CVE-2024-50278

A flaw was found in the Linux kernel's Device Mapper cache (dm-cache) component. This flaw allows a local user with storage configuration privileges to cause a Denial of Service (DoS) or potentially disclose sensitive system information. The vulnerability occurs when a caching device is resized prior to its initial resume, causing the kernel to omit required size checks and fail to allocate adequate internal data structures. Operating on the misconfigured device triggers an out-of-bounds memory access that can crash the system.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this vulnerability, prevent the dm_cache kernel module from loading on systems that do not use device-mapper caching:

1. Create a configuration file in /etc/modprobe.d/ to disable the module:

echo "install dm_cache /bin/true" > /etc/modprobe.d/disable-dm_cache.conf

2. If the module is already loaded, remove it:

modprobe -r dm_cache

Caveats: This workaround prevents the activation or creation of any storage volumes relying on dm-cache (such as LVM cache volumes). If the module is currently in active use by mounted filesystems or volumes, it cannot be unloaded dynamically, and a system reboot will be required after unmounting affected volumes.