CVE-2024-46733

一、漏洞信息
 漏洞编号：[CVE-2024-46733](https://nvd.nist.gov/vuln/detail/CVE-2024-46733)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.0,6.1.14,6.1.19,6.1.5,6.1.6,6.1.8,6.4.0,6.6.0
 CVSS V3.0分值：
  BaseScore：0.0 None
  Vector：CVSS：3.0/
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:btrfs: fix qgroup reserve leaks in cow_file_rangeIn the buffered write path, the dirty page owns the qgroup reserve untilit creates an ordered_extent.Therefore, any errors that occur before the ordered_extent is createdmust free that reservation, or else the space is leaked. The fstestgeneric/475 exercises various IO error paths, and is able to triggererrors in cow_file_range where we fail to get to allocating the orderedextent. Note that because we *do* clear delalloc, we are likely toremove the inode from the delalloc list, so the inodes/pages to not haveinvalidate/launder called on them in the commit abort path.This results in failures at the unmount stage of the test that look like:  BTRFS: error (device dm-8 state EA) in cleanup_transaction:2018: errno=-5 IO failure  BTRFS: error (device dm-8 state EA) in btrfs_replace_file_extents:2416: errno=-5 IO failure  BTRFS warning (device dm-8 state EA): qgroup 0/5 has unreleased space, type 0 rsv 28672  ------------[ cut here ]------------  WARNING: CPU: 3 PID: 22588 at fs/btrfs/disk-io.c:4333 close_ctree+0x222/0x4d0 [btrfs]  Modules linked in: btrfs blake2b_generic libcrc32c xor zstd_compress raid6_pq  CPU: 3 PID: 22588 Comm: umount Kdump: loaded Tainted: G W          6.10.0-rc7-gab56fde445b8 #21  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux 1.16.3-1-1 04/01/2014  RIP: 0010:close_ctree+0x222/0x4d0 [btrfs]  RSP: 0018:ffffb4465283be00 EFLAGS: 00010202  RAX: 0000000000000001 RBX: ffffa1a1818e1000 RCX: 0000000000000001  RDX: 0000000000000000 RSI: ffffb4465283bbe0 RDI: ffffa1a19374fcb8  RBP: ffffa1a1818e13c0 R08: 0000000100028b16 R09: 0000000000000000  R10: 0000000000000003 R11: 0000000000000003 R12: ffffa1a18ad7972c  R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000  FS:  00007f9168312b80(0000) GS:ffffa1a4afcc0000(0000) knlGS:0000000000000000  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033  CR2: 00007f91683c9140 CR3: 000000010acaa000 CR4: 00000000000006f0  Call Trace:   <TASK>   ? close_ctree+0x222/0x4d0 [btrfs]   ? __warn.cold+0x8e/0xea   ? close_ctree+0x222/0x4d0 [btrfs]   ? report_bug+0xff/0x140   ? handle_bug+0x3b/0x70   ? exc_invalid_op+0x17/0x70   ? asm_exc_invalid_op+0x1a/0x20   ? close_ctree+0x222/0x4d0 [btrfs]   generic_shutdown_super+0x70/0x160   kill_anon_super+0x11/0x40   btrfs_kill_super+0x11/0x20 [btrfs]   deactivate_locked_super+0x2e/0xa0   cleanup_mnt+0xb5/0x150   task_work_run+0x57/0x80   syscall_exit_to_user_mode+0x121/0x130   do_syscall_64+0xab/0x1a0   entry_SYSCALL_64_after_hwframe+0x77/0x7f  RIP: 0033:0x7f916847a887  ---[ end trace 0000000000000000 ]---  BTRFS error (device dm-8 state EA): qgroup reserved space leakedCases 2 and 3 in the out_reserve path both pertain to this type of leakand must free the reserved qgroup data. Because it is already an errorpath, I opted not to handle the possible errors inbtrfs_free_qgroup_data.
 漏洞公开时间：2024-09-18 15:15:04
 漏洞创建时间：2024-09-18 15:29:16
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2024-46733
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/30479f31d44d47ed00ae0c7453d9b253537005b2 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/e42ef22bc10f0309c0c65d8d6ca8b4127a674b7f |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-46733 | https://bugzilla.suse.com/show_bug.cgi?id=1230708 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2024-46733 | https://bugzilla.suse.com/show_bug.cgi?id=1230708 |
| suse_bugzilla | https://git.kernel.org/stable/c/30479f31d44d47ed00ae0c7453d9b253537005b2 | https://bugzilla.suse.com/show_bug.cgi?id=1230708 |
| suse_bugzilla | https://git.kernel.org/stable/c/e42ef22bc10f0309c0c65d8d6ca8b4127a674b7f | https://bugzilla.suse.com/show_bug.cgi?id=1230708 |
| redhat_bugzilla | https://lore.kernel.org/linux-cve-announce/2024091836-CVE-2024-46733-77eb@gregkh/T | https://bugzilla.redhat.com/show_bug.cgi?id=2313064 |
| debian |  | https://security-tracker.debian.org/tracker/CVE-2024-46733 |
| anolis |  | https://anas.openanolis.cn/cves/detail/CVE-2024-46733 |
| amazon_linux_explore | https://access.redhat.com/security/cve/CVE-2024-46733 | https://explore.alas.aws.amazon.com/CVE-2024-46733.html |
| amazon_linux_explore | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-46733 | https://explore.alas.aws.amazon.com/CVE-2024-46733.html |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

无
</details>

二、漏洞分析结构反馈
 影响性分析说明：
  Reserved.
 openEuler评分：
  5.5
 Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
 受影响版本排查(受影响/不受影响)：
  1.openEuler-20.03-LTS-SP4(4.19.90):受影响
2.openEuler-22.03-LTS-SP3(5.10.0):受影响
3.openEuler-22.03-LTS-SP4(5.10.0):受影响
4.openEuler-24.03-LTS(6.6.0):受影响
5.master(6.6.0):不受影响
6.openEuler-24.03-LTS-Next(6.6.0):不受影响
7.openEuler-24.03-LTS-SP1(6.6.0):不受影响

修复是否涉及abi变化(是/否)：
  1.openEuler-20.03-LTS-SP4(4.19.90):否
2.openEuler-22.03-LTS-SP1(5.10.0):否
3.openEuler-22.03-LTS-SP3(5.10.0):否
4.master(6.6.0):否
5.openEuler-24.03-LTS(6.6.0):否
6.openEuler-24.03-LTS-Next(6.6.0):否
7.openEuler-22.03-LTS-SP4(5.10.0):否
8.openEuler-24.03-LTS-SP1(6.6.0):否

原因说明：
  1.openEuler-20.03-LTS-SP4(4.19.90):正常修复
2.openEuler-22.03-LTS-SP3(5.10.0):正常修复
3.openEuler-22.03-LTS-SP4(5.10.0):正常修复
4.openEuler-24.03-LTS(6.6.0):正常修复
5.master(6.6.0):不受影响-漏洞代码不能被攻击者触发
6.openEuler-24.03-LTS-Next(6.6.0):不受影响-漏洞代码不能被攻击者触发
7.openEuler-24.03-LTS-SP1(6.6.0):不受影响-漏洞代码不存在

src-openEuler/kernel

内容风险标识

评论 (32)

src-openEuler/kernel .gitee-modal { width: 500px !important; }

内容风险标识

CVE-2024-46733

评论 (32)

搜索帮助

src-openEuler/kernel