CVE-2024-27080

一、漏洞信息
 漏洞编号：[CVE-2024-27080](https://nvd.nist.gov/vuln/detail/CVE-2024-27080)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.0,6.1.14,6.1.19,6.1.5,6.1.6,6.1.8,6.4.0,6.6.0
 CVSS V2.0分值：
  BaseScore：0.0 Low
  Vector：CVSS：2.0/
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:btrfs: fix race when detecting delalloc ranges during fiemapFor fiemap we recently stopped locking the target extent range for thewhole duration of the fiemap call, in order to avoid a deadlock in ascenario where the fiemap buffer happens to be a memory mapped range ofthe same file. This use case is very unlikely to be useful in practice butit may be triggered by fuzz testing (syzbot, etc).This however introduced a race that makes us miss delalloc ranges forfile regions that are currently holes, so the caller of fiemap will notbe aware that there s data for some file regions. This can be quiteserious for some use cases - for example in coreutils versions before 9.0,the cp program used fiemap to detect holes and data in the source file,copying only regions with data (extents or delalloc) from the source fileto the destination file in order to preserve holes (see the documentationfor its --sparse command line option). This means that if cp was usedwith a source file that had delalloc in a hole, the destination file couldend up without that data, which is effectively a data loss issue, if ithappened to hit the race described below.The race happens like this:1) Fiemap is called, without the FIEMAP_FLAG_SYNC flag, for a file that   has delalloc in the file range [64M, 65M[, which is currently a hole;2) Fiemap locks the inode in shared mode, then starts iterating the   inode s subvolume tree searching for file extent items, without having   the whole fiemap target range locked in the inode s io tree - the   change introduced recently by commit b0ad381fa769 ( btrfs: fix   deadlock with fiemap and extent locking ). It only locks ranges in   the io tree when it finds a hole or prealloc extent since that   commit;3) Note that fiemap clones each leaf before using it, and this is to   avoid deadlocks when locking a file range in the inode s io tree and   the fiemap buffer is memory mapped to some file, because writing   to the page with btrfs_page_mkwrite() will wait on any ordered extent   for the page s range and the ordered extent needs to lock the range   and may need to modify the same leaf, therefore leading to a deadlock   on the leaf;4) While iterating the file extent items in the cloned leaf before   finding the hole in the range [64M, 65M[, the delalloc in that range   is flushed and its ordered extent completes - meaning the corresponding   file extent item is in the inode s subvolume tree, but not present in   the cloned leaf that fiemap is iterating over;5) When fiemap finds the hole in the [64M, 65M[ range by seeing the gap in   the cloned leaf (or a file extent item with disk_bytenr == 0 in case   the NO_HOLES feature is not enabled), it will lock that file range in   the inode s io tree and then search for delalloc by checking for the   EXTENT_DELALLOC bit in the io tree for that range and ordered extents   (with btrfs_find_delalloc_in_range()). But it finds nothing since the   delalloc in that range was already flushed and the ordered extent   completed and is gone - as a result fiemap will not report that there s   delalloc or an extent for the range [64M, 65M[, so user space will be   mislead into thinking that there s a hole in that range.This could actually be sporadically triggered with test case generic/094from fstests, which reports a missing extent/delalloc range like this:  generic/094 2s ... - output mismatch (see /home/fdmanana/git/hub/xfstests/results//generic/094.out.bad)      --- tests/generic/094.out	2020-06-10 19:29:03.830519425 +0100      +++ /home/fdmanana/git/hub/xfstests/results//generic/094.out.bad	2024-02-28 11:00:00.381071525 +0000      @@ -1,3 +1,9 @@       QA output created by 094       fiemap run with sync       fiemap run without sync      +ERROR: couldn t find extent at 7      +map is  HHDDHPPDPHPH       +logical: [       5..       6] phys:---truncated---
 漏洞公开时间：2024-05-01 21:15:51
 漏洞创建时间：2024-05-01 22:53:07
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2024-27080
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/49d640d2946c35a17b051d54171a032dd95b0f50 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/978b63f7464abcfd364a6c95f734282c50f3decf |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/ced63fffd63072c0ca55d5a451010d71bf08c0b3 |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-27080 | https://bugzilla.suse.com/show_bug.cgi?id=1223782 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2024-27080 | https://bugzilla.suse.com/show_bug.cgi?id=1223782 |
| suse_bugzilla | https://git.kernel.org/stable/c/49d640d2946c35a17b051d54171a032dd95b0f50 | https://bugzilla.suse.com/show_bug.cgi?id=1223782 |
| suse_bugzilla | https://git.kernel.org/stable/c/978b63f7464abcfd364a6c95f734282c50f3decf | https://bugzilla.suse.com/show_bug.cgi?id=1223782 |
| suse_bugzilla | https://git.kernel.org/stable/c/ced63fffd63072c0ca55d5a451010d71bf08c0b3 | https://bugzilla.suse.com/show_bug.cgi?id=1223782 |
| suse_bugzilla | https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2024/CVE-2024-27080.mbox | https://bugzilla.suse.com/show_bug.cgi?id=1223782 |
| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2278490 | https://bugzilla.suse.com/show_bug.cgi?id=1223782 |
| redhat_bugzilla | https://lore.kernel.org/linux-cve-announce/2024050135-CVE-2024-27080-46f0@gregkh/T | https://bugzilla.redhat.com/show_bug.cgi?id=2278490 |
| debian |  | https://security-tracker.debian.org/tracker/CVE-2024-27080 |
| ubuntu | https://www.cve.org/CVERecord?id=CVE-2024-27080 | https://ubuntu.com/security/CVE-2024-27080 |
| ubuntu | https://git.kernel.org/linus/978b63f7464abcfd364a6c95f734282c50f3decf (6.9-rc1) | https://ubuntu.com/security/CVE-2024-27080 |
| ubuntu | https://git.kernel.org/stable/c/49d640d2946c35a17b051d54171a032dd95b0f50 | https://ubuntu.com/security/CVE-2024-27080 |
| ubuntu | https://git.kernel.org/stable/c/ced63fffd63072c0ca55d5a451010d71bf08c0b3 | https://ubuntu.com/security/CVE-2024-27080 |
| ubuntu | https://git.kernel.org/stable/c/978b63f7464abcfd364a6c95f734282c50f3decf | https://ubuntu.com/security/CVE-2024-27080 |
| ubuntu | https://nvd.nist.gov/vuln/detail/CVE-2024-27080 | https://ubuntu.com/security/CVE-2024-27080 |
| ubuntu | https://launchpad.net/bugs/cve/CVE-2024-27080 | https://ubuntu.com/security/CVE-2024-27080 |
| ubuntu | https://security-tracker.debian.org/tracker/CVE-2024-27080 | https://ubuntu.com/security/CVE-2024-27080 |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
| linux |  | https://git.kernel.org/linus/978b63f7464abcfd364a6c95f734282c50f3decf | https://git.kernel.org/linus/b0ad381fa7690244802aed119b478b4bdafc31dd | ubuntu |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
  Reserved.
 openEuler评分：
  4.0
 Vector：CVSS：3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:N
 受影响版本排查(受影响/不受影响)：
  1.openEuler-20.03-LTS-SP1(4.19.90):不受影响
2.openEuler-20.03-LTS-SP4(4.19.90):不受影响
3.openEuler-22.03-LTS(5.10.0):不受影响
4.openEuler-22.03-LTS-SP1(5.10.0):不受影响
5.openEuler-22.03-LTS-SP2(5.10.0):不受影响
6.openEuler-22.03-LTS-SP3(5.10.0):不受影响
7.openEuler-22.03-LTS-SP4(5.10.0):不受影响
8.master(6.1.0):不受影响
9.openEuler-22.03-LTS-Next(5.10.0):不受影响
10.openEuler-24.03-LTS(6.6.0):不受影响
11.openEuler-24.03-LTS-Next(6.6.0):不受影响

修复是否涉及abi变化(是/否)：
  1.openEuler-20.03-LTS-SP1(4.19.90):否
2.openEuler-20.03-LTS-SP4(4.19.90):否
3.openEuler-22.03-LTS(5.10.0):否
4.openEuler-22.03-LTS-SP1(5.10.0):否
5.openEuler-22.03-LTS-SP2(5.10.0):否
6.openEuler-22.03-LTS-SP3(5.10.0):否
7.master(6.1.0):否
8.openEuler-22.03-LTS-Next(5.10.0):否
9.openEuler-24.03-LTS(6.6.0):否
10.openEuler-24.03-LTS-Next(6.6.0):否
11.openEuler-22.03-LTS-SP4(5.10.0):否

src-openEuler/kernel
Closed

Content Risk Flag

Comments (5)

src-openEuler/kernelClosed .gitee-modal { width: 500px !important; }

Content Risk Flag

CVE-2024-27080

Comments (5)

Search

src-openEuler/kernel
Closed