-only programs on other devices -
CVE-2026-98381
veth: manage XDP program pointers during channel resize
V. Comments for CVE-2024-35979
No comments yet