CVE-2024-35805 – This CVE describes a denial-of-service vulnerab... (How to Fix)

Q: What is the severity of CVE-2024-35805?

CVE-2024-35805 has a CVSS score of 5.5 (MEDIUM). This CVE describes a denial-of-service vulnerability in the Linux kernel's device mapper snapshot subsystem. When destroying a snapshot with many exceptions, the system can lock up due to a missing cond_resched() call in the cleanup loop. This affects systems using Linux device mapper snapshots, particularly those with high-volume storage operations.

📋 TL;DR

This CVE describes a denial-of-service vulnerability in the Linux kernel's device mapper snapshot subsystem. When destroying a snapshot with many exceptions, the system can lock up due to a missing cond_resched() call in the cleanup loop. This affects systems using Linux device mapper snapshots, particularly those with high-volume storage operations.

💻 Affected Systems

Products:

Linux kernel

Versions: Specific affected versions not explicitly stated in CVE, but references indicate multiple stable kernel versions

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects systems using device mapper snapshots. The vulnerability triggers when destroying snapshots with many exceptions.

📦 What is this software?

Debian Linux by Debian

View all CVEs affecting Debian Linux →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete system lockup requiring hard reboot, potentially causing data corruption or loss in active storage operations.

🟠

Likely Case

Temporary system unresponsiveness when removing snapshots with large exception tables, requiring manual intervention.

🟢

If Mitigated

Minor performance impact during snapshot cleanup with proper patching.

🌐 Internet-Facing: LOW - This vulnerability requires local access to the system and specific device mapper operations.

🏢 Internal Only: MEDIUM - Internal systems using device mapper snapshots could experience service disruption if exploited by authorized users.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: NO

Unauthenticated Exploit: ✅ No

Complexity: LOW

Exploitation requires local access and ability to create/destroy device mapper snapshots. The vulnerability is triggered during normal cleanup operations.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Multiple stable kernel versions with fixes referenced in git commits

Vendor Advisory: https://git.kernel.org/stable/c/116562e804ffc9dc600adab6326dde31d72262c7

Restart Required: Yes

Instructions:

1. Update Linux kernel to patched version from your distribution vendor. 2. Reboot system to load new kernel. 3. Verify kernel version matches patched release.

🔧 Temporary Workarounds

Limit snapshot exception count

linux

Avoid creating snapshots with extremely large exception tables

# Monitor snapshot exception counts
# dmstats create --alldevices
# Review snapshot usage patterns

Avoid unnecessary snapshot destruction

linux

Schedule snapshot cleanup during maintenance windows

# Use cron jobs for off-hours cleanup
# Implement snapshot lifecycle management

🧯 If You Can't Patch

Monitor system for lockup symptoms during snapshot operations
Implement strict access controls to limit who can create/destroy device mapper snapshots

🔍 How to Verify

Check if Vulnerable:

Check if system uses device mapper snapshots and has unpatched kernel: 'lsmod | grep dm_snapshot' and 'uname -r'

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version is updated to patched release: 'uname -r' and check with distribution vendor for specific patched versions

📡 Detection & Monitoring

Log Indicators:

Kernel panic messages
System lockup events in syslog
Device mapper errors in dmesg

Network Indicators:

None - this is a local kernel vulnerability

SIEM Query:

source="kernel" AND ("lockup" OR "panic" OR "dm_snapshot")

📊 Metadata

CVE ID: CVE-2024-35805

CVSS v3 Score: 5.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-667

Published: May 17, 2024

Last Updated: December 23, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-35805, you might also want to check these: