CVE-2024-50228

{"id": "CVE-2024-50228", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.0, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.0}]}, "published": "2024-11-09T11:15:08.650", "references": [{"url": "https://git.kernel.org/stable/c/3d9528484480e8f4979b3a347930ed383be99f89", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/7cc30ada84323be19395094d567579536e0d187e", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/82cae1e30bd940253593c2d4f16d88343d1358f4", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/9fb9703cd43ee20a6de8ccdef991677b7274cec0", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/bda1a99a0dd644f31a87d636ac624eeb975cb65a", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/d949d1d14fa281ace388b1de978e8f2cd52875cf", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/edd1f905050686fdc4cfe233d818469fdf7d5ff8", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/ffd56612566bc23877c8f45def2801f3324a222a", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-362"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm: shmem: fix data-race in shmem_getattr()\n\nI got the following KCSAN report during syzbot testing:\n\n==================================================================\nBUG: KCSAN: data-race in generic_fillattr / inode_set_ctime_current\n\nwrite to 0xffff888102eb3260 of 4 bytes by task 6565 on cpu 1:\n inode_set_ctime_to_ts include/linux/fs.h:1638 [inline]\n inode_set_ctime_current+0x169/0x1d0 fs/inode.c:2626\n shmem_mknod+0x117/0x180 mm/shmem.c:3443\n shmem_create+0x34/0x40 mm/shmem.c:3497\n lookup_open fs/namei.c:3578 [inline]\n open_last_lookups fs/namei.c:3647 [inline]\n path_openat+0xdbc/0x1f00 fs/namei.c:3883\n do_filp_open+0xf7/0x200 fs/namei.c:3913\n do_sys_openat2+0xab/0x120 fs/open.c:1416\n do_sys_open fs/open.c:1431 [inline]\n __do_sys_openat fs/open.c:1447 [inline]\n __se_sys_openat fs/open.c:1442 [inline]\n __x64_sys_openat+0xf3/0x120 fs/open.c:1442\n x64_sys_call+0x1025/0x2d60 arch/x86/include/generated/asm/syscalls_64.h:258\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0x54/0x120 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nread to 0xffff888102eb3260 of 4 bytes by task 3498 on cpu 0:\n inode_get_ctime_nsec include/linux/fs.h:1623 [inline]\n inode_get_ctime include/linux/fs.h:1629 [inline]\n generic_fillattr+0x1dd/0x2f0 fs/stat.c:62\n shmem_getattr+0x17b/0x200 mm/shmem.c:1157\n vfs_getattr_nosec fs/stat.c:166 [inline]\n vfs_getattr+0x19b/0x1e0 fs/stat.c:207\n vfs_statx_path fs/stat.c:251 [inline]\n vfs_statx+0x134/0x2f0 fs/stat.c:315\n vfs_fstatat+0xec/0x110 fs/stat.c:341\n __do_sys_newfstatat fs/stat.c:505 [inline]\n __se_sys_newfstatat+0x58/0x260 fs/stat.c:499\n __x64_sys_newfstatat+0x55/0x70 fs/stat.c:499\n x64_sys_call+0x141f/0x2d60 arch/x86/include/generated/asm/syscalls_64.h:263\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0x54/0x120 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nvalue changed: 0x2755ae53 -> 0x27ee44d3\n\nReported by Kernel Concurrency Sanitizer on:\nCPU: 0 UID: 0 PID: 3498 Comm: udevd Not tainted 6.11.0-rc6-syzkaller-00326-gd1f2d51b711a-dirty #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024\n==================================================================\n\nWhen calling generic_fillattr(), if you don't hold read lock, data-race\nwill occur in inode member variables, which can cause unexpected\nbehavior.\n\nSince there is no special protection when shmem_getattr() calls\ngeneric_fillattr(), data-race occurs by functions such as shmem_unlink()\nor shmem_mknod(). This can cause unexpected results, so commenting it out\nis not enough.\n\nTherefore, when calling generic_fillattr() from shmem_getattr(), it is\nappropriate to protect the inode using inode_lock_shared() and\ninode_unlock_shared() to prevent data-race."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: mm: shmem: correcci\u00f3n de data-race en shmem_getattr() Obtuve el siguiente informe de KCSAN durante las pruebas de syzbot: ====================================================================== ERROR: KCSAN: data-race en generic_fillattr / inode_set_ctime_current escritura en 0xffff888102eb3260 de 4 bytes por la tarea 6565 en la CPU 1: inode_set_ctime_to_ts include/linux/fs.h:1638 [en l\u00ednea] inode_set_ctime_current+0x169/0x1d0 fs/inode.c:2626 shmem_mknod+0x117/0x180 mm/shmem.c:3443 shmem_create+0x34/0x40 mm/shmem.c:3497 lookup_open fs/namei.c:3578 [en l\u00ednea] open_last_lookups fs/namei.c:3647 [en l\u00ednea] path_openat+0xdbc/0x1f00 fs/namei.c:3883 do_filp_open+0xf7/0x200 fs/namei.c:3913 do_sys_openat2+0xab/0x120 fs/open.c:1416 do_sys_open fs/open.c:1431 [en l\u00ednea] __do_sys_openat fs/open.c:1447 [en l\u00ednea] __se_sys_openat fs/open.c:1442 [en l\u00ednea] __x64_sys_openat+0xf3/0x120 fs/open.c:1442 x64_sys_call+0x1025/0x2d60 arch/x86/include/generated/asm/syscalls_64.h:258 do_syscall_x64 arch/x86/entry/common.c:52 [en l\u00ednea] do_syscall_64+0x54/0x120 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x76/0x7e le\u00eddo hasta 0xffff888102eb3260 de 4 bytes por la tarea 3498 en la CPU 0: inode_get_ctime_nsec include/linux/fs.h:1623 [en l\u00ednea] inode_get_ctime include/linux/fs.h:1629 [en l\u00ednea] generic_fillattr+0x1dd/0x2f0 fs/stat.c:62 shmem_getattr+0x17b/0x200 mm/shmem.c:1157 vfs_getattr_nosec fs/stat.c:166 [en l\u00ednea] vfs_getattr+0x19b/0x1e0 fs/stat.c:207 vfs_statx_path fs/stat.c:251 [en l\u00ednea] vfs_statx+0x134/0x2f0 fs/stat.c:315 vfs_fstatat+0xec/0x110 fs/stat.c:341 __do_sys_newfstatat fs/stat.c:505 [en l\u00ednea] __se_sys_newfstatat+0x58/0x260 fs/stat.c:499 __x64_sys_newfstatat+0x55/0x70 fs/stat.c:499 x64_sys_call+0x141f/0x2d60 arch/x86/include/generated/asm/syscalls_64.h:263 do_syscall_x64 arch/x86/entry/common.c:52 [en l\u00ednea] do_syscall_64+0x54/0x120 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x76/0x7e valor cambiado: 0x2755ae53 -> 0x27ee44d3 Reportado por Kernel Concurrency Sanitizer en: CPU: 0 UID: 0 PID: 3498 Comm: udevd No contaminado 6.11.0-rc6-syzkaller-00326-gd1f2d51b711a-dirty #0 Nombre del hardware: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 ======================================================================== Al llamar a generic_fillattr(), si no mantiene el bloqueo de lectura, se producir\u00e1 una ejecuci\u00f3n de datos en las variables miembro del inodo, lo que puede provocar un comportamiento inesperado. Dado que no existe una protecci\u00f3n especial cuando shmem_getattr() llama a generic_fillattr(), la ejecuci\u00f3n de datos se produce mediante funciones como shmem_unlink() o shmem_mknod(). Esto puede provocar resultados inesperados, por lo que comentarlo no es suficiente. Por lo tanto, al llamar a generic_fillattr() desde shmem_getattr(), es adecuado proteger el inodo utilizando inode_lock_shared() e inode_unlock_shared() para evitar la ejecuci\u00f3n de datos."}], "lastModified": "2024-11-13T18:38:25.157", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DEAA99E9-44C6-4908-AE62-9763660B744F", "versionEndExcluding": "4.19.323", "versionStartIncluding": "4.3"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B5A89369-320F-47FC-8695-56F61F87E4C0", "versionEndExcluding": "5.4.285", "versionStartIncluding": "4.20"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1A03CABE-9B43-4E7F-951F-10DEEADAA426", "versionEndExcluding": "5.10.229", "versionStartIncluding": "5.5"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2BE18665-48ED-417A-90AA-41F3AC0B4E9A", "versionEndExcluding": "5.15.171", "versionStartIncluding": "5.11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "43EFDC15-E4D4-4F1E-B70D-62F0854BFDF3", "versionEndExcluding": "6.1.116", "versionStartIncluding": "5.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "75088E5E-2400-4D20-915F-7A65C55D9CCD", "versionEndExcluding": "6.6.60", "versionStartIncluding": "6.2"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E96F53A4-5E87-4A70-BD9A-BC327828D57F", "versionEndExcluding": "6.11.7", "versionStartIncluding": "6.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7F361E1D-580F-4A2D-A509-7615F73167A1"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.12:rc2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "925478D0-3E3D-4E6F-ACD5-09F28D5DF82C"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.12:rc3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3C95E234-D335-4B6C-96BF-E2CEBD8654ED"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.12:rc4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E0F717D8-3014-4F84-8086-0124B2111379"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.12:rc5:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "24DBE6C7-2AAE-4818-AED2-E131F153D2FA"}], "operator": "OR"}]}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}