CVE-2024-26944

一、漏洞信息
 漏洞编号：[CVE-2024-26944](https://nvd.nist.gov/vuln/detail/CVE-2024-26944)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.0,6.1.14,6.1.19,6.1.5,6.1.6,6.1.8,6.4.0,6.6.0
 CVSS V3.0分值：
  BaseScore：0.0 None
  Vector：CVSS：3.0/
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:btrfs: zoned: fix use-after-free in do_zone_finish()Shinichiro reported the following use-after-free triggered by the devicereplace operation in fstests btrfs/070. BTRFS info (device nullb1): scrub: finished on devid 1 with status: 0 ================================================================== BUG: KASAN: slab-use-after-free in do_zone_finish+0x91a/0xb90 [btrfs] Read of size 8 at addr ffff8881543c8060 by task btrfs-cleaner/3494007 CPU: 0 PID: 3494007 Comm: btrfs-cleaner Tainted: G        W          6.8.0-rc5-kts #1 Hardware name: Supermicro Super Server/X11SPi-TF, BIOS 3.3 02/21/2020 Call Trace:  <TASK>  dump_stack_lvl+0x5b/0x90  print_report+0xcf/0x670  ? __virt_addr_valid+0x200/0x3e0  kasan_report+0xd8/0x110  ? do_zone_finish+0x91a/0xb90 [btrfs]  ? do_zone_finish+0x91a/0xb90 [btrfs]  do_zone_finish+0x91a/0xb90 [btrfs]  btrfs_delete_unused_bgs+0x5e1/0x1750 [btrfs]  ? __pfx_btrfs_delete_unused_bgs+0x10/0x10 [btrfs]  ? btrfs_put_root+0x2d/0x220 [btrfs]  ? btrfs_clean_one_deleted_snapshot+0x299/0x430 [btrfs]  cleaner_kthread+0x21e/0x380 [btrfs]  ? __pfx_cleaner_kthread+0x10/0x10 [btrfs]  kthread+0x2e3/0x3c0  ? __pfx_kthread+0x10/0x10  ret_from_fork+0x31/0x70  ? __pfx_kthread+0x10/0x10  ret_from_fork_asm+0x1b/0x30  </TASK> Allocated by task 3493983:  kasan_save_stack+0x33/0x60  kasan_save_track+0x14/0x30  __kasan_kmalloc+0xaa/0xb0  btrfs_alloc_device+0xb3/0x4e0 [btrfs]  device_list_add.constprop.0+0x993/0x1630 [btrfs]  btrfs_scan_one_device+0x219/0x3d0 [btrfs]  btrfs_control_ioctl+0x26e/0x310 [btrfs]  __x64_sys_ioctl+0x134/0x1b0  do_syscall_64+0x99/0x190  entry_SYSCALL_64_after_hwframe+0x6e/0x76 Freed by task 3494056:  kasan_save_stack+0x33/0x60  kasan_save_track+0x14/0x30  kasan_save_free_info+0x3f/0x60  poison_slab_object+0x102/0x170  __kasan_slab_free+0x32/0x70  kfree+0x11b/0x320  btrfs_rm_dev_replace_free_srcdev+0xca/0x280 [btrfs]  btrfs_dev_replace_finishing+0xd7e/0x14f0 [btrfs]  btrfs_dev_replace_by_ioctl+0x1286/0x25a0 [btrfs]  btrfs_ioctl+0xb27/0x57d0 [btrfs]  __x64_sys_ioctl+0x134/0x1b0  do_syscall_64+0x99/0x190  entry_SYSCALL_64_after_hwframe+0x6e/0x76 The buggy address belongs to the object at ffff8881543c8000  which belongs to the cache kmalloc-1k of size 1024 The buggy address is located 96 bytes inside of  freed 1024-byte region [ffff8881543c8000, ffff8881543c8400) The buggy address belongs to the physical page: page:00000000fe2c1285 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1543c8 head:00000000fe2c1285 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0x17ffffc0000840(slab|head|node=0|zone=2|lastcpupid=0x1fffff) page_type: 0xffffffff() raw: 0017ffffc0000840 ffff888100042dc0 ffffea0019e8f200 dead000000000002 raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address:  ffff8881543c7f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ffff8881543c7f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff8881543c8000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb                                                        ^  ffff8881543c8080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb  ffff8881543c8100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fbThis UAF happens because we re accessing stale zone information of aalready removed btrfs_device in do_zone_finish().The sequence of events is as follows:btrfs_dev_replace_start  btrfs_scrub_dev   btrfs_dev_replace_finishing    btrfs_dev_replace_update_device_in_mapping_tree <-- devices replaced    btrfs_rm_dev_replace_free_srcdev     btrfs_free_device                              <-- device freedcleaner_kthread btrfs_delete_unused_bgs  btrfs_zone_finish   do_zone_finish              <-- refers the freed deviceThe reason for this is that we re using a---truncated---
 漏洞公开时间：2024-05-01 14:15:10
 漏洞创建时间：2024-05-01 07:13:10
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2024-26944
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/1ec17ef59168a1a6f1105f5dc517f783839a5302 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/34ca809e055eca5cfe63d9c7efbf80b7c21b4e57 |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-26944 | https://bugzilla.suse.com/show_bug.cgi?id=1223731 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2024-26944 | https://bugzilla.suse.com/show_bug.cgi?id=1223731 |
| suse_bugzilla | https://git.kernel.org/stable/c/1ec17ef59168a1a6f1105f5dc517f783839a5302 | https://bugzilla.suse.com/show_bug.cgi?id=1223731 |
| suse_bugzilla | https://git.kernel.org/stable/c/34ca809e055eca5cfe63d9c7efbf80b7c21b4e57 | https://bugzilla.suse.com/show_bug.cgi?id=1223731 |
| suse_bugzilla | https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2024/CVE-2024-26944.mbox | https://bugzilla.suse.com/show_bug.cgi?id=1223731 |
| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2278210 | https://bugzilla.suse.com/show_bug.cgi?id=1223731 |
| redhat_bugzilla | https://lore.kernel.org/linux-cve-announce/2024050125-CVE-2024-26944-598c@gregkh/T | https://bugzilla.redhat.com/show_bug.cgi?id=2278210 |
| ubuntu | https://www.cve.org/CVERecord?id=CVE-2024-26944 | https://ubuntu.com/security/CVE-2024-26944 |
| ubuntu | https://git.kernel.org/linus/1ec17ef59168a1a6f1105f5dc517f783839a5302 (6.9-rc2) | https://ubuntu.com/security/CVE-2024-26944 |
| ubuntu | https://git.kernel.org/stable/c/34ca809e055eca5cfe63d9c7efbf80b7c21b4e57 | https://ubuntu.com/security/CVE-2024-26944 |
| ubuntu | https://git.kernel.org/stable/c/1ec17ef59168a1a6f1105f5dc517f783839a5302 | https://ubuntu.com/security/CVE-2024-26944 |
| ubuntu | https://ubuntu.com/security/notices/USN-6816-1 | https://ubuntu.com/security/CVE-2024-26944 |
| ubuntu | https://ubuntu.com/security/notices/USN-6817-1 | https://ubuntu.com/security/CVE-2024-26944 |
| ubuntu | https://ubuntu.com/security/notices/USN-6817-2 | https://ubuntu.com/security/CVE-2024-26944 |
| ubuntu | https://ubuntu.com/security/notices/USN-6817-3 | https://ubuntu.com/security/CVE-2024-26944 |
| ubuntu | https://nvd.nist.gov/vuln/detail/CVE-2024-26944 | https://ubuntu.com/security/CVE-2024-26944 |
| ubuntu | https://launchpad.net/bugs/cve/CVE-2024-26944 | https://ubuntu.com/security/CVE-2024-26944 |
| ubuntu | https://security-tracker.debian.org/tracker/CVE-2024-26944 | https://ubuntu.com/security/CVE-2024-26944 |
| debian |  | https://security-tracker.debian.org/tracker/CVE-2024-26944 |
| cve_search |  | https://git.kernel.org/stable/c/34ca809e055eca5cfe63d9c7efbf80b7c21b4e57 |
| cve_search |  | https://git.kernel.org/stable/c/1ec17ef59168a1a6f1105f5dc517f783839a5302 |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
| linux |  | https://git.kernel.org/linus/1ec17ef59168a1a6f1105f5dc517f783839a5302 | https://git.kernel.org/linus/1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 | ubuntu |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
    In the Linux kernel, the following vulnerability has been resolved:btrfs: zoned: fix use-after-free in do_zone_finish()Shinichiro reported the following use-after-free triggered by the devicereplace operation in fstests btrfs/070. BTRFS info (device nullb1): scrub: finished on devid 1 with status: 0 ================================================================== BUG: KASAN: slab-use-after-free in do_zone_finish+0x91a/0xb90 [btrfs] Read of size 8 at addr ffff8881543c8060 by task btrfs-cleaner/3494007 CPU: 0 PID: 3494007 Comm: btrfs-cleaner Tainted: G        W          6.8.0-rc5-kts #1 Hardware name: Supermicro Super Server/X11SPi-TF, BIOS 3.3 02/21/2020 Call Trace:  &lt;TASK&gt;  dump_stack_lvl+0x5b/0x90  print_report+0xcf/0x670  ? __virt_addr_valid+0x200/0x3e0  kasan_report+0xd8/0x110  ? do_zone_finish+0x91a/0xb90 [btrfs]  ? do_zone_finish+0x91a/0xb90 [btrfs]  do_zone_finish+0x91a/0xb90 [btrfs]  btrfs_delete_unused_bgs+0x5e1/0x1750 [btrfs]  ? __pfx_btrfs_delete_unused_bgs+0x10/0x10 [btrfs]  ? btrfs_put_root+0x2d/0x220 [btrfs]  ? btrfs_clean_one_deleted_snapshot+0x299/0x430 [btrfs]  cleaner_kthread+0x21e/0x380 [btrfs]  ? __pfx_cleaner_kthread+0x10/0x10 [btrfs]  kthread+0x2e3/0x3c0  ? __pfx_kthread+0x10/0x10  ret_from_fork+0x31/0x70  ? __pfx_kthread+0x10/0x10  ret_from_fork_asm+0x1b/0x30  &lt;/TASK&gt; Allocated by task 3493983:  kasan_save_stack+0x33/0x60  kasan_save_track+0x14/0x30  __kasan_kmalloc+0xaa/0xb0  btrfs_alloc_device+0xb3/0x4e0 [btrfs]  device_list_add.constprop.0+0x993/0x1630 [btrfs]  btrfs_scan_one_device+0x219/0x3d0 [btrfs]  btrfs_control_ioctl+0x26e/0x310 [btrfs]  __x64_sys_ioctl+0x134/0x1b0  do_syscall_64+0x99/0x190  entry_SYSCALL_64_after_hwframe+0x6e/0x76 Freed by task 3494056:  kasan_save_stack+0x33/0x60  kasan_save_track+0x14/0x30  kasan_save_free_info+0x3f/0x60  poison_slab_object+0x102/0x170  __kasan_slab_free+0x32/0x70  kfree+0x11b/0x320  btrfs_rm_dev_replace_free_srcdev+0xca/0x280 [btrfs]  btrfs_dev_replace_finishing+0xd7e/0x14f0 [btrfs]  btrfs_dev_replace_by_ioctl+0x1286/0x25a0 [btrfs]  btrfs_ioctl+0xb27/0x57d0 [btrfs]  __x64_sys_ioctl+0x134/0x1b0  do_syscall_64+0x99/0x190  entry_SYSCALL_64_after_hwframe+0x6e/0x76 The buggy address belongs to the object at ffff8881543c8000  which belongs to the cache kmalloc-1k of size 1024 The buggy address is located 96 bytes inside of  freed 1024-byte region [ffff8881543c8000, ffff8881543c8400) The buggy address belongs to the physical page: page:00000000fe2c1285 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1543c8 head:00000000fe2c1285 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0x17ffffc0000840(slab|head|node=0|zone=2|lastcpupid=0x1fffff) page_type: 0xffffffff() raw: 0017ffffc0000840 ffff888100042dc0 ffffea0019e8f200 dead000000000002 raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address:  ffff8881543c7f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ffff8881543c7f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 &gt;ffff8881543c8000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb                                                        ^  ffff8881543c8080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb  ffff8881543c8100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fbThis UAF happens because we_x27;re accessing stale zone information of aalready removed btrfs_device in do_zone_finish().The sequence of events is as follows:btrfs_dev_replace_start  btrfs_scrub_dev   btrfs_dev_replace_finishing    btrfs_dev_replace_update_device_in_mapping_tree &lt;-- devices replaced    btrfs_rm_dev_replace_free_srcdev     btrfs_free_device                              &lt;-- device freedcleaner_kthread btrfs_delete_unused_bgs  btrfs_zone_finish   do_zone_finish              &lt;-- refers the freed deviceThe reason for this is that we_ 
 openEuler评分：
  5.5
 Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
 受影响版本排查(受影响/不受影响)：
  1.openEuler-24.03-LTS(6.6.0):受影响
2.openEuler-20.03-LTS-SP4(4.19.90):不受影响
3.openEuler-22.03-LTS-SP1(5.10.0):不受影响
4.openEuler-22.03-LTS-SP3(5.10.0):不受影响
5.openEuler-22.03-LTS-SP4(5.10.0):不受影响
6.master(6.6.0):不受影响
7.openEuler-24.03-LTS-Next(6.6.0):不受影响

修复是否涉及abi变化(是/否)：
  1.openEuler-20.03-LTS-SP4(4.19.90):否
2.openEuler-22.03-LTS-SP1(5.10.0):否
3.openEuler-22.03-LTS-SP3(5.10.0):否
4.master(6.6.0):否
5.openEuler-24.03-LTS(6.6.0):否
6.openEuler-24.03-LTS-Next(6.6.0):否
7.openEuler-22.03-LTS-SP4(5.10.0):否

原因说明：
  1.master(6.6.0):
2.openEuler-20.03-LTS-SP4(4.19.90):
3.openEuler-22.03-LTS-SP1(5.10.0):
4.openEuler-22.03-LTS-SP3(5.10.0):
5.openEuler-22.03-LTS-SP4(5.10.0):
6.openEuler-24.03-LTS(6.6.0):
7.openEuler-24.03-LTS-Next(6.6.0):
8.openEuler-24.03-LTS-SP1:

三、漏洞修复
安全公告链接：https://www.openeuler.org/zh/security/safety-bulletin/detail/?id=openEuler-SA-2024-2446

src-openEuler/kernel
Closed

Content Risk Flag

Comments (10)

src-openEuler/kernelClosed .gitee-modal { width: 500px !important; }

Content Risk Flag

CVE-2024-26944

Comments (10)

Search

src-openEuler/kernel
Closed