CVE-2024-37354

一、漏洞信息
 漏洞编号：[CVE-2024-37354](https://nvd.nist.gov/vuln/detail/CVE-2024-37354)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.0,6.1.14,6.1.19,6.1.5,6.1.6,6.1.8,6.4.0,6.6.0
 CVSS V2.0分值：
  BaseScore：0.0 None
  Vector：CVSS：2.0/
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:btrfs: fix crash on racing fsync and size-extending write into preallocWe have been seeing crashes on duplicate keys inbtrfs_set_item_key_safe():  BTRFS critical (device vdb): slot 4 key (450 108 8192) new key (450 108 8192)  ------------[ cut here ]------------  kernel BUG at fs/btrfs/ctree.c:2620!  invalid opcode: 0000 [#1] PREEMPT SMP PTI  CPU: 0 PID: 3139 Comm: xfs_io Kdump: loaded Not tainted 6.9.0 #6  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-2.fc40 04/01/2014  RIP: 0010:btrfs_set_item_key_safe+0x11f/0x290 [btrfs]With the following stack trace:  #0  btrfs_set_item_key_safe (fs/btrfs/ctree.c:2620:4)  #1  btrfs_drop_extents (fs/btrfs/file.c:411:4)  #2  log_one_extent (fs/btrfs/tree-log.c:4732:9)  #3  btrfs_log_changed_extents (fs/btrfs/tree-log.c:4955:9)  #4  btrfs_log_inode (fs/btrfs/tree-log.c:6626:9)  #5  btrfs_log_inode_parent (fs/btrfs/tree-log.c:7070:8)  #6  btrfs_log_dentry_safe (fs/btrfs/tree-log.c:7171:8)  #7  btrfs_sync_file (fs/btrfs/file.c:1933:8)  #8  vfs_fsync_range (fs/sync.c:188:9)  #9  vfs_fsync (fs/sync.c:202:9)  #10 do_fsync (fs/sync.c:212:9)  #11 __do_sys_fdatasync (fs/sync.c:225:9)  #12 __se_sys_fdatasync (fs/sync.c:223:1)  #13 __x64_sys_fdatasync (fs/sync.c:223:1)  #14 do_syscall_x64 (arch/x86/entry/common.c:52:14)  #15 do_syscall_64 (arch/x86/entry/common.c:83:7)  #16 entry_SYSCALL_64+0xaf/0x14c (arch/x86/entry/entry_64.S:121)So we re logging a changed extent from fsync, which is splitting anextent in the log tree. But this split part already exists in the tree,triggering the BUG().This is the state of the log tree at the time of the crash, dumped withdrgn (https://github.com/osandov/drgn/blob/main/contrib/btrfs_tree.py)to get more details than btrfs_print_leaf() gives us:  >>> print_extent_buffer(prog.crashed_thread().stack_trace()[0][ eb ])  leaf 33439744 level 0 items 72 generation 9 owner 18446744073709551610  leaf 33439744 flags 0x100000000000000  fs uuid e5bd3946-400c-4223-8923-190ef1f18677  chunk uuid d58cb17e-6d02-494a-829a-18b7d8a399da          item 0 key (450 INODE_ITEM 0) itemoff 16123 itemsize 160                  generation 7 transid 9 size 8192 nbytes 8473563889606862198                  block group 0 mode 100600 links 1 uid 0 gid 0 rdev 0                  sequence 204 flags 0x10(PREALLOC)                  atime 1716417703.220000000 (2024-05-22 15:41:43)                  ctime 1716417704.983333333 (2024-05-22 15:41:44)                  mtime 1716417704.983333333 (2024-05-22 15:41:44)                  otime 17592186044416.000000000 (559444-03-08 01:40:16)          item 1 key (450 INODE_REF 256) itemoff 16110 itemsize 13                  index 195 namelen 3 name: 193          item 2 key (450 XATTR_ITEM 1640047104) itemoff 16073 itemsize 37                  location key (0 UNKNOWN.0 0) type XATTR                  transid 7 data_len 1 name_len 6                  name: user.a                  data a          item 3 key (450 EXTENT_DATA 0) itemoff 16020 itemsize 53                  generation 9 type 1 (regular)                  extent data disk byte 303144960 nr 12288                  extent data offset 0 nr 4096 ram 12288                  extent compression 0 (none)          item 4 key (450 EXTENT_DATA 4096) itemoff 15967 itemsize 53                  generation 9 type 2 (prealloc)                  prealloc data disk byte 303144960 nr 12288                  prealloc data offset 4096 nr 8192          item 5 key (450 EXTENT_DATA 8192) itemoff 15914 itemsize 53                  generation 9 type 2 (prealloc)                  prealloc data disk byte 303144960 nr 12288                  prealloc data offset 8192 nr 4096  ...So the real problem happened earlier: notice that items 4 (4k-12k) and 5(8k-12k) overlap. Both are prealloc extents. Item 4 straddles i_size anditem 5 starts at i_size.Here is the state of ---truncated---
 漏洞公开时间：2024-06-25 23:15:13
 漏洞创建时间：2024-06-26 00:11:48
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2024-37354
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/1ff2bd566fbcefcb892be85c493bdb92b911c428 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/3d08c52ba1887a1ff9c179d4b6a18b427bcb2097 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/9d274c19a71b3a276949933859610721a453946b |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/f4e5ed974876c14d3623e04dc43d3e3281bc6011 |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-37354 | https://bugzilla.suse.com/show_bug.cgi?id=1227101 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2024-37354 | https://bugzilla.suse.com/show_bug.cgi?id=1227101 |
| suse_bugzilla | https://git.kernel.org/stable/c/1ff2bd566fbcefcb892be85c493bdb92b911c428 | https://bugzilla.suse.com/show_bug.cgi?id=1227101 |
| suse_bugzilla | https://git.kernel.org/stable/c/3d08c52ba1887a1ff9c179d4b6a18b427bcb2097 | https://bugzilla.suse.com/show_bug.cgi?id=1227101 |
| suse_bugzilla | https://git.kernel.org/stable/c/9d274c19a71b3a276949933859610721a453946b | https://bugzilla.suse.com/show_bug.cgi?id=1227101 |
| suse_bugzilla | https://git.kernel.org/stable/c/f4e5ed974876c14d3623e04dc43d3e3281bc6011 | https://bugzilla.suse.com/show_bug.cgi?id=1227101 |
| suse_bugzilla | https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2024/CVE-2024-37354.mbox | https://bugzilla.suse.com/show_bug.cgi?id=1227101 |
| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2294279 | https://bugzilla.suse.com/show_bug.cgi?id=1227101 |
| redhat_bugzilla | https://lore.kernel.org/linux-cve-announce/2024062547-CVE-2024-37354-ccfb@gregkh/T | https://bugzilla.redhat.com/show_bug.cgi?id=2294279 |
| debian |  | https://security-tracker.debian.org/tracker/CVE-2024-37354 |
| cve_search |  | https://git.kernel.org/stable/c/1ff2bd566fbcefcb892be85c493bdb92b911c428 |
| cve_search |  | https://git.kernel.org/stable/c/3d08c52ba1887a1ff9c179d4b6a18b427bcb2097 |
| cve_search |  | https://git.kernel.org/stable/c/f4e5ed974876c14d3623e04dc43d3e3281bc6011 |
| cve_search |  | https://git.kernel.org/stable/c/9d274c19a71b3a276949933859610721a453946b |
| ubuntu | https://www.cve.org/CVERecord?id=CVE-2024-37354 | https://ubuntu.com/security/CVE-2024-37354 |
| ubuntu | https://git.kernel.org/linus/9d274c19a71b3a276949933859610721a453946b (6.10-rc3) | https://ubuntu.com/security/CVE-2024-37354 |
| ubuntu | https://git.kernel.org/stable/c/1ff2bd566fbcefcb892be85c493bdb92b911c428 | https://ubuntu.com/security/CVE-2024-37354 |
| ubuntu | https://git.kernel.org/stable/c/3d08c52ba1887a1ff9c179d4b6a18b427bcb2097 | https://ubuntu.com/security/CVE-2024-37354 |
| ubuntu | https://git.kernel.org/stable/c/f4e5ed974876c14d3623e04dc43d3e3281bc6011 | https://ubuntu.com/security/CVE-2024-37354 |
| ubuntu | https://git.kernel.org/stable/c/9d274c19a71b3a276949933859610721a453946b | https://ubuntu.com/security/CVE-2024-37354 |
| ubuntu | https://nvd.nist.gov/vuln/detail/CVE-2024-37354 | https://ubuntu.com/security/CVE-2024-37354 |
| ubuntu | https://launchpad.net/bugs/cve/CVE-2024-37354 | https://ubuntu.com/security/CVE-2024-37354 |
| ubuntu | https://security-tracker.debian.org/tracker/CVE-2024-37354 | https://ubuntu.com/security/CVE-2024-37354 |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
| linux |  | https://git.kernel.org/linus/9d274c19a71b3a276949933859610721a453946b | https://git.kernel.org/linus/1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 | ubuntu |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
              In the Linux kernel, the following vulnerability has been resolved:btrfs: fix crash on racing fsync and size-extending write into preallocWe have been seeing crashes on duplicate keys inbtrfs_set_item_key_safe():  BTRFS critical (device vdb): slot 4 key (450 108 8192) new key (450 108 8192)  ------------[ cut here ]------------  kernel BUG at fs/btrfs/ctree.c:2620!  invalid opcode: 0000 [#1] PREEMPT SMP PTI  CPU: 0 PID: 3139 Comm: xfs_io Kdump: loaded Not tainted 6.9.0 #6  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-2.fc40 04/01/2014  RIP: 0010:btrfs_set_item_key_safe+0x11f/0x290 [btrfs]With the following stack trace:  #0  btrfs_set_item_key_safe (fs/btrfs/ctree.c:2620:4)  #1  btrfs_drop_extents (fs/btrfs/file.c:411:4)  #2  log_one_extent (fs/btrfs/tree-log.c:4732:9)  #3  btrfs_log_changed_extents (fs/btrfs/tree-log.c:4955:9)  #4  btrfs_log_inode (fs/btrfs/tree-log.c:6626:9)  #5  btrfs_log_inode_parent (fs/btrfs/tree-log.c:7070:8)  #6  btrfs_log_dentry_safe (fs/btrfs/tree-log.c:7171:8)  #7  btrfs_sync_file (fs/btrfs/file.c:1933:8)  #8  vfs_fsync_range (fs/sync.c:188:9)  #9  vfs_fsync (fs/sync.c:202:9)  #10 do_fsync (fs/sync.c:212:9)  #11 __do_sys_fdatasync (fs/sync.c:225:9)  #12 __se_sys_fdatasync (fs/sync.c:223:1)  #13 __x64_sys_fdatasync (fs/sync.c:223:1)  #14 do_syscall_x64 (arch/x86/entry/common.c:52:14)  #15 do_syscall_64 (arch/x86/entry/common.c:83:7)  #16 entry_SYSCALL_64+0xaf/0x14c (arch/x86/entry/entry_64.S:121)So we re logging a changed extent from fsync, which is splitting anextent in the log tree. But this split part already exists in the tree,triggering the BUG().This is the state of the log tree at the time of the crash, dumped withdrgn (https://github.com/osandov/drgn/blob/main/contrib/btrfs_tree.py)to get more details than btrfs_print_leaf() gives us:  >>> print_extent_buffer(prog.crashed_thread().stack_trace()[0][ eb ])  leaf 33439744 level 0 items 72 generation 9 owner 18446744073709551610  leaf 33439744 flags 0x100000000000000  fs uuid e5bd3946-400c-4223-8923-190ef1f18677  chunk uuid d58cb17e-6d02-494a-829a-18b7d8a399da          item 0 key (450 INODE_ITEM 0) itemoff 16123 itemsize 160                  generation 7 transid 9 size 8192 nbytes 8473563889606862198                  block group 0 mode 100600 links 1 uid 0 gid 0 rdev 0                  sequence 204 flags 0x10(PREALLOC)                  atime 1716417703.220000000 (2024-05-22 15:41:43)                  ctime 1716417704.983333333 (2024-05-22 15:41:44)                  mtime 1716417704.983333333 (2024-05-22 15:41:44)                  otime 17592186044416.000000000 (559444-03-08 01:40:16)          item 1 key (450 INODE_REF 256) itemoff 16110 itemsize 13                  index 195 namelen 3 name: 193          item 2 key (450 XATTR_ITEM 1640047104) itemoff 16073 itemsize 37                  location key (0 UNKNOWN.0 0) type XATTR                  transid 7 data_len 1 name_len 6                  name: user.a                  data a          item 3 key (450 EXTENT_DATA 0) itemoff 16020 itemsize 53                  generation 9 type 1 (regular)                  extent data disk byte 303144960 nr 12288                  extent data offset 0 nr 4096 ram 12288                  extent compression 0 (none)          item 4 key (450 EXTENT_DATA 4096) itemoff 15967 itemsize 53                  generation 9 type 2 (prealloc)                  prealloc data disk byte 303144960 nr 12288                  prealloc data offset 4096 nr 8192          item 5 key (450 EXTENT_DATA 8192) itemoff 15914 itemsize 53                  generation 9 type 2 (prealloc)                  prealloc data disk byte 303144960 nr 12288                  prealloc data offset 8192 nr 4096  ...So the real problem happened earlier: notice that items 4 (4k-12k) and 5(8k-12k) overlap. Both are prealloc extents. Item 4 straddles i_size anditem 5 starts at i_size.Here is the state of ---truncated---      
 openEuler评分：
  6.1
 Vector：CVSS：2.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
 受影响版本排查(受影响/不受影响)：
  1.openEuler-22.03-LTS-SP1(5.10.0):受影响
2.openEuler-22.03-LTS-SP3(5.10.0):受影响
3.openEuler-24.03-LTS(6.6.0):受影响
4.openEuler-20.03-LTS-SP4(4.19.90):不受影响
5.openEuler-22.03-LTS-SP4(5.10.0):不受影响
6.master(6.1.0):不受影响
7.openEuler-24.03-LTS-Next(6.6.0):不受影响

修复是否涉及abi变化(是/否)：
  1.openEuler-20.03-LTS-SP4(4.19.90):否
2.openEuler-22.03-LTS-SP1(5.10.0):否
3.openEuler-22.03-LTS-SP3(5.10.0):否
4.master(6.1.0):否
5.openEuler-24.03-LTS(6.6.0):否
6.openEuler-24.03-LTS-Next(6.6.0):否
7.openEuler-22.03-LTS-SP4(5.10.0):否

三、漏洞修复
安全公告链接：https://www.openeuler.org/zh/security/safety-bulletin/detail/?id=openEuler-SA-2024-1839

src-openEuler / kernel
Closed

Content Risk Flag

Comments (35)

src-openEuler / kernelClosed .gitee-modal { width: 500px !important; }

Content Risk Flag

CVE-2024-37354

Comments (35)

Search

src-openEuler / kernel
Closed