LiveActive security incident?Get immediate response
CVE Record

CVE-2024-45026: s390/dasd: fix error recovery leading to data corruption on ESE devices

In the Linux kernel, the following vulnerability has been resolved: s390/dasd: fix error recovery leading to data corruption on ESE devices Extent Space Efficient (ESE) or thin provisioned volumes need to be formatted on demand during usual IO processing. The dasd_ese_needs_format function checks for error codes that signal the non existence of a proper track format. The check for incorrect length is to imprecise since other error cases leading to transport of insufficient data also have this flag set. This might lead to data corruption in certain error cases for example during a storage server warmstart. Fix by removing the check for incorrect length and replacing by explicitly checking for invalid track format in transport mode. Also remove the check for file protected since this is not a valid ESE handling case.

HighCVSS 7Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A Linux storage-driver error can corrupt data on IBM s390 systems using Extent Space Efficient, or thin-provisioned, DASD volumes. During certain storage errors, including a storage-server warmstart, the kernel may mistake incomplete data for an unformatted track and handle it incorrectly. Systems not using this architecture and storage configuration are unlikely to be exposed.

Executive priority

Treat this as high priority where s390 workloads depend on ESE DASD because successful triggering may affect confidentiality, integrity, and availability. Schedule expedited kernel maintenance and data-integrity review. For environments without s390 ESE storage, document non-exposure rather than initiating broad emergency remediation.

Technical view

The s390 DASD ESE recovery logic imprecisely interpreted an incorrect-length flag as evidence that a track required formatting. Other transport failures can set the same flag, potentially triggering unsafe format-on-demand handling. The correction explicitly checks for invalid track format in transport mode and removes the inappropriate file-protected check.

Likely exposure

Exposure is narrow but consequential: Linux on s390 using DASD ESE or thin-provisioned volumes. The supplied record identifies affected kernel lines beginning with 5.3 and provides stable fixes across supported branches. Confirm distribution backports because kernel version numbers alone may not establish status.

Exploitation context

The CVSS vector requires local access, low privileges, and high attack complexity, with no user interaction. CISA KEV status is false in the supplied bundle, and no cited evidence establishes active exploitation. The documented trigger concerns particular storage error conditions, such as a storage-server warmstart, rather than ordinary remote attack traffic.

Researcher notes

The core flaw is an error-classification problem in dasd_ese_needs_format, not evidence of a general remote compromise path. The supplied data lacks confirmed attack reports and detailed prerequisites beyond the CVSS vector and storage scenario. Distribution backports may make apparent version comparisons misleading; verify the corrective commit or vendor package status.

Mitigation direction

  • Install the distribution-supported kernel update containing the applicable stable fix.
  • Consult the Linux distribution or platform vendor for branch-specific backport status.
  • Prioritize affected s390 hosts using ESE or thin-provisioned DASD storage.
  • Maintain verified backups and integrity controls until patched systems are validated.

Validation and detection

  • Inventory s390 Linux systems and identify DASD ESE or thin-provisioned volumes.
  • Record running kernel builds and compare them with vendor advisories or stable fix commits.
  • Confirm the updated kernel is running after maintenance, not merely installed.
  • Review storage warmstarts, DASD errors, and integrity alerts for possible corruption.
  • Perform application-consistent integrity checks on data exposed during relevant storage errors.
Prepared
Confidence
high
Sources
10

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2024-45026 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
2ADP providers
9Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7CVSS 3.1HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H15.9Linux

Vulnerability scoring details

Base CVSS 3.1 score

7High
CVSS 3.1 vector shape for CVE-2024-45026Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc
CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux5e2b17e712cf10cc3cc98fde28a88e8f1a1267e9, 5e2b17e712cf10cc3cc98fde28a88e8f1a1267e9, 5e2b17e712cf10cc3cc98fde28a88e8f1a1267e9, 5e2b17e712cf10cc3cc98fde28a88e8f1a1267e9, 5e2b17e712cf10cc3cc98fde28a88e8f1a1267e9, 5e2b17e712cf10cc3cc98fde28a88e8f1a1267e9, 5e2b17e712cf10cc3cc98fde28a88e8f1a1267e9unaffected
LinuxLinux5.3, 0, 5.4.283, 5.10.225, 5.15.166, 6.1.107, 6.6.48, 6.10.7, 6.11affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.