CVE-2024-35794: 
Linux Kernel vulnerability analysis and mitigation

A vulnerability in the Linux kernel's dm-raid subsystem has been identified as CVE-2024-35794. The issue relates to the sync_thread handling during suspend operations in the dm-raid component. This vulnerability was discovered in early 2024 and affects the Linux kernel's RAID (MD) subsystem (Kernel Git).

The vulnerability stems from multiple issues in the sync_thread handling: 1) The removal of MD_RECOVERY_FROZEN from __md_stop_writes() affected dm-raid's indirect reliance on __md_stop_writes() for freezing sync_thread, 2) The MD_RECOVERY_FROZEN flag only prevents new sync_threads from starting but doesn't stop running ones, 3) The flag doesn't guarantee writes are stopped, and 4) raid_message could modify the MD_RECOVERY_FROZEN flag during suspension. The issue manifests as a system hang in stop_sync_thread() and potential ext4 corruption (Kernel Git).

The vulnerability can lead to system crashes and potential filesystem corruption. When exploited, it can cause the system to hang during RAID operations and may result in ext4 filesystem corruption (Red Hat CVE).

The vulnerability requires local access to the system and can be triggered during RAID operations, particularly during suspend operations. It has been confirmed to cause system hangs in specific test scenarios, such as the shell/lvconvert-raid-reshape.sh test (Kernel Git).

The issue has been fixed through a patch that: 1) Adds MD_RECOVERY_FROZEN in md_stop_writes(), 2) Moves stop_sync_thread() to md_stop_writes(), 3) Always calls md_stop_writes() in raid_postsuspend(), and 4) Prevents raid_message() from changing sync_thread status during suspend. The fix is available in the Linux kernel repository (Kernel Git).