CVE-2024-35956

一、漏洞信息
 漏洞编号：[CVE-2024-35956](https://nvd.nist.gov/vuln/detail/CVE-2024-35956)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.0,6.1.14,6.1.19,6.1.5,6.1.6,6.1.8,6.4.0,6.6.0
 CVSS V3.0分值：
  BaseScore：0.0 None
  Vector：CVSS：3.0/
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:btrfs: qgroup: fix qgroup prealloc rsv leak in subvolume operationsCreate subvolume, create snapshot and delete subvolume all usebtrfs_subvolume_reserve_metadata() to reserve metadata for the changesdone to the parent subvolume s fs tree, which cannot be mediated in thenormal way via start_transaction. When quota groups (squota or qgroups)are enabled, this reserves qgroup metadata of type PREALLOC. Once theoperation is associated to a transaction, we convert PREALLOC toPERTRANS, which gets cleared in bulk at the end of the transaction.However, the error paths of these three operations were not implementingthis lifecycle correctly. They unconditionally converted the PREALLOC toPERTRANS in a generic cleanup step regardless of errors or whether theoperation was fully associated to a transaction or not. This resulted inerror paths occasionally converting this rsv to PERTRANS without callingrecord_root_in_trans successfully, which meant that unless that root gotrecorded in the transaction by some other thread, the end of thetransaction would not free that root s PERTRANS, leaking it. Ultimately,this resulted in hitting a WARN in CONFIG_BTRFS_DEBUG builds at unmountfor the leaked reservation.The fix is to ensure that every qgroup PREALLOC reservation observes thefollowing properties:1. any failure before record_root_in_trans is called successfully   results in freeing the PREALLOC reservation.2. after record_root_in_trans, we convert to PERTRANS, and now the   transaction owns freeing the reservation.This patch enforces those properties on the three operations. Withoutit, generic/269 with squotas enabled at mkfs time would fail in ~5-10runs on my system. With this patch, it ran successfully 1000 times in arow.
 漏洞公开时间：2024-05-20 18:15:10
 漏洞创建时间：2024-05-20 10:14:38
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2024-35956
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/14431815a4ae4bcd7c7a68b6a64c66c7712d27c9 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/6c95336f5d8eb9ab79cd7306d71b6d0477363f8c |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/74e97958121aa1f5854da6effba70143f051b0cd |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-35956 | https://bugzilla.suse.com/show_bug.cgi?id=1224674 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2024-35956 | https://bugzilla.suse.com/show_bug.cgi?id=1224674 |
| suse_bugzilla | https://git.kernel.org/stable/c/14431815a4ae4bcd7c7a68b6a64c66c7712d27c9 | https://bugzilla.suse.com/show_bug.cgi?id=1224674 |
| suse_bugzilla | https://git.kernel.org/stable/c/6c95336f5d8eb9ab79cd7306d71b6d0477363f8c | https://bugzilla.suse.com/show_bug.cgi?id=1224674 |
| suse_bugzilla | https://git.kernel.org/stable/c/74e97958121aa1f5854da6effba70143f051b0cd | https://bugzilla.suse.com/show_bug.cgi?id=1224674 |
| suse_bugzilla | https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2024/CVE-2024-35956.mbox | https://bugzilla.suse.com/show_bug.cgi?id=1224674 |
| redhat_bugzilla | https://lore.kernel.org/linux-cve-announce/2024052018-CVE-2024-35956-3c25@gregkh/T | https://bugzilla.redhat.com/show_bug.cgi?id=2281929 |
| ubuntu | https://www.cve.org/CVERecord?id=CVE-2024-35956 | https://ubuntu.com/security/CVE-2024-35956 |
| ubuntu | https://git.kernel.org/linus/74e97958121aa1f5854da6effba70143f051b0cd (6.9-rc4) | https://ubuntu.com/security/CVE-2024-35956 |
| ubuntu | https://git.kernel.org/stable/c/14431815a4ae4bcd7c7a68b6a64c66c7712d27c9 | https://ubuntu.com/security/CVE-2024-35956 |
| ubuntu | https://git.kernel.org/stable/c/6c95336f5d8eb9ab79cd7306d71b6d0477363f8c | https://ubuntu.com/security/CVE-2024-35956 |
| ubuntu | https://git.kernel.org/stable/c/74e97958121aa1f5854da6effba70143f051b0cd | https://ubuntu.com/security/CVE-2024-35956 |
| ubuntu | https://ubuntu.com/security/notices/USN-6893-1 | https://ubuntu.com/security/CVE-2024-35956 |
| ubuntu | https://nvd.nist.gov/vuln/detail/CVE-2024-35956 | https://ubuntu.com/security/CVE-2024-35956 |
| ubuntu | https://launchpad.net/bugs/cve/CVE-2024-35956 | https://ubuntu.com/security/CVE-2024-35956 |
| ubuntu | https://security-tracker.debian.org/tracker/CVE-2024-35956 | https://ubuntu.com/security/CVE-2024-35956 |
| debian |  | https://security-tracker.debian.org/tracker/CVE-2024-35956 |
| anolis |  | https://anas.openanolis.cn/cves/detail/CVE-2024-35956 |
| cve_search |  | https://git.kernel.org/stable/c/14431815a4ae4bcd7c7a68b6a64c66c7712d27c9 |
| cve_search |  | https://git.kernel.org/stable/c/6c95336f5d8eb9ab79cd7306d71b6d0477363f8c |
| cve_search |  | https://git.kernel.org/stable/c/74e97958121aa1f5854da6effba70143f051b0cd |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
| linux |  | https://git.kernel.org/linus/74e97958121aa1f5854da6effba70143f051b0cd | https://git.kernel.org/linus/e85fde5162bf1b242cbd6daf7dba0f9b457d592b | ubuntu |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
  In the Linux kernel, the following vulnerability has been resolved:btrfs: qgroup: fix qgroup prealloc rsv leak in subvolume operationsCreate subvolume, create snapshot and delete subvolume all usebtrfs_subvolume_reserve_metadata() to reserve metadata for the changesdone to the parent subvolume s fs tree, which cannot be mediated in thenormal way via start_transaction. When quota groups (squota or qgroups)are enabled, this reserves qgroup metadata of type PREALLOC. Once theoperation is associated to a transaction, we convert PREALLOC toPERTRANS, which gets cleared in bulk at the end of the transaction.However, the error paths of these three operations were not implementingthis lifecycle correctly. They unconditionally converted the PREALLOC toPERTRANS in a generic cleanup step regardless of errors or whether theoperation was fully associated to a transaction or not. This resulted inerror paths occasionally converting this rsv to PERTRANS without callingrecord_root_in_trans successfully, which meant that unless that root gotrecorded in the transaction by some other thread, the end of thetransaction would not free that root s PERTRANS, leaking it. Ultimately,this resulted in hitting a WARN in CONFIG_BTRFS_DEBUG builds at unmountfor the leaked reservation.The fix is to ensure that every qgroup PREALLOC reservation observes thefollowing properties:1. any failure before record_root_in_trans is called successfully   results in freeing the PREALLOC reservation.2. after record_root_in_trans, we convert to PERTRANS, and now the   transaction owns freeing the reservation.This patch enforces those properties on the three operations. Withoutit, generic/269 with squotas enabled at mkfs time would fail in ~5-10runs on my system. With this patch, it ran successfully 1000 times in arow.
 openEuler评分：
  5.5
 Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
 受影响版本排查(受影响/不受影响)：
  1.openEuler-22.03-LTS-SP1(5.10.0):受影响
2.openEuler-22.03-LTS-SP3(5.10.0):受影响
3.openEuler-22.03-LTS-SP4(5.10.0):受影响
4.openEuler-20.03-LTS-SP4(4.19.90):不受影响
5.master(6.6.0):不受影响
6.openEuler-24.03-LTS(6.6.0):不受影响
7.openEuler-24.03-LTS-Next(6.6.0):不受影响

修复是否涉及abi变化(是/否)：
  1.openEuler-20.03-LTS-SP4(4.19.90):否
2.openEuler-22.03-LTS-SP1(5.10.0):否
3.openEuler-22.03-LTS-SP3(5.10.0):否
4.master(6.6.0):否
5.openEuler-24.03-LTS(6.6.0):否
6.openEuler-24.03-LTS-Next(6.6.0):否
7.openEuler-22.03-LTS-SP4(5.10.0):否

原因说明：
  1.master(6.6.0):
2.openEuler-20.03-LTS-SP4(4.19.90):
3.openEuler-22.03-LTS-SP1(5.10.0):
4.openEuler-22.03-LTS-SP3(5.10.0):
5.openEuler-22.03-LTS-SP4(5.10.0):
6.openEuler-24.03-LTS(6.6.0):
7.openEuler-24.03-LTS-Next(6.6.0):

src-openEuler/kernel
关闭

内容风险标识

评论 (29)

src-openEuler/kernel关闭 .gitee-modal { width: 500px !important; }

内容风险标识

CVE-2024-35956

评论 (29)

搜索帮助

src-openEuler/kernel
关闭