CVE-2024-43854: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-43854 affects the Linux kernel's block layer data integrity support. The vulnerability was discovered and disclosed on August 17, 2024, and involves uninitialized kernel memory being written to media through the bio_integrity_prep function. This issue affects Linux kernel versions from 2.6.27 up to versions before 5.15.165, 6.1.103, 6.6.44, and 6.10.3 (NVD).

The vulnerability stems from bio_integrity_prep using plain kmalloc without memory initialization, which results in random kernel memory being written to media. For PI (Protection Information) metadata, the issue is limited to the app tag that isn't used by kernel-generated metadata, but for non-PI metadata, the entire buffer leaks kernel memory. The vulnerability has been assigned a CVSS v3.1 base score of 5.5 (Medium) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD).

The vulnerability can lead to kernel memory leakage to disk media. For PI metadata, the impact is limited to the app tag portion, while for non-PI metadata, it affects the entire metadata buffer, potentially exposing sensitive kernel memory content (Kernel Patch).

The vulnerability requires local access to the system and can be triggered through operations involving block layer data integrity support. The issue has been present since the introduction of block layer data integrity support (Fixes: 7ba1ba12eeef "block: Block layer data integrity support") (Kernel Patch).

The vulnerability has been fixed by adding the __GFP_ZERO flag to allocations for writes in the bio_integrity_prep function. The fix ensures that allocated memory is zeroed before use, preventing kernel memory leakage. Users should upgrade to Linux kernel versions 5.15.165, 6.1.103, 6.6.44, 6.10.3 or later that contain the fix (NVD).