CVE-2024-46687

一、漏洞信息
 漏洞编号：[CVE-2024-46687](https://nvd.nist.gov/vuln/detail/CVE-2024-46687)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.0,6.1.14,6.1.19,6.1.5,6.1.6,6.1.8,6.4.0,6.6.0
 CVSS V3.0分值：
  BaseScore：7.8 High
  Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:btrfs: fix a use-after-free when hitting errors inside btrfs_submit_chunk()[BUG]There is an internal report that KASAN is reporting use-after-free, withthe following backtrace:  BUG: KASAN: slab-use-after-free in btrfs_check_read_bio+0xa68/0xb70 [btrfs]  Read of size 4 at addr ffff8881117cec28 by task kworker/u16:2/45  CPU: 1 UID: 0 PID: 45 Comm: kworker/u16:2 Not tainted 6.11.0-rc2-next-20240805-default+ #76  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-3-gd478f380-rebuilt.opensuse.org 04/01/2014  Workqueue: btrfs-endio btrfs_end_bio_work [btrfs]  Call Trace:   dump_stack_lvl+0x61/0x80   print_address_description.constprop.0+0x5e/0x2f0   print_report+0x118/0x216   kasan_report+0x11d/0x1f0   btrfs_check_read_bio+0xa68/0xb70 [btrfs]   process_one_work+0xce0/0x12a0   worker_thread+0x717/0x1250   kthread+0x2e3/0x3c0   ret_from_fork+0x2d/0x70   ret_from_fork_asm+0x11/0x20  Allocated by task 20917:   kasan_save_stack+0x37/0x60   kasan_save_track+0x10/0x30   __kasan_slab_alloc+0x7d/0x80   kmem_cache_alloc_noprof+0x16e/0x3e0   mempool_alloc_noprof+0x12e/0x310   bio_alloc_bioset+0x3f0/0x7a0   btrfs_bio_alloc+0x2e/0x50 [btrfs]   submit_extent_page+0x4d1/0xdb0 [btrfs]   btrfs_do_readpage+0x8b4/0x12a0 [btrfs]   btrfs_readahead+0x29a/0x430 [btrfs]   read_pages+0x1a7/0xc60   page_cache_ra_unbounded+0x2ad/0x560   filemap_get_pages+0x629/0xa20   filemap_read+0x335/0xbf0   vfs_read+0x790/0xcb0   ksys_read+0xfd/0x1d0   do_syscall_64+0x6d/0x140   entry_SYSCALL_64_after_hwframe+0x4b/0x53  Freed by task 20917:   kasan_save_stack+0x37/0x60   kasan_save_track+0x10/0x30   kasan_save_free_info+0x37/0x50   __kasan_slab_free+0x4b/0x60   kmem_cache_free+0x214/0x5d0   bio_free+0xed/0x180   end_bbio_data_read+0x1cc/0x580 [btrfs]   btrfs_submit_chunk+0x98d/0x1880 [btrfs]   btrfs_submit_bio+0x33/0x70 [btrfs]   submit_one_bio+0xd4/0x130 [btrfs]   submit_extent_page+0x3ea/0xdb0 [btrfs]   btrfs_do_readpage+0x8b4/0x12a0 [btrfs]   btrfs_readahead+0x29a/0x430 [btrfs]   read_pages+0x1a7/0xc60   page_cache_ra_unbounded+0x2ad/0x560   filemap_get_pages+0x629/0xa20   filemap_read+0x335/0xbf0   vfs_read+0x790/0xcb0   ksys_read+0xfd/0x1d0   do_syscall_64+0x6d/0x140   entry_SYSCALL_64_after_hwframe+0x4b/0x53[CAUSE]Although I cannot reproduce the error, the report itself is good enoughto pin down the cause.The call trace is the regular endio workqueue context, but thefree-by-task trace is showing that during btrfs_submit_chunk() wealready hit a critical error, and is calling btrfs_bio_end_io() to errorout.  And the original endio function called bio_put() to free the wholebio.This means a double freeing thus causing use-after-free, e.g.:1. Enter btrfs_submit_bio() with a read bio   The read bio length is 128K, crossing two 64K stripes.2. The first run of btrfs_submit_chunk()2.1 Call btrfs_map_block(), which returns 64K2.2 Call btrfs_split_bio()    Now there are two bios, one referring to the first 64K, the other    referring to the second 64K.2.3 The first half is submitted.3. The second run of btrfs_submit_chunk()3.1 Call btrfs_map_block(), which by somehow failed    Now we call btrfs_bio_end_io() to handle the error3.2 btrfs_bio_end_io() calls the original endio function    Which is end_bbio_data_read(), and it calls bio_put() for the    original bio.    Now the original bio is freed.4. The submitted first 64K bio finished   Now we call into btrfs_check_read_bio() and tries to advance the bio   iter.   But since the original bio (thus its iter) is already freed, we   trigger the above use-after free.   And even if the memory is not poisoned/corrupted, we will later call   the original endio function, causing a double freeing.[FIX]Instead of calling btrfs_bio_end_io(), call btrfs_orig_bbio_end_io(),which has the extra check on split bios and do the pr---truncated---
 漏洞公开时间：2024-09-13 14:15:13
 漏洞创建时间：2024-09-13 22:33:48
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2024-46687
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/10d9d8c3512f16cad47b2ff81ec6fc4b27d8ee10 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/4a3b9e1a8e6cd1a8d427a905e159de58d38941cc |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/51722b99f41f5e722ffa10b8f61e802a0e70b331 |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-46687 | https://bugzilla.suse.com/show_bug.cgi?id=1230518 |
| suse_bugzilla | https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2024/CVE-2024-46687.mbox | https://bugzilla.suse.com/show_bug.cgi?id=1230518 |
| suse_bugzilla | https://git.kernel.org/stable/c/51722b99f41f5e722ffa10b8f61e802a0e70b331 | https://bugzilla.suse.com/show_bug.cgi?id=1230518 |
| suse_bugzilla | https://git.kernel.org/stable/c/4a3b9e1a8e6cd1a8d427a905e159de58d38941cc | https://bugzilla.suse.com/show_bug.cgi?id=1230518 |
| suse_bugzilla | https://git.kernel.org/stable/c/10d9d8c3512f16cad47b2ff81ec6fc4b27d8ee10 | https://bugzilla.suse.com/show_bug.cgi?id=1230518 |
| redhat_bugzilla | https://lore.kernel.org/linux-cve-announce/2024091338-CVE-2024-46687-5668@gregkh/T | https://bugzilla.redhat.com/show_bug.cgi?id=2312075 |
| debian |  | https://security-tracker.debian.org/tracker/CVE-2024-46687 |
| cve_search |  | https://git.kernel.org/stable/c/51722b99f41f5e722ffa10b8f61e802a0e70b331 |
| cve_search |  | https://git.kernel.org/stable/c/4a3b9e1a8e6cd1a8d427a905e159de58d38941cc |
| cve_search |  | https://git.kernel.org/stable/c/10d9d8c3512f16cad47b2ff81ec6fc4b27d8ee10 |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
|  |  | https://git.kernel.org/stable/c/10d9d8c3512f16cad47b2ff81ec6fc4b27d8ee10 |  | nvd |
|  |  | https://git.kernel.org/stable/c/4a3b9e1a8e6cd1a8d427a905e159de58d38941cc |  | nvd |
|  |  | https://git.kernel.org/stable/c/51722b99f41f5e722ffa10b8f61e802a0e70b331 |  | nvd |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
        In the Linux kernel, the following vulnerability has been resolved:btrfs: fix a use-after-free when hitting errors inside btrfs_submit_chunk()[BUG]There is an internal report that KASAN is reporting use-after-free, withthe following backtrace:  BUG: KASAN: slab-use-after-free in btrfs_check_read_bio+0xa68/0xb70 [btrfs]  Read of size 4 at addr ffff8881117cec28 by task kworker/u16:2/45  CPU: 1 UID: 0 PID: 45 Comm: kworker/u16:2 Not tainted 6.11.0-rc2-next-20240805-default+ #76  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-3-gd478f380-rebuilt.opensuse.org 04/01/2014  Workqueue: btrfs-endio btrfs_end_bio_work [btrfs]  Call Trace:   dump_stack_lvl+0x61/0x80   print_address_description.constprop.0+0x5e/0x2f0   print_report+0x118/0x216   kasan_report+0x11d/0x1f0   btrfs_check_read_bio+0xa68/0xb70 [btrfs]   process_one_work+0xce0/0x12a0   worker_thread+0x717/0x1250   kthread+0x2e3/0x3c0   ret_from_fork+0x2d/0x70   ret_from_fork_asm+0x11/0x20  Allocated by task 20917:   kasan_save_stack+0x37/0x60   kasan_save_track+0x10/0x30   __kasan_slab_alloc+0x7d/0x80   kmem_cache_alloc_noprof+0x16e/0x3e0   mempool_alloc_noprof+0x12e/0x310   bio_alloc_bioset+0x3f0/0x7a0   btrfs_bio_alloc+0x2e/0x50 [btrfs]   submit_extent_page+0x4d1/0xdb0 [btrfs]   btrfs_do_readpage+0x8b4/0x12a0 [btrfs]   btrfs_readahead+0x29a/0x430 [btrfs]   read_pages+0x1a7/0xc60   page_cache_ra_unbounded+0x2ad/0x560   filemap_get_pages+0x629/0xa20   filemap_read+0x335/0xbf0   vfs_read+0x790/0xcb0   ksys_read+0xfd/0x1d0   do_syscall_64+0x6d/0x140   entry_SYSCALL_64_after_hwframe+0x4b/0x53  Freed by task 20917:   kasan_save_stack+0x37/0x60   kasan_save_track+0x10/0x30   kasan_save_free_info+0x37/0x50   __kasan_slab_free+0x4b/0x60   kmem_cache_free+0x214/0x5d0   bio_free+0xed/0x180   end_bbio_data_read+0x1cc/0x580 [btrfs]   btrfs_submit_chunk+0x98d/0x1880 [btrfs]   btrfs_submit_bio+0x33/0x70 [btrfs]   submit_one_bio+0xd4/0x130 [btrfs]   submit_extent_page+0x3ea/0xdb0 [btrfs]   btrfs_do_readpage+0x8b4/0x12a0 [btrfs]   btrfs_readahead+0x29a/0x430 [btrfs]   read_pages+0x1a7/0xc60   page_cache_ra_unbounded+0x2ad/0x560   filemap_get_pages+0x629/0xa20   filemap_read+0x335/0xbf0   vfs_read+0x790/0xcb0   ksys_read+0xfd/0x1d0   do_syscall_64+0x6d/0x140   entry_SYSCALL_64_after_hwframe+0x4b/0x53[CAUSE]Although I cannot reproduce the error, the report itself is good enoughto pin down the cause.The call trace is the regular endio workqueue context, but thefree-by-task trace is showing that during btrfs_submit_chunk() wealready hit a critical error, and is calling btrfs_bio_end_io() to errorout.  And the original endio function called bio_put() to free the wholebio.This means a double freeing thus causing use-after-free, e.g.:1. Enter btrfs_submit_bio() with a read bio   The read bio length is 128K, crossing two 64K stripes.2. The first run of btrfs_submit_chunk()2.1 Call btrfs_map_block(), which returns 64K2.2 Call btrfs_split_bio()    Now there are two bios, one referring to the first 64K, the other    referring to the second 64K.2.3 The first half is submitted.3. The second run of btrfs_submit_chunk()3.1 Call btrfs_map_block(), which by somehow failed    Now we call btrfs_bio_end_io() to handle the error3.2 btrfs_bio_end_io() calls the original endio function    Which is end_bbio_data_read(), and it calls bio_put() for the    original bio.    Now the original bio is freed.4. The submitted first 64K bio finished   Now we call into btrfs_check_read_bio() and tries to advance the bio   iter.   But since the original bio (thus its iter) is already freed, we   trigger the above use-after free.   And even if the memory is not poisoned/corrupted, we will later call   the original endio function, causing a double freeing.[FIX]Instead of calling btrfs_bio_end_io(), call btrfs_orig_bbio_end_io(),which has the extra check on split bios and do the pr---truncated---   
 openEuler评分：
  7.8
 Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
 受影响版本排查(受影响/不受影响)：
  1.openEuler-24.03-LTS(6.6.0):受影响
2.openEuler-20.03-LTS-SP4(4.19.90):不受影响
3.openEuler-22.03-LTS-SP1(5.10.0):不受影响
4.openEuler-22.03-LTS-SP3(5.10.0):不受影响
5.openEuler-22.03-LTS-SP4(5.10.0):不受影响
6.master(6.6.0):不受影响
7.openEuler-24.03-LTS-Next(6.6.0):不受影响

修复是否涉及abi变化(是/否)：
  1.openEuler-20.03-LTS-SP4(4.19.90):否
2.openEuler-22.03-LTS-SP1(5.10.0):否
3.openEuler-22.03-LTS-SP3(5.10.0):否
4.master(6.6.0):否
5.openEuler-24.03-LTS(6.6.0):否
6.openEuler-24.03-LTS-Next(6.6.0):否
7.openEuler-22.03-LTS-SP4(5.10.0):否

三、漏洞修复
安全公告链接：https://www.openeuler.org/zh/security/safety-bulletin/detail/?id=openEuler-SA-2024-2181

src-openEuler/kernel
Closed

Content Risk Flag

Comments (15)

src-openEuler/kernelClosed .gitee-modal { width: 500px !important; }

Content Risk Flag

CVE-2024-46687

Comments (15)

Search

src-openEuler/kernel
Closed