CVE-2024-26792

一、漏洞信息
 漏洞编号：[CVE-2024-26792](https://nvd.nist.gov/vuln/detail/CVE-2024-26792)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.0,6.1.14,6.1.19,6.1.5,6.1.6,6.1.8,6.4.0
 CVSS V2.0分值：
  BaseScore：0.0 Low
  Vector：CVSS：2.0/
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:btrfs: fix double free of anonymous device after snapshot creation failureWhen creating a snapshot we may do a double free of an anonymous devicein case there s an error committing the transaction. The second free mayresult in freeing an anonymous device number that was allocated by someother subsystem in the kernel or another btrfs filesystem.The steps that lead to this:1) At ioctl.c:create_snapshot() we allocate an anonymous device number   and assign it to pending_snapshot->anon_dev;2) Then we call btrfs_commit_transaction() and end up at   transaction.c:create_pending_snapshot();3) There we call btrfs_get_new_fs_root() and pass it the anonymous device   number stored in pending_snapshot->anon_dev;4) btrfs_get_new_fs_root() frees that anonymous device number because   btrfs_lookup_fs_root() returned a root - someone else did a lookup   of the new root already, which could some task doing backref walking;5) After that some error happens in the transaction commit path, and at   ioctl.c:create_snapshot() we jump to the  fail  label, and after   that we free again the same anonymous device number, which in the   meanwhile may have been reallocated somewhere else, because   pending_snapshot->anon_dev still has the same value as in step 1.Recently syzbot ran into this and reported the following trace:  ------------[ cut here ]------------  ida_free called for id=51 which is not allocated.  WARNING: CPU: 1 PID: 31038 at lib/idr.c:525 ida_free+0x370/0x420 lib/idr.c:525  Modules linked in:  CPU: 1 PID: 31038 Comm: syz-executor.2 Not tainted 6.8.0-rc4-syzkaller-00410-gc02197fc9076 #0  Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024  RIP: 0010:ida_free+0x370/0x420 lib/idr.c:525  Code: 10 42 80 3c 28 (...)  RSP: 0018:ffffc90015a67300 EFLAGS: 00010246  RAX: be5130472f5dd000 RBX: 0000000000000033 RCX: 0000000000040000  RDX: ffffc90009a7a000 RSI: 000000000003ffff RDI: 0000000000040000  RBP: ffffc90015a673f0 R08: ffffffff81577992 R09: 1ffff92002b4cdb4  R10: dffffc0000000000 R11: fffff52002b4cdb5 R12: 0000000000000246  R13: dffffc0000000000 R14: ffffffff8e256b80 R15: 0000000000000246  FS:  00007fca3f4b46c0(0000) GS:ffff8880b9500000(0000) knlGS:0000000000000000  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033  CR2: 00007f167a17b978 CR3: 000000001ed26000 CR4: 0000000000350ef0  Call Trace:   <TASK>   btrfs_get_root_ref+0xa48/0xaf0 fs/btrfs/disk-io.c:1346   create_pending_snapshot+0xff2/0x2bc0 fs/btrfs/transaction.c:1837   create_pending_snapshots+0x195/0x1d0 fs/btrfs/transaction.c:1931   btrfs_commit_transaction+0xf1c/0x3740 fs/btrfs/transaction.c:2404   create_snapshot+0x507/0x880 fs/btrfs/ioctl.c:848   btrfs_mksubvol+0x5d0/0x750 fs/btrfs/ioctl.c:998   btrfs_mksnapshot+0xb5/0xf0 fs/btrfs/ioctl.c:1044   __btrfs_ioctl_snap_create+0x387/0x4b0 fs/btrfs/ioctl.c:1306   btrfs_ioctl_snap_create_v2+0x1ca/0x400 fs/btrfs/ioctl.c:1393   btrfs_ioctl+0xa74/0xd40   vfs_ioctl fs/ioctl.c:51 [inline]   __do_sys_ioctl fs/ioctl.c:871 [inline]   __se_sys_ioctl+0xfe/0x170 fs/ioctl.c:857   do_syscall_64+0xfb/0x240   entry_SYSCALL_64_after_hwframe+0x6f/0x77  RIP: 0033:0x7fca3e67dda9  Code: 28 00 00 00 (...)  RSP: 002b:00007fca3f4b40c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010  RAX: ffffffffffffffda RBX: 00007fca3e7abf80 RCX: 00007fca3e67dda9  RDX: 00000000200005c0 RSI: 0000000050009417 RDI: 0000000000000003  RBP: 00007fca3e6ca47a R08: 0000000000000000 R09: 0000000000000000  R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000  R13: 000000000000000b R14: 00007fca3e7abf80 R15: 00007fff6bf95658   </TASK>Where we get an explicit message where we attempt to free an anonymousdevice number that is not currently allocated. It happens in a differentcode path from the example below, at btrfs_get_root_ref(), so this changemay not fix the case triggered by sy---truncated---
 漏洞公开时间：2024-04-04 17:15:08
 漏洞创建时间：2024-04-04 18:03:07
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2024-26792
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/c34adc20b91a8e55e048b18d63f4f4ae003ecf8f |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/c8ab7521665bd0f8bc4a900244d1d5a7095cc3b9 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/e2b54eaf28df0c978626c9736b94f003b523b451 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/eb3441093aad251418921246fc3b224fd1575701 |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-26792 | https://bugzilla.suse.com/show_bug.cgi?id=1222430 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2024-26792 | https://bugzilla.suse.com/show_bug.cgi?id=1222430 |
| suse_bugzilla | https://git.kernel.org/stable/c/c34adc20b91a8e55e048b18d63f4f4ae003ecf8f | https://bugzilla.suse.com/show_bug.cgi?id=1222430 |
| suse_bugzilla | https://git.kernel.org/stable/c/c8ab7521665bd0f8bc4a900244d1d5a7095cc3b9 | https://bugzilla.suse.com/show_bug.cgi?id=1222430 |
| suse_bugzilla | https://git.kernel.org/stable/c/eb3441093aad251418921246fc3b224fd1575701 | https://bugzilla.suse.com/show_bug.cgi?id=1222430 |
| suse_bugzilla | https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2024/CVE-2024-26792.mbox | https://bugzilla.suse.com/show_bug.cgi?id=1222430 |
| suse_bugzilla | https://git.kernel.org/stable/c/e2b54eaf28df0c978626c9736b94f003b523b451 | https://bugzilla.suse.com/show_bug.cgi?id=1222430 |
| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2273446 | https://bugzilla.suse.com/show_bug.cgi?id=1222430 |
| redhat_bugzilla | https://lore.kernel.org/linux-cve-announce/2024040401-CVE-2024-26792-6048@gregkh/T | https://bugzilla.redhat.com/show_bug.cgi?id=2273446 |
| ubuntu | https://git.kernel.org/stable/c/c34adc20b91a8e55e048b18d63f4f4ae003ecf8f | https://ubuntu.com/security/CVE-2024-26792 |
| ubuntu | https://git.kernel.org/stable/c/eb3441093aad251418921246fc3b224fd1575701 | https://ubuntu.com/security/CVE-2024-26792 |
| ubuntu | https://git.kernel.org/stable/c/c8ab7521665bd0f8bc4a900244d1d5a7095cc3b9 | https://ubuntu.com/security/CVE-2024-26792 |
| ubuntu | https://www.cve.org/CVERecord?id=CVE-2024-26792 | https://ubuntu.com/security/CVE-2024-26792 |
| ubuntu | https://nvd.nist.gov/vuln/detail/CVE-2024-26792 | https://ubuntu.com/security/CVE-2024-26792 |
| ubuntu | https://launchpad.net/bugs/cve/CVE-2024-26792 | https://ubuntu.com/security/CVE-2024-26792 |
| ubuntu | https://security-tracker.debian.org/tracker/CVE-2024-26792 | https://ubuntu.com/security/CVE-2024-26792 |
| debian |  | https://security-tracker.debian.org/tracker/CVE-2024-26792 |
| ubuntu | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-26792 | https://ubuntu.com/security/CVE-2024-26792 |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
| linux |  | https://git.kernel.org/linus/e2b54eaf28df0c978626c9736b94f003b523b451 | https://git.kernel.org/linus/e03ee2fe873eb68c1f9ba5112fee70303ebf9dfb | ubuntu |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
  btrfs: fix double free of anonymous device after snapshot creation failureWhen creating a snapshot we may do a double free of an anonymous devicein case there_x27;s an error committing the transaction. The second free mayresult in freeing an anonymous device number that was allocated by someother subsystem in the kernel or another btrfs filesystem.The steps that lead to this:1) At ioctl.c:create_snapshot() we allocate an anonymous device number   and assign it to pending_snapshot-&gt;anon_dev;2) Then we call btrfs_commit_transaction() and end up at   transaction.c:create_pending_snapshot();3) There we call btrfs_get_new_fs_root() and pass it the anonymous device   number stored in pending_snapshot-&gt;anon_dev;4) btrfs_get_new_fs_root() frees that anonymous device number because   btrfs_lookup_fs_root() returned a root - someone else did a lookup   of the new root already, which could some task doing backref walking;5) After that some error happens in the transaction commit path, and at   ioctl.c:create_snapshot() we jump to the _x27;fail_x27; label, and after   that we free again the same anonymous device number, which in the   meanwhile may have been reallocated somewhere else, because   pending_snapshot-&gt;anon_dev still has the same value as in step 1.Recently syzbot ran into this and reported the following trace:  ------------[ cut here ]------------  ida_free called for id=51 which is not allocated.  WARNING: CPU: 1 PID: 31038 at lib/idr.c:525 ida_free+0x370/0x420 lib/idr.c:525  Modules linked in:  CPU: 1 PID: 31038 Comm: syz-executor.2 Not tainted 6.8.0-rc4-syzkaller-00410-gc02197fc9076 #0  Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024  RIP: 0010:ida_free+0x370/0x420 lib/idr.c:525  Code: 10 42 80 3c 28 (...)  RSP: 0018:ffffc90015a67300 EFLAGS: 00010246  RAX: be5130472f5dd000 RBX: 0000000000000033 RCX: 0000000000040000  RDX: ffffc90009a7a000 RSI: 000000000003ffff RDI: 0000000000040000  RBP: ffffc90015a673f0 R08: ffffffff81577992 R09: 1ffff92002b4cdb4  R10: dffffc0000000000 R11: fffff52002b4cdb5 R12: 0000000000000246  R13: dffffc0000000000 R14: ffffffff8e256b80 R15: 0000000000000246  FS:  00007fca3f4b46c0(0000) GS:ffff8880b9500000(0000) knlGS:0000000000000000  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033  CR2: 00007f167a17b978 CR3: 000000001ed26000 CR4: 0000000000350ef0  Call Trace:   &lt;TASK&gt;   btrfs_get_root_ref+0xa48/0xaf0 fs/btrfs/disk-io.c:1346   create_pending_snapshot+0xff2/0x2bc0 fs/btrfs/transaction.c:1837   create_pending_snapshots+0x195/0x1d0 fs/btrfs/transaction.c:1931   btrfs_commit_transaction+0xf1c/0x3740 fs/btrfs/transaction.c:2404   create_snapshot+0x507/0x880 fs/btrfs/ioctl.c:848   btrfs_mksubvol+0x5d0/0x750 fs/btrfs/ioctl.c:998   btrfs_mksnapshot+0xb5/0xf0 fs/btrfs/ioctl.c:1044   __btrfs_ioctl_snap_create+0x387/0x4b0 fs/btrfs/ioctl.c:1306   btrfs_ioctl_snap_create_v2+0x1ca/0x400 fs/btrfs/ioctl.c:1393   btrfs_ioctl+0xa74/0xd40   vfs_ioctl fs/ioctl.c:51 [inline]   __do_sys_ioctl fs/ioctl.c:871 [inline]   __se_sys_ioctl+0xfe/0x170 fs/ioctl.c:857   do_syscall_64+0xfb/0x240   entry_SYSCALL_64_after_hwframe+0x6f/0x77  RIP: 0033:0x7fca3e67dda9  Code: 28 00 00 00 (...)  RSP: 002b:00007fca3f4b40c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010  RAX: ffffffffffffffda RBX: 00007fca3e7abf80 RCX: 00007fca3e67dda9  RDX: 00000000200005c0 RSI: 0000000050009417 RDI: 0000000000000003  RBP: 00007fca3e6ca47a R08: 0000000000000000 R09: 0000000000000000  R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000  R13: 000000000000000b R14: 00007fca3e7abf80 R15: 00007fff6bf95658   &lt;/TASK&gt;Where we get an explicit message where we attempt to free an anonymousdevice number that is not currently allocated. It happens in a differentcode path from the example below, at btrfs_get_root_ref(), so this changemay not fix the case triggered by sy---truncated---
 openEuler评分：
  5.5
 Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
 受影响版本排查(受影响/不受影响)：
  1.openEuler-22.03-LTS(5.10.0):受影响
2.openEuler-22.03-LTS-SP1(5.10.0):受影响
3.openEuler-22.03-LTS-SP2(5.10.0):受影响
4.openEuler-22.03-LTS-SP3(5.10.0):受影响
5.openEuler-20.03-LTS-SP1(4.19.90):不受影响
6.openEuler-20.03-LTS-SP4(4.19.90):不受影响
7.openEuler-22.03-LTS-SP4:不受影响
8.master(6.1.0):不受影响
9.openEuler-22.03-LTS-Next(5.10.0):不受影响
10.openEuler-24.03-LTS:不受影响
11.openEuler-24.03-LTS-Next:不受影响

修复是否涉及abi变化(是/否)：
  1.openEuler-20.03-LTS-SP1(4.19.90):否
2.openEuler-20.03-LTS-SP4(4.19.90):否
3.openEuler-22.03-LTS(5.10.0):否
4.openEuler-22.03-LTS-SP1(5.10.0):否
5.openEuler-22.03-LTS-SP2(5.10.0):否
6.openEuler-22.03-LTS-SP3(5.10.0):否
7.master(6.1.0):否
8.openEuler-22.03-LTS-Next(5.10.0):否
9.openEuler-24.03-LTS:否
10.openEuler-24.03-LTS-Next:否
11.openEuler-22.03-LTS-SP4:否

src-openEuler/kernel
Closed

Content Risk Flag

Comments (8)

src-openEuler/kernelClosed .gitee-modal { width: 500px !important; }

Content Risk Flag

CVE-2024-26792

Comments (8)

Search

src-openEuler/kernel
Closed