CVE-2024-35808

md/dm-raid: don't call md_reap_sync_thread() directly

Description

In the Linux kernel, the following vulnerability has been resolved: md/dm-raid: don't call md_reap_sync_thread() directly Currently md_reap_sync_thread() is called from raid_message() directly without holding 'reconfig_mutex', this is definitely unsafe because md_reap_sync_thread() can change many fields that is protected by 'reconfig_mutex'. However, hold 'reconfig_mutex' here is still problematic because this will cause deadlock, for example, commit 130443d60b1b ("md: refactor idle/frozen_sync_thread() to fix deadlock"). Fix this problem by using stop_sync_thread() to unregister sync_thread, like md/raid did.

N/A

CVSS

Severity:

EPSS 0.12%

Affected: Linux Linux

References

Link	Tags
https://git.kernel.org/stable/c/347dcdc15a1706f61aa545ae498ededdf31aeebc
https://git.kernel.org/stable/c/9e59b8d76ff511505eb0dd1478329f09e0f04669
https://git.kernel.org/stable/c/cd32b27a66db8776d8b8e82ec7d7dde97a8693b0

Frequently Asked Questions

What is the severity of CVE-2024-35808?: CVE-2024-35808 has not yet been assigned a CVSS score.
How to fix CVE-2024-35808?: To fix CVE-2024-35808, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2024-35808 being actively exploited in the wild?: As for now, there are no information to confirm that CVE-2024-35808 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2024-35808?: CVE-2024-35808 affects Linux Linux, Linux Linux.

This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.