一、漏洞信息
漏洞编号：CVE-2024-26956
漏洞归属组件：kernel
漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.0,6.1.14,6.1.19,6.1.5,6.1.6,6.1.8,6.4.0,6.6.0
CVSS V2.0分值：
BaseScore：0.0 Low
Vector：CVSS：2.0/
漏洞简述：
In the Linux kernel, the following vulnerability has been resolved:nilfs2: fix failure to detect DAT corruption in btree and direct mappingsPatch series nilfs2: fix kernel bug at submit_bh_wbc() .This resolves a kernel BUG reported by syzbot. Since there are twoflaws involved, I ve made each one a separate patch.The first patch alone resolves the syzbot-reported bug, but I thinkboth fixes should be sent to stable, so I ve tagged them as such.This patch (of 2):Syzbot has reported a kernel bug in submit_bh_wbc() when writing file datato a nilfs2 file system whose metadata is corrupted.There are two flaws involved in this issue.The first flaw is that when nilfs_get_block() locates a data block usingbtree or direct mapping, if the disk address translation routinenilfs_dat_translate() fails with internal code -ENOENT due to DAT metadatacorruption, it can be passed back to nilfs_get_block(). This causesnilfs_get_block() to misidentify an existing block as non-existent,causing both data block lookup and insertion to fail inconsistently.The second flaw is that nilfs_get_block() returns a successful status inthis inconsistent state. This causes the caller __block_write_begin_int()or others to request a read even though the buffer is not mapped,resulting in a BUG_ON check for the BH_Mapped flag in submit_bh_wbc()failing.This fixes the first issue by changing the return value to code -EINVALwhen a conversion using DAT fails with code -ENOENT, avoiding theconflicting condition that leads to the kernel bug described above. Here,code -EINVAL indicates that metadata corruption was detected during theblock lookup, which will be properly handled as a file system error andconverted to -EIO when passing through the nilfs2 bmap layer.
漏洞公开时间：2024-05-01 14:15:11
漏洞创建时间：2024-05-01 15:44:07
漏洞详情参考链接：
https://nvd.nist.gov/vuln/detail/CVE-2024-26956

漏洞分析指导链接：
https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
漏洞数据来源:
openBrain开源漏洞感知系统
漏洞补丁信息：

二、漏洞分析结构反馈
影响性分析说明：
In the Linux kernel, the following vulnerability has been resolved:nilfs2: fix failure to detect DAT corruption in btree and direct mappingsPatch series nilfs2: fix kernel bug at submit_bh_wbc() .This resolves a kernel BUG reported by syzbot. Since there are twoflaws involved, I ve made each one a separate patch.The first patch alone resolves the syzbot-reported bug, but I thinkboth fixes should be sent to stable, so I ve tagged them as such.This patch (of 2):Syzbot has reported a kernel bug in submit_bh_wbc() when writing file datato a nilfs2 file system whose metadata is corrupted.There are two flaws involved in this issue.The first flaw is that when nilfs_get_block() locates a data block usingbtree or direct mapping, if the disk address translation routinenilfs_dat_translate() fails with internal code -ENOENT due to DAT metadatacorruption, it can be passed back to nilfs_get_block(). This causesnilfs_get_block() to misidentify an existing block as non-existent,causing both data block lookup and insertion to fail inconsistently.The second flaw is that nilfs_get_block() returns a successful status inthis inconsistent state. This causes the caller __block_write_begin_int()or others to request a read even though the buffer is not mapped,resulting in a BUG_ON check for the BH_Mapped flag in submit_bh_wbc()failing.This fixes the first issue by changing the return value to code -EINVALwhen a conversion using DAT fails with code -ENOENT, avoiding theconflicting condition that leads to the kernel bug described above. Here,code -EINVAL indicates that metadata corruption was detected during theblock lookup, which will be properly handled as a file system error andconverted to -EIO when passing through the nilfs2 bmap layer.
openEuler评分：
5.5
Vector：CVSS：2.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
受影响版本排查(受影响/不受影响)：
1.openEuler-20.03-LTS-SP1(4.19.90):受影响
2.openEuler-20.03-LTS-SP4:受影响
3.openEuler-22.03-LTS(5.10.0):受影响
4.openEuler-22.03-LTS-SP1(5.10.0):受影响
5.openEuler-22.03-LTS-SP2(5.10.0):受影响
6.openEuler-22.03-LTS-SP3:受影响
7.openEuler-22.03-LTS-SP4:不受影响
8.master(6.1.0):不受影响
9.openEuler-22.03-LTS-Next(5.10.0):不受影响
10.openEuler-24.03-LTS(6.6.0):不受影响
11.openEuler-24.03-LTS-Next(6.6.0):不受影响

修复是否涉及abi变化(是/否)：
1.openEuler-20.03-LTS-SP1(4.19.90):否
2.openEuler-20.03-LTS-SP4:否
3.openEuler-22.03-LTS(5.10.0):否
4.openEuler-22.03-LTS-SP1(5.10.0):否
5.openEuler-22.03-LTS-SP2(5.10.0):否
6.openEuler-22.03-LTS-SP3:否
7.master(6.1.0):否
8.openEuler-22.03-LTS-Next(5.10.0):否
9.openEuler-24.03-LTS(6.6.0):否
10.openEuler-24.03-LTS-Next(6.6.0):否
11.openEuler-22.03-LTS-SP4:否