CVE-2024-35949

一、漏洞信息
 漏洞编号：[CVE-2024-35949](https://nvd.nist.gov/vuln/detail/CVE-2024-35949)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.0,6.1.14,6.1.19,6.1.5,6.1.6,6.1.8,6.4.0,6.6.0
 CVSS V3.0分值：
  BaseScore：0.0 None
  Vector：CVSS：3.0/
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:btrfs: make sure that WRITTEN is set on all metadata blocksWe previously would call btrfs_check_leaf() if we had the checkintegrity code enabled, which meant that we could only run the extendedleaf checks if we had WRITTEN set on the header flags.This leaves a gap in our checking, because we could end up withcorruption on disk where WRITTEN isn t set on the leaf, and then theextended leaf checks don t get run which we rely on to validate all ofthe item pointers to make sure we don t access memory outside of theextent buffer.However, since 732fab95abe2 ( btrfs: check-integrity: removeCONFIG_BTRFS_FS_CHECK_INTEGRITY option ) we no longer callbtrfs_check_leaf() from btrfs_mark_buffer_dirty(), which means we onlyever call it on blocks that are being written out, and thus have WRITTENset, or that are being read in, which should have WRITTEN set.Add checks to make sure we have WRITTEN set appropriately, and then makesure __btrfs_check_leaf() always does the item checking.  This willprotect us from file systems that have been corrupted and no longer haveWRITTEN set on some of the blocks.This was hit on a crafted image tweaking the WRITTEN bit and reported byKASAN as out-of-bound access in the eb accessors. The example is a diritem at the end of an eb.  [2.042] BTRFS warning (device loop1): bad eb member start: ptr 0x3fff start 30572544 member offset 16410 size 2  [2.040] general protection fault, probably for non-canonical address 0xe0009d1000000003: 0000 [#1] PREEMPT SMP KASAN NOPTI  [2.537] KASAN: maybe wild-memory-access in range [0x0005088000000018-0x000508800000001f]  [2.729] CPU: 0 PID: 2587 Comm: mount Not tainted 6.8.2 #1  [2.729] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014  [2.621] RIP: 0010:btrfs_get_16+0x34b/0x6d0  [2.621] RSP: 0018:ffff88810871fab8 EFLAGS: 00000206  [2.621] RAX: 0000a11000000003 RBX: ffff888104ff8720 RCX: ffff88811b2288c0  [2.621] RDX: dffffc0000000000 RSI: ffffffff81dd8aca RDI: ffff88810871f748  [2.621] RBP: 000000000000401a R08: 0000000000000001 R09: ffffed10210e3ee9  [2.621] R10: ffff88810871f74f R11: 205d323430333737 R12: 000000000000001a  [2.621] R13: 000508800000001a R14: 1ffff110210e3f5d R15: ffffffff850011e8  [2.621] FS:  00007f56ea275840(0000) GS:ffff88811b200000(0000) knlGS:0000000000000000  [2.621] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033  [2.621] CR2: 00007febd13b75c0 CR3: 000000010bb50000 CR4: 00000000000006f0  [2.621] Call Trace:  [2.621]  <TASK>  [2.621]  ? show_regs+0x74/0x80  [2.621]  ? die_addr+0x46/0xc0  [2.621]  ? exc_general_protection+0x161/0x2a0  [2.621]  ? asm_exc_general_protection+0x26/0x30  [2.621]  ? btrfs_get_16+0x33a/0x6d0  [2.621]  ? btrfs_get_16+0x34b/0x6d0  [2.621]  ? btrfs_get_16+0x33a/0x6d0  [2.621]  ? __pfx_btrfs_get_16+0x10/0x10  [2.621]  ? __pfx_mutex_unlock+0x10/0x10  [2.621]  btrfs_match_dir_item_name+0x101/0x1a0  [2.621]  btrfs_lookup_dir_item+0x1f3/0x280  [2.621]  ? __pfx_btrfs_lookup_dir_item+0x10/0x10  [2.621]  btrfs_get_tree+0xd25/0x1910[ copy more details from report ]
 漏洞公开时间：2024-05-20 18:15:10
 漏洞创建时间：2024-05-20 10:46:06
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2024-35949
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/e03418abde871314e1a3a550f4c8afb7b89cb273 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/ef3ba8ce8cf7075b716aa4afcefc3034215878ee |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OTB4HWU2PTVW5NEYHHLOCXDKG3PYA534/ |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-35949 | https://bugzilla.suse.com/show_bug.cgi?id=1224700 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2024-35949 | https://bugzilla.suse.com/show_bug.cgi?id=1224700 |
| suse_bugzilla | https://git.kernel.org/stable/c/e03418abde871314e1a3a550f4c8afb7b89cb273 | https://bugzilla.suse.com/show_bug.cgi?id=1224700 |
| suse_bugzilla | https://git.kernel.org/stable/c/ef3ba8ce8cf7075b716aa4afcefc3034215878ee | https://bugzilla.suse.com/show_bug.cgi?id=1224700 |
| suse_bugzilla | https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2024/CVE-2024-35949.mbox | https://bugzilla.suse.com/show_bug.cgi?id=1224700 |
| redhat_bugzilla | https://lore.kernel.org/linux-cve-announce/2024052045-CVE-2024-35949-4a64@gregkh/T | https://bugzilla.redhat.com/show_bug.cgi?id=2281945 |
| ubuntu | https://www.cve.org/CVERecord?id=CVE-2024-35949 | https://ubuntu.com/security/CVE-2024-35949 |
| ubuntu | https://git.kernel.org/linus/e03418abde871314e1a3a550f4c8afb7b89cb273 (6.9) | https://ubuntu.com/security/CVE-2024-35949 |
| ubuntu | https://git.kernel.org/stable/c/ef3ba8ce8cf7075b716aa4afcefc3034215878ee | https://ubuntu.com/security/CVE-2024-35949 |
| ubuntu | https://git.kernel.org/stable/c/e03418abde871314e1a3a550f4c8afb7b89cb273 | https://ubuntu.com/security/CVE-2024-35949 |
| ubuntu | https://nvd.nist.gov/vuln/detail/CVE-2024-35949 | https://ubuntu.com/security/CVE-2024-35949 |
| ubuntu | https://launchpad.net/bugs/cve/CVE-2024-35949 | https://ubuntu.com/security/CVE-2024-35949 |
| ubuntu | https://security-tracker.debian.org/tracker/CVE-2024-35949 | https://ubuntu.com/security/CVE-2024-35949 |
| debian |  | https://security-tracker.debian.org/tracker/CVE-2024-35949 |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
| linux |  | https://git.kernel.org/linus/e03418abde871314e1a3a550f4c8afb7b89cb273 | https://git.kernel.org/linus/1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 | ubuntu |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
  In the Linux kernel, the following vulnerability has been resolved:btrfs: make sure that WRITTEN is set on all metadata blocksWe previously would call btrfs_check_leaf() if we had the checkintegrity code enabled, which meant that we could only run the extendedleaf checks if we had WRITTEN set on the header flags.This leaves a gap in our checking, because we could end up withcorruption on disk where WRITTEN isn t set on the leaf, and then theextended leaf checks don t get run which we rely on to validate all ofthe item pointers to make sure we don t access memory outside of theextent buffer.However, since 732fab95abe2 ( btrfs: check-integrity: removeCONFIG_BTRFS_FS_CHECK_INTEGRITY option ) we no longer callbtrfs_check_leaf() from btrfs_mark_buffer_dirty(), which means we onlyever call it on blocks that are being written out, and thus have WRITTENset, or that are being read in, which should have WRITTEN set.Add checks to make sure we have WRITTEN set appropriately, and then makesure __btrfs_check_leaf() always does the item checking.  This willprotect us from file systems that have been corrupted and no longer haveWRITTEN set on some of the blocks.This was hit on a crafted image tweaking the WRITTEN bit and reported byKASAN as out-of-bound access in the eb accessors. The example is a diritem at the end of an eb.  [2.042] BTRFS warning (device loop1): bad eb member start: ptr 0x3fff start 30572544 member offset 16410 size 2  [2.040] general protection fault, probably for non-canonical address 0xe0009d1000000003: 0000 [#1] PREEMPT SMP KASAN NOPTI  [2.537] KASAN: maybe wild-memory-access in range [0x0005088000000018-0x000508800000001f]  [2.729] CPU: 0 PID: 2587 Comm: mount Not tainted 6.8.2 #1  [2.729] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014  [2.621] RIP: 0010:btrfs_get_16+0x34b/0x6d0  [2.621] RSP: 0018:ffff88810871fab8 EFLAGS: 00000206  [2.621] RAX: 0000a11000000003 RBX: ffff888104ff8720 RCX: ffff88811b2288c0  [2.621] RDX: dffffc0000000000 RSI: ffffffff81dd8aca RDI: ffff88810871f748  [2.621] RBP: 000000000000401a R08: 0000000000000001 R09: ffffed10210e3ee9  [2.621] R10: ffff88810871f74f R11: 205d323430333737 R12: 000000000000001a  [2.621] R13: 000508800000001a R14: 1ffff110210e3f5d R15: ffffffff850011e8  [2.621] FS:  00007f56ea275840(0000) GS:ffff88811b200000(0000) knlGS:0000000000000000  [2.621] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033  [2.621] CR2: 00007febd13b75c0 CR3: 000000010bb50000 CR4: 00000000000006f0  [2.621] Call Trace:  [2.621]  <TASK>  [2.621]  ? show_regs+0x74/0x80  [2.621]  ? die_addr+0x46/0xc0  [2.621]  ? exc_general_protection+0x161/0x2a0  [2.621]  ? asm_exc_general_protection+0x26/0x30  [2.621]  ? btrfs_get_16+0x33a/0x6d0  [2.621]  ? btrfs_get_16+0x34b/0x6d0  [2.621]  ? btrfs_get_16+0x33a/0x6d0  [2.621]  ? __pfx_btrfs_get_16+0x10/0x10  [2.621]  ? __pfx_mutex_unlock+0x10/0x10  [2.621]  btrfs_match_dir_item_name+0x101/0x1a0  [2.621]  btrfs_lookup_dir_item+0x1f3/0x280  [2.621]  ? __pfx_btrfs_lookup_dir_item+0x10/0x10  [2.621]  btrfs_get_tree+0xd25/0x1910[ copy more details from report ]
 openEuler评分：
  7.8
 Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
 受影响版本排查(受影响/不受影响)：
  1.openEuler-24.03-LTS(6.6.0):受影响
2.openEuler-20.03-LTS-SP4(4.19.90):不受影响
3.openEuler-22.03-LTS-SP1(5.10.0):不受影响
4.openEuler-22.03-LTS-SP3(5.10.0):不受影响
5.openEuler-22.03-LTS-SP4(5.10.0):不受影响
6.master(6.6.0):不受影响
7.openEuler-24.03-LTS-Next(6.6.0):不受影响

修复是否涉及abi变化(是/否)：
  1.openEuler-20.03-LTS-SP4(4.19.90):否
2.openEuler-22.03-LTS-SP1(5.10.0):否
3.openEuler-22.03-LTS-SP3(5.10.0):否
4.master(6.6.0):否
5.openEuler-24.03-LTS(6.6.0):否
6.openEuler-24.03-LTS-Next(6.6.0):否
7.openEuler-22.03-LTS-SP4(5.10.0):否

原因说明：
  1.master(6.6.0):
2.openEuler-20.03-LTS-SP4(4.19.90):
3.openEuler-22.03-LTS-SP1(5.10.0):
4.openEuler-22.03-LTS-SP3(5.10.0):
5.openEuler-22.03-LTS-SP4(5.10.0):
6.openEuler-24.03-LTS(6.6.0):
7.openEuler-24.03-LTS-Next(6.6.0):

三、漏洞修复
安全公告链接：https://www.openeuler.org/zh/security/safety-bulletin/detail/?id=openEuler-SA-2024-2325

src-openEuler / kernel
关闭

内容风险标识

评论 (41)

src-openEuler / kernel关闭 .gitee-modal { width: 500px !important; }

内容风险标识

CVE-2024-35949

评论 (41)

搜索帮助

src-openEuler / kernel
关闭