CVE-2024-57875 (GCVE-0-2024-57875)

Vulnerability from cvelistv5 – Published: 2025-01-11 14:49 – Updated: 2026-08-05 11:46
VLAI
Title
block: RCU protect disk->conv_zones_bitmap
Summary
In the Linux kernel, the following vulnerability has been resolved: block: RCU protect disk->conv_zones_bitmap Ensure that a disk revalidation changing the conventional zones bitmap of a disk does not cause invalid memory references when using the disk_zone_is_conv() helper by RCU protecting the disk->conv_zones_bitmap pointer. disk_zone_is_conv() is modified to operate under the RCU read lock and the function disk_set_conv_zones_bitmap() is added to update a disk conv_zones_bitmap pointer using rcu_replace_pointer() with the disk zone_wplugs_lock spinlock held. disk_free_zone_resources() is modified to call disk_update_zone_resources() with a NULL bitmap pointer to free the disk conv_zones_bitmap. disk_set_conv_zones_bitmap() is also used in disk_update_zone_resources() to set the new (revalidated) bitmap and free the old one.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: dd291d77cc90eb6a86e9860ba8e6e38eebd57d12 , < 493326c4f10cc71a42c27fdc97ce112182ee4cbc (git)
Affected: dd291d77cc90eb6a86e9860ba8e6e38eebd57d12 , < d7cb6d7414ea1b33536fa6d11805cb8dceec1f97 (git)
Create a notification for this product.
Linux Linux Affected: 6.10
Unaffected: 0 , < 6.10 (semver)
Unaffected: 6.12.5 , ≤ 6.12.* (semver)
Unaffected: 6.13 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "block/blk-zoned.c",
            "include/linux/blkdev.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "493326c4f10cc71a42c27fdc97ce112182ee4cbc",
              "status": "affected",
              "version": "dd291d77cc90eb6a86e9860ba8e6e38eebd57d12",
              "versionType": "git"
            },
            {
              "lessThan": "d7cb6d7414ea1b33536fa6d11805cb8dceec1f97",
              "status": "affected",
              "version": "dd291d77cc90eb6a86e9860ba8e6e38eebd57d12",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "block/blk-zoned.c",
            "include/linux/blkdev.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.10"
            },
            {
              "lessThan": "6.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.5",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nblock: RCU protect disk-\u003econv_zones_bitmap\n\nEnsure that a disk revalidation changing the conventional zones bitmap\nof a disk does not cause invalid memory references when using the\ndisk_zone_is_conv() helper by RCU protecting the disk-\u003econv_zones_bitmap\npointer.\n\ndisk_zone_is_conv() is modified to operate under the RCU read lock and\nthe function disk_set_conv_zones_bitmap() is added to update a disk\nconv_zones_bitmap pointer using rcu_replace_pointer() with the disk\nzone_wplugs_lock spinlock held.\n\ndisk_free_zone_resources() is modified to call\ndisk_update_zone_resources() with a NULL bitmap pointer to free the disk\nconv_zones_bitmap. disk_set_conv_zones_bitmap() is also used in\ndisk_update_zone_resources() to set the new (revalidated) bitmap and\nfree the old one."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable helper is reached only through the local block I/O submission path (`submit_bio`/`blk_mq_submit_bio` \u2192 `blk_zone_plug_bio`) and zone-management ioctls (`BLKRESETZONE`/`BLKFINISHZONE`) against a zoned block device node or a filesystem mounted on it. There is no network protocol handler in the path; the racing revalidation is a local block-layer/driver operation.\nAC:L - The attacker fully controls the reader side and can drive `disk_zone_is_conv()` continuously and indefinitely with a cheap write/zone-reset loop, so the race can be retried without limit at no cost until a revalidation (admin rescan, `BLKRRPART`, DM table reload, or a device-driven SCSI capacity-change unit attention / NVMe namespace-changed AEN, all of which recur in normal operation) lands in the window. No specific memory layout or victim state that the attacker cannot influence is required.\nPR:L - An ordinary unprivileged local user only needs write access to the zoned block device or to a filesystem on it (common for containers given a ZNS namespace, storage hosts with SMR disks, and Android/embedded systems running f2fs on zoned storage) to keep the vulnerable read path hot. No capability check guards `blk_zone_plug_bio()` on the submission path.\nUI:N - Triggering requires only the attacker\u0027s own I/O against the zoned device concurrently with a revalidation event; no victim has to open a file, mount a filesystem, or take any other action.\nS:U - The freed bitmap and the corrupted decision logic are both kernel block-layer state, so the impact stays within the kernel\u0027s own security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - `test_bit()` on the freed bitmap reads memory that may already have been reallocated to another kernel object, and the resulting bit value is observable to the attacker through the differing I/O behavior (zone append accepted vs. `-EIO`), yielding a use-after-free read oracle over recycled kernel heap contents.\nI:H - A stale/freed bitmap can make a sequential-write-required zone be classified as conventional, causing writes to bypass zone write plugging entirely and be issued out of order to the device \u2014 corrupting on-disk data on the zoned device \u2014 and the use-after-free read is the kind of memory-safety defect that is treated as exploitable for further corruption.\nA:H - Dereferencing the freed bitmap can oops the kernel (kvmalloc/vmalloc-backed bitmaps for large zone counts become unmapped on free, and KASAN/DEBUG_PAGEALLOC builds fault immediately), and even without a fault the misclassification produces write-ordering failures that force I/O errors and filesystem shutdown on the zoned device."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:46:43.350Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/493326c4f10cc71a42c27fdc97ce112182ee4cbc"
        },
        {
          "url": "https://git.kernel.org/stable/c/d7cb6d7414ea1b33536fa6d11805cb8dceec1f97"
        }
      ],
      "title": "block: RCU protect disk-\u003econv_zones_bitmap",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-57875",
    "datePublished": "2025-01-11T14:49:01.655Z",
    "dateReserved": "2025-01-11T14:45:42.023Z",
    "dateUpdated": "2026-08-05T11:46:43.350Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-57875",
      "date": "2026-08-06",
      "epss": "0.00194",
      "percentile": "0.09318"
    },
    "microsoft_vex": {
      "current_release_date": "2026-06-28T01:52:33.000Z",
      "cve": "CVE-2024-57875",
      "id": "msrc_CVE-2024-57875",
      "initial_release_date": "2025-01-02T00:00:00.000Z",
      "product_status:known_affected": "19",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "block: RCU protect disk-\u003econv_zones_bitmap",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2024-57875.json",
      "version": "14"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-57875\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-01-11T15:15:07.803\",\"lastModified\":\"2026-06-17T08:14:07.467\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nblock: RCU protect disk-\u003econv_zones_bitmap\\n\\nEnsure that a disk revalidation changing the conventional zones bitmap\\nof a disk does not cause invalid memory references when using the\\ndisk_zone_is_conv() helper by RCU protecting the disk-\u003econv_zones_bitmap\\npointer.\\n\\ndisk_zone_is_conv() is modified to operate under the RCU read lock and\\nthe function disk_set_conv_zones_bitmap() is added to update a disk\\nconv_zones_bitmap pointer using rcu_replace_pointer() with the disk\\nzone_wplugs_lock spinlock held.\\n\\ndisk_free_zone_resources() is modified to call\\ndisk_update_zone_resources() with a NULL bitmap pointer to free the disk\\nconv_zones_bitmap. disk_set_conv_zones_bitmap() is also used in\\ndisk_update_zone_resources() to set the new (revalidated) bitmap and\\nfree the old one.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: bloque: RCU protege disk-\u0026gt;conv_zones_bitmap Aseg\u00farese de que una revalidaci\u00f3n de disco que cambia el mapa de bits de las zonas convencionales de un disco no cause referencias de memoria no v\u00e1lidas cuando se usa el asistente disk_zone_is_conv() mediante la protecci\u00f3n por RCU del puntero disk-\u0026gt;conv_zones_bitmap. disk_zone_is_conv() se modifica para que funcione bajo el bloqueo de lectura de RCU y se agrega la funci\u00f3n disk_set_conv_zones_bitmap() para actualizar un puntero conv_zones_bitmap de disco usando rcu_replace_pointer() con el bloqueo giratorio zone_wplugs_lock de disco retenido. disk_free_zone_resources() se modifica para llamar a disk_update_zone_resources() con un puntero de mapa de bits NULL para liberar el disco conv_zones_bitmap. disk_set_conv_zones_bitmap() tambi\u00e9n se utiliza en disk_update_zone_resources() para establecer el nuevo mapa de bits (revalidado) y liberar el antiguo.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"block/blk-zoned.c\",\"include/linux/blkdev.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"dd291d77cc90eb6a86e9860ba8e6e38eebd57d12\",\"lessThan\":\"493326c4f10cc71a42c27fdc97ce112182ee4cbc\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"dd291d77cc90eb6a86e9860ba8e6e38eebd57d12\",\"lessThan\":\"d7cb6d7414ea1b33536fa6d11805cb8dceec1f97\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"block/blk-zoned.c\",\"include/linux/blkdev.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.10\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.10\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.5\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.13\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"},{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"6.12.5\",\"matchCriteriaId\":\"75E05E0A-C898-433A-8E50-6D9EC8646A64\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/493326c4f10cc71a42c27fdc97ce112182ee4cbc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d7cb6d7414ea1b33536fa6d11805cb8dceec1f97\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T14:07:35+00:00",
      "cve": "CVE-2024-57875",
      "id": "CVE-2024-57875",
      "initial_release_date": "2024-01-01T00:00:00+00:00",
      "product_status:known_affected": "108",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: block: RCU protect disk-\u003econv_zones_bitmap",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-57875.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.