CVE-2024-26900 in Linux
Summary
by MITRE • 04/17/2024
In the Linux kernel, the following vulnerability has been resolved:
md: fix kmemleak of rdev->serial
If kobject_add() is fail in bind_rdev_to_array(), 'rdev->serial' will be alloc not be freed, and kmemleak occurs.
unreferenced object 0xffff88815a350000 (size 49152): comm "mdadm", pid 789, jiffies 4294716910 hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace (crc f773277a): [] kmemleak_alloc+0x61/0xe0
[] __kmalloc_large_node+0x15e/0x270
[] __kmalloc_node.cold+0x11/0x7f
[] kvmalloc_node+0x74/0x150
[] rdev_init_serial+0x67/0x170
[] mddev_create_serial_pool+0x62/0x220
[] bind_rdev_to_array+0x2af/0x630
[] md_add_new_disk+0x400/0x9f0
[] md_ioctl+0x15bf/0x1c10
[] blkdev_ioctl+0x191/0x3f0
[] vfs_ioctl+0x22/0x60
[] __x64_sys_ioctl+0xba/0xe0
[] do_syscall_64+0x71/0x150
[] entry_SYSCALL_64_after_hwframe+0x6c/0x74
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 11/13/2024
The vulnerability described in CVE-2024-26900 represents a memory leak within the Linux kernel's md (multiple device) subsystem, specifically affecting the management of RAID arrays. This issue occurs during the initialization process of RAID devices where memory allocated for device serial numbers fails to be properly released when certain error conditions are encountered. The flaw manifests in the bind_rdev_to_array() function, which is responsible for binding RAID devices to arrays and managing their associated metadata. When kobject_add() fails during this binding process, the rdev->serial memory allocation remains unreleased, creating a persistent memory leak that can accumulate over time and potentially impact system stability.
The technical implementation of this vulnerability stems from inadequate error handling within the md subsystem's device management routines. The rdev_init_serial() function allocates memory for serial number storage through kvmalloc_node() which is part of the kernel's memory management subsystem. However, when bind_rdev_to_array() encounters a failure in kobject_add(), it does not properly clean up the previously allocated serial memory, leading to a kmemleak condition. This memory leak directly violates the principle of proper resource management and can be categorized under CWE-401: Improper Release of Memory Before Removing Last Reference. The backtrace shows the memory allocation path starting from kmemleak_alloc() through the kernel's memory allocation functions, demonstrating how the leak propagates through the system's call stack.
The operational impact of this vulnerability extends beyond simple memory consumption, as persistent memory leaks can degrade system performance and potentially lead to resource exhaustion. In high-availability environments or systems managing numerous RAID arrays, the accumulation of these unreleased memory segments can result in increased memory pressure, reduced system responsiveness, and in extreme cases, system instability or crashes. The leak affects the mdadm process which manages RAID arrays, making it particularly concerning for storage-intensive applications and enterprise systems that rely heavily on software RAID configurations. This vulnerability aligns with ATT&CK technique T1490: Inhibit System Recovery, as memory leaks can contribute to system degradation and make recovery processes more difficult when resources become constrained. The specific memory block size of 49152 bytes indicates this is likely a substantial allocation for RAID metadata structures, making each leak more impactful than typical smaller allocations.
Mitigation strategies for this vulnerability involve applying the kernel patch that ensures proper cleanup of rdev->serial memory allocation when kobject_add() fails. System administrators should prioritize updating to kernel versions that contain the fix, typically those released after the vulnerability disclosure. Additionally, monitoring for memory leaks through tools like kmemleak or system memory usage patterns can help detect the accumulation of such issues. Regular system auditing and memory profiling should be implemented to identify potential memory leaks in storage subsystems. The fix requires careful implementation to ensure that all error paths properly release allocated resources without introducing new race conditions or performance issues. Organizations should also consider implementing automated monitoring for memory consumption patterns in systems running RAID configurations to detect similar memory management issues before they escalate into operational problems.