CVE-2024-35787: 
Linux Kernel vulnerability analysis and mitigation

A vulnerability in the Linux kernel's MD (Multiple Device) subsystem, specifically within the bitmap handling code, was discovered and assigned CVE-2024-35787. The issue was identified in May 2024 and stems from incorrect usage of sb_index in the md-bitmap code. The vulnerability affects the Linux kernel's software RAID functionality, particularly in clustered environments (Kernel Git).

The vulnerability was introduced when commit d7038f951828 removed page->index from bitmap code but left incorrect code logic for clustered-md. The issue causes the code to never set slot offset for cluster nodes, which can lead to system crashes in clustered environments. The problem manifests in the md_bitmap_file_set_bit function and related call paths, including md_bitmap_startwrite and raid1_make_request functions (Kernel Git).

When exploited, this vulnerability can cause system crashes in clustered environments using Linux software RAID configurations. The impact is primarily focused on system availability, as it can trigger kernel crashes during bitmap operations in clustered MD setups (NVD).

The vulnerability requires access to a clustered environment using Linux software RAID with bitmap functionality. It can be triggered during normal system operations involving bitmap file operations in the MD subsystem (Ubuntu).

The issue has been fixed in various Linux kernel versions. Ubuntu has released patches for affected systems, including version 6.8.0-35.35 for Ubuntu 24.04 LTS noble and similar updates for other distributions. Users are advised to update their systems to the patched versions (Ubuntu).