CVE-2024-46734

一、漏洞信息
 漏洞编号：[CVE-2024-46734](https://nvd.nist.gov/vuln/detail/CVE-2024-46734)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.0,6.1.14,6.1.19,6.1.5,6.1.6,6.1.8,6.4.0,6.6.0
 CVSS V2.0分值：
  BaseScore：0.0 None
  Vector：CVSS：2.0/
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:btrfs: fix race between direct IO write and fsync when using same fdIf we have 2 threads that are using the same file descriptor and one ofthem is doing direct IO writes while the other is doing fsync, we have arace where we can end up either:1) Attempt a fsync without holding the inode s lock, triggering an   assertion failures when assertions are enabled;2) Do an invalid memory access from the fsync task because the file private   points to memory allocated on stack by the direct IO task and it may be   used by the fsync task after the stack was destroyed.The race happens like this:1) A user space program opens a file descriptor with O_DIRECT;2) The program spawns 2 threads using libpthread for example;3) One of the threads uses the file descriptor to do direct IO writes,   while the other calls fsync using the same file descriptor.4) Call task A the thread doing direct IO writes and task B the thread   doing fsyncs;5) Task A does a direct IO write, and at btrfs_direct_write() sets the   file s private to an on stack allocated private with the member    fsync_skip_inode_lock  set to true;6) Task B enters btrfs_sync_file() and sees that there s a private   structure associated to the file which has  fsync_skip_inode_lock  set   to true, so it skips locking the inode s VFS lock;7) Task A completes the direct IO write, and resets the file s private to   NULL since it had no prior private and our private was stack allocated.   Then it unlocks the inode s VFS lock;8) Task B enters btrfs_get_ordered_extents_for_logging(), then the   assertion that checks the inode s VFS lock is held fails, since task B   never locked it and task A has already unlocked it.The stack trace produced is the following:   assertion failed: inode_is_locked(&inode->vfs_inode), in fs/btrfs/ordered-data.c:983   ------------[ cut here ]------------   kernel BUG at fs/btrfs/ordered-data.c:983!   Oops: invalid opcode: 0000 [#1] PREEMPT SMP PTI   CPU: 9 PID: 5072 Comm: worker Tainted: G     U     OE      6.10.5-1-default #1 openSUSE Tumbleweed 69f48d427608e1c09e60ea24c6c55e2ca1b049e8   Hardware name: Acer Predator PH315-52/Covini_CFS, BIOS V1.12 07/28/2020   RIP: 0010:btrfs_get_ordered_extents_for_logging.cold+0x1f/0x42 [btrfs]   Code: 50 d6 86 c0 e8 (...)   RSP: 0018:ffff9e4a03dcfc78 EFLAGS: 00010246   RAX: 0000000000000054 RBX: ffff9078a9868e98 RCX: 0000000000000000   RDX: 0000000000000000 RSI: ffff907dce4a7800 RDI: ffff907dce4a7800   RBP: ffff907805518800 R08: 0000000000000000 R09: ffff9e4a03dcfb38   R10: ffff9e4a03dcfb30 R11: 0000000000000003 R12: ffff907684ae7800   R13: 0000000000000001 R14: ffff90774646b600 R15: 0000000000000000   FS:  00007f04b96006c0(0000) GS:ffff907dce480000(0000) knlGS:0000000000000000   CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033   CR2: 00007f32acbfc000 CR3: 00000001fd4fa005 CR4: 00000000003726f0   Call Trace:    <TASK>    ? __die_body.cold+0x14/0x24    ? die+0x2e/0x50    ? do_trap+0xca/0x110    ? do_error_trap+0x6a/0x90    ? btrfs_get_ordered_extents_for_logging.cold+0x1f/0x42 [btrfs bb26272d49b4cdc847cf3f7faadd459b62caee9a]    ? exc_invalid_op+0x50/0x70    ? btrfs_get_ordered_extents_for_logging.cold+0x1f/0x42 [btrfs bb26272d49b4cdc847cf3f7faadd459b62caee9a]    ? asm_exc_invalid_op+0x1a/0x20    ? btrfs_get_ordered_extents_for_logging.cold+0x1f/0x42 [btrfs bb26272d49b4cdc847cf3f7faadd459b62caee9a]    ? btrfs_get_ordered_extents_for_logging.cold+0x1f/0x42 [btrfs bb26272d49b4cdc847cf3f7faadd459b62caee9a]    btrfs_sync_file+0x21a/0x4d0 [btrfs bb26272d49b4cdc847cf3f7faadd459b62caee9a]    ? __seccomp_filter+0x31d/0x4f0    __x64_sys_fdatasync+0x4f/0x90    do_syscall_64+0x82/0x160    ? do_futex+0xcb/0x190    ? __x64_sys_futex+0x10e/0x1d0    ? switch_fpu_return+0x4f/0xd0    ? syscall_exit_to_user_mode+0x72/0x220    ? do_syscall_64+0x8e/0x160    ? syscall_exit_to_user_mod---truncated---
 漏洞公开时间：2024-09-18 16:15:02
 漏洞创建时间：2024-09-19 02:25:09
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2024-46734
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/01681aa609b5f110502f56c4e3b2938efcf4a5bc |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/7b5595f33c3c273613b590892a578d78186bb400 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/cd3087582e4fa36e89be4e6f859e75a4400292b4 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/cd9253c23aedd61eb5ff11f37a36247cd46faf86 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/d116a0b0e02f395cedfb8c725bd67480aa7c428c |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-46734 | https://bugzilla.suse.com/show_bug.cgi?id=1230726 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2024-46734 | https://bugzilla.suse.com/show_bug.cgi?id=1230726 |
| suse_bugzilla | https://git.kernel.org/stable/c/01681aa609b5f110502f56c4e3b2938efcf4a5bc | https://bugzilla.suse.com/show_bug.cgi?id=1230726 |
| suse_bugzilla | https://git.kernel.org/stable/c/7b5595f33c3c273613b590892a578d78186bb400 | https://bugzilla.suse.com/show_bug.cgi?id=1230726 |
| suse_bugzilla | https://git.kernel.org/stable/c/cd3087582e4fa36e89be4e6f859e75a4400292b4 | https://bugzilla.suse.com/show_bug.cgi?id=1230726 |
| suse_bugzilla | https://git.kernel.org/stable/c/cd9253c23aedd61eb5ff11f37a36247cd46faf86 | https://bugzilla.suse.com/show_bug.cgi?id=1230726 |
| suse_bugzilla | https://git.kernel.org/stable/c/d116a0b0e02f395cedfb8c725bd67480aa7c428c | https://bugzilla.suse.com/show_bug.cgi?id=1230726 |
| suse_bugzilla | https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2024/CVE-2024-46734.mbox | https://bugzilla.suse.com/show_bug.cgi?id=1230726 |
| redhat_bugzilla | https://lore.kernel.org/linux-cve-announce/2024091830-CVE-2024-46734-9fe1@gregkh/T | https://bugzilla.redhat.com/show_bug.cgi?id=2313082 |
| debian |  | https://security-tracker.debian.org/tracker/CVE-2024-46734 |
| anolis |  | https://anas.openanolis.cn/cves/detail/CVE-2024-46734 |
| mageia |  | http://advisories.mageia.org/MGASA-2024-0316.html |
| amazon_linux_explore | https://access.redhat.com/security/cve/CVE-2024-46734 | https://explore.alas.aws.amazon.com/CVE-2024-46734.html |
| amazon_linux_explore | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-46734 | https://explore.alas.aws.amazon.com/CVE-2024-46734.html |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

无
</details>

二、漏洞分析结构反馈
 影响性分析说明：
                          In the Linux kernel, the following vulnerability has been resolved:btrfs: fix race between direct IO write and fsync when using same fdIf we have 2 threads that are using the same file descriptor and one ofthem is doing direct IO writes while the other is doing fsync, we have arace where we can end up either:1) Attempt a fsync without holding the inode&#39;s lock, triggering an   assertion failures when assertions are enabled;2) Do an invalid memory access from the fsync task because the file private   points to memory allocated on stack by the direct IO task and it may be   used by the fsync task after the stack was destroyed.The race happens like this:1) A user space program opens a file descriptor with O_DIRECT;2) The program spawns 2 threads using libpthread for example;3) One of the threads uses the file descriptor to do direct IO writes,   while the other calls fsync using the same file descriptor.4) Call task A the thread doing direct IO writes and task B the thread   doing fsyncs;5) Task A does a direct IO write, and at btrfs_direct_write() sets the   file&#39;s private to an on stack allocated private with the member   &#39;fsync_skip_inode_lock&#39; set to true;6) Task B enters btrfs_sync_file() and sees that there&#39;s a private   structure associated to the file which has &#39;fsync_skip_inode_lock&#39; set   to true, so it skips locking the inode&#39;s VFS lock;7) Task A completes the direct IO write, and resets the file&#39;s private to   NULL since it had no prior private and our private was stack allocated.   Then it unlocks the inode&#39;s VFS lock;8) Task B enters btrfs_get_ordered_extents_for_logging(), then the   assertion that checks the inode&#39;s VFS lock is held fails, since task B   never locked it and task A has already unlocked it.The stack trace produced is the following:   assertion failed: inode_is_locked(&#38;inode-&gt;vfs_inode), in fs/btrfs/ordered-data.c:983   ------------[ cut here ]------------   kernel BUG at fs/btrfs/ordered-data.c:983!   Oops: invalid opcode: 0000 [#1] PREEMPT SMP PTI   CPU: 9 PID: 5072 Comm: worker Tainted: G     U     OE      6.10.5-1-default #1 openSUSE Tumbleweed 69f48d427608e1c09e60ea24c6c55e2ca1b049e8   Hardware name: Acer Predator PH315-52/Covini_CFS, BIOS V1.12 07/28/2020   RIP: 0010:btrfs_get_ordered_extents_for_logging.cold+0x1f/0x42 [btrfs]   Code: 50 d6 86 c0 e8 (...)   RSP: 0018:ffff9e4a03dcfc78 EFLAGS: 00010246   RAX: 0000000000000054 RBX: ffff9078a9868e98 RCX: 0000000000000000   RDX: 0000000000000000 RSI: ffff907dce4a7800 RDI: ffff907dce4a7800   RBP: ffff907805518800 R08: 0000000000000000 R09: ffff9e4a03dcfb38   R10: ffff9e4a03dcfb30 R11: 0000000000000003 R12: ffff907684ae7800   R13: 0000000000000001 R14: ffff90774646b600 R15: 0000000000000000   FS:  00007f04b96006c0(0000) GS:ffff907dce480000(0000) knlGS:0000000000000000   CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033   CR2: 00007f32acbfc000 CR3: 00000001fd4fa005 CR4: 00000000003726f0   Call Trace:    &lt;TASK&gt;    ? __die_body.cold+0x14/0x24    ? die+0x2e/0x50    ? do_trap+0xca/0x110    ? do_error_trap+0x6a/0x90    ? btrfs_get_ordered_extents_for_logging.cold+0x1f/0x42 [btrfs bb26272d49b4cdc847cf3f7faadd459b62caee9a]    ? exc_invalid_op+0x50/0x70    ? btrfs_get_ordered_extents_for_logging.cold+0x1f/0x42 [btrfs bb26272d49b4cdc847cf3f7faadd459b62caee9a]    ? asm_exc_invalid_op+0x1a/0x20    ? btrfs_get_ordered_extents_for_logging.cold+0x1f/0x42 [btrfs bb26272d49b4cdc847cf3f7faadd459b62caee9a]    ? btrfs_get_ordered_extents_for_logging.cold+0x1f/0x42 [btrfs bb26272d49b4cdc847cf3f7faadd459b62caee9a]    btrfs_sync_file+0x21a/0x4d0 [btrfs bb26272d49b4cdc847cf3f7faadd459b62caee9a]    ? __seccomp_filter+0x31d/0x4f0    __x64_sys_fdatasync+0x4f/0x90    do_syscall_64+0x82/0x160    ? do_futex+0xcb/0x190    ? __x64_sys_futex+0x10e/0x1d0    ? switch_fpu_return+0x4f/0xd0    ? syscall_exit_to_user_mode+0x72/0x220    ? do_syscall_64+0x8e/0x160    ? syscall_exit_to_user_mode+0x72/0x220    ? do_syscall_64+0x8e/0x160    ? syscall_exit_to_user_mode+0x72/0x220    ? do_syscall_64+0x8e/0x160 
 openEuler评分：
  5.5
 Vector：CVSS：2.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
 受影响版本排查(受影响/不受影响)：
  1.openEuler-24.03-LTS(6.6.0):受影响
2.openEuler-20.03-LTS-SP4(4.19.90):不受影响
3.openEuler-22.03-LTS-SP1(5.10.0):不受影响
4.openEuler-22.03-LTS-SP3(5.10.0):不受影响
5.openEuler-22.03-LTS-SP4(5.10.0):不受影响
6.master(6.6.0):不受影响
7.openEuler-24.03-LTS-Next(6.6.0):不受影响

修复是否涉及abi变化(是/否)：
  1.openEuler-20.03-LTS-SP4(4.19.90):否
2.openEuler-22.03-LTS-SP1(5.10.0):否
3.openEuler-22.03-LTS-SP3(5.10.0):否
4.master(6.6.0):否
5.openEuler-24.03-LTS(6.6.0):否
6.openEuler-24.03-LTS-Next(6.6.0):否
7.openEuler-22.03-LTS-SP4(5.10.0):否

三、漏洞修复
安全公告链接：https://www.openeuler.org/zh/security/safety-bulletin/detail/?id=openEuler-SA-2024-2219

src-openEuler/kernel
关闭

内容风险标识

评论 (12)

src-openEuler/kernel关闭 .gitee-modal { width: 500px !important; }

内容风险标识

CVE-2024-46734

评论 (12)

搜索帮助

src-openEuler/kernel
关闭