CVE-2024-46704

{"id": "CVE-2024-46704", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.7, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.0}]}, "published": "2024-09-13T07:15:05.397", "references": [{"url": "https://git.kernel.org/stable/c/8bc35475ef1a23b0e224f3242eb11c76cab0ea88", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/91d09642127a32fde231face2ff489af70eef316", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nworkqueue: Fix spruious data race in __flush_work()\n\nWhen flushing a work item for cancellation, __flush_work() knows that it\nexclusively owns the work item through its PENDING bit. 134874e2eee9\n(\"workqueue: Allow cancel_work_sync() and disable_work() from atomic\ncontexts on BH work items\") added a read of @work->data to determine whether\nto use busy wait for BH work items that are being canceled. While the read\nis safe when @from_cancel, @work->data was read before testing @from_cancel\nto simplify code structure:\n\n\tdata = *work_data_bits(work);\n\tif (from_cancel &&\n\t !WARN_ON_ONCE(data & WORK_STRUCT_PWQ) && (data & WORK_OFFQ_BH)) {\n\nWhile the read data was never used if !@from_cancel, this could trigger\nKCSAN data race detection spuriously:\n\n ==================================================================\n BUG: KCSAN: data-race in __flush_work / __flush_work\n\n write to 0xffff8881223aa3e8 of 8 bytes by task 3998 on cpu 0:\n instrument_write include/linux/instrumented.h:41 [inline]\n ___set_bit include/asm-generic/bitops/instrumented-non-atomic.h:28 [inline]\n insert_wq_barrier kernel/workqueue.c:3790 [inline]\n start_flush_work kernel/workqueue.c:4142 [inline]\n __flush_work+0x30b/0x570 kernel/workqueue.c:4178\n flush_work kernel/workqueue.c:4229 [inline]\n ...\n\n read to 0xffff8881223aa3e8 of 8 bytes by task 50 on cpu 1:\n __flush_work+0x42a/0x570 kernel/workqueue.c:4188\n flush_work kernel/workqueue.c:4229 [inline]\n flush_delayed_work+0x66/0x70 kernel/workqueue.c:4251\n ...\n\n value changed: 0x0000000000400000 -> 0xffff88810006c00d\n\nReorganize the code so that @from_cancel is tested before @work->data is\naccessed. The only problem is triggering KCSAN detection spuriously. This\nshouldn't need READ_ONCE() or other access qualifiers.\n\nNo functional changes."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: workqueue: Fix spruious data race in __flush_work() Al vaciar un elemento de trabajo para su cancelaci\u00f3n, __flush_work() sabe que posee exclusivamente el elemento de trabajo a trav\u00e9s de su bit PENDING. 134874e2eee9 (\"workqueue: Allow cancel_work_sync() and disable_work() from atomic contexts on BH work items\") agreg\u00f3 una lectura de @work->data para determinar si se debe usar la espera activa para los elementos de trabajo de BH que se est\u00e1n cancelando. Si bien la lectura es segura cuando @from_cancel, @work->data se ley\u00f3 antes de probar @from_cancel para simplificar la estructura del c\u00f3digo: data = *work_data_bits(work); if (from_cancel && !WARN_ON_ONCE(data & WORK_STRUCT_PWQ) && (data & WORK_OFFQ_BH)) { Si bien los datos le\u00eddos nunca se usaron si !@from_cancel, esto podr\u00eda activar la detecci\u00f3n de ejecuci\u00f3n de datos de KCSAN de manera espuria: ====================================================================== ERROR: KCSAN: carrera de datos en __flush_work / __flush_work escribe en 0xffff8881223aa3e8 de 8 bytes por la tarea 3998 en la CPU 0: instrument_write include/linux/instrumented.h:41 [en l\u00ednea] ___set_bit include/asm-generic/bitops/instrumented-non-atomic.h:28 [en l\u00ednea] insert_wq_barrier kernel/workqueue.c:3790 [en l\u00ednea] start_flush_work kernel/workqueue.c:4142 [en l\u00ednea] __flush_work+0x30b/0x570 kernel/workqueue.c:4178 flush_work kernel/workqueue.c:4229 [en l\u00ednea] ... le\u00eddo hasta 0xffff8881223aa3e8 de 8 bytes por la tarea 50 en la CPU 1: __flush_work+0x42a/0x570 kernel/workqueue.c:4188 flush_work kernel/workqueue.c:4229 [en l\u00ednea] flush_delayed_work+0x66/0x70 kernel/workqueue.c:4251 ... valor cambiado: 0x0000000000400000 -> 0xffff88810006c00d Reorganice el c\u00f3digo para que @from_cancel se pruebe antes de acceder a @work->data. El \u00fanico problema es que se activa la detecci\u00f3n de KCSAN de manera espuria. Esto no deber\u00eda necesitar READ_ONCE() ni otros calificadores de acceso. No hay cambios funcionales."}], "lastModified": "2024-09-19T13:32:39.257", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E55C1263-DF43-41EF-8DA8-2BA68DF4FFFD", "versionEndExcluding": "6.10.7", "versionStartIncluding": "6.10"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.11:rc1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8B3CE743-2126-47A3-8B7C-822B502CF119"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.11:rc2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4DEB27E7-30AA-45CC-8934-B89263EF3551"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.11:rc3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E0005AEF-856E-47EB-BFE4-90C46899394D"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.11:rc4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "39889A68-6D34-47A6-82FC-CD0BF23D6754"}], "operator": "OR"}]}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}