CVE-2024-45023

A flaw was found in the md/raid1 component of the Linux kernel. This vulnerability allows a local attacker with elevated privileges to cause data corruption in a degraded RAID1 array. The read_balance() function, responsible for balancing read operations across disks, can incorrectly read unrecovered data from a disk that is still in the recovery process, particularly when valid data resides on slower disks. This issue stems from a missing recovery check in the choose_bb_rdev() and choose_slow_rdev() functions.

Accessing storage device will need some extra privilege and hence impact of this issue is considered to be Moderate.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, systems not utilizing software RAID1 can prevent the raid1 kernel module from loading. This can be achieved by creating a blacklist rule.

Create a file /etc/modprobe.d/disable-raid1.conf with the following content: blacklist raid1

After creating the file, regenerate the initramfs and reboot the system for the changes to take effect. For Red Hat Enterprise Linux 7 and 8, use dracut -f -v. For Red Hat Enterprise Linux 6, use mkinitrd -f -v.

This action may impact systems relying on software RAID1 functionality and requires a system reboot to apply.