CVE-2024-50250

Summary

CVE-2024-50250 is a vulnerability affecting the Linux kernel's fsdax subsystem. This issue stems from the function dax_unshare_iter, which incorrectly copies data from srcmap to iomap. If the data is not aligned to an fsblock boundary, user data can be corrupted as iter->pos and daddr/saddr do not point to the same byte in the file. Moreover, the code fails to copy full blocks when iter->pos + iomap_length() is not aligned to a page, leading to data confidentiality issues. The vulnerability can be mitigated by aligning copy_pos/copy_len to a page boundary. Another concern is the absence of a call to invalidate_inode_pages2_range, potentially allowing programs to continue accessing outdated memory mappings after file metadata updates.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.