CVE-2024-49958

一、漏洞信息
 漏洞编号：[CVE-2024-49958](https://nvd.nist.gov/vuln/detail/CVE-2024-49958)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.0,6.1.14,6.1.19,6.1.5,6.1.6,6.1.8,6.4.0,6.6.0
 CVSS V3.0分值：
  BaseScore：5.5 Medium
  Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:ocfs2: reserve space for inline xattr before attaching reflink treeOne of our customers reported a crash and a corrupted ocfs2 filesystem. The crash was due to the detection of corruption.  Upon troubleshooting,the fsck -fn output showed the below corruption[EXTENT_LIST_FREE] Extent list in owner 33080590 claims 230 as the next free chain record,but fsck believes the largest valid value is 227.  Clamp the next record value? nThe stat output from the debugfs.ocfs2 showed the following corruptionwhere the  Next Free Rec:  had overshot the  Count:  in the root metadatablock.        Inode: 33080590   Mode: 0640   Generation: 2619713622 (0x9c25a856)        FS Generation: 904309833 (0x35e6ac49)        CRC32: 00000000   ECC: 0000        Type: Regular   Attr: 0x0   Flags: Valid        Dynamic Features: (0x16) HasXattr InlineXattr Refcounted        Extended Attributes Block: 0  Extended Attributes Inline Size: 256        User: 0 (root)   Group: 0 (root)   Size: 281320357888        Links: 1   Clusters: 141738        ctime: 0x66911b56 0x316edcb8 -- Fri Jul 12 06:02:30.829349048 2024        atime: 0x66911d6b 0x7f7a28d -- Fri Jul 12 06:11:23.133669517 2024        mtime: 0x66911b56 0x12ed75d7 -- Fri Jul 12 06:02:30.317552087 2024        dtime: 0x0 -- Wed Dec 31 17:00:00 1969        Refcount Block: 2777346        Last Extblk: 2886943   Orphan Slot: 0        Sub Alloc Slot: 0   Sub Alloc Bit: 14        Tree Depth: 1   Count: 227   Next Free Rec: 230        ## Offset        Clusters       Block#        0  0             2310           2776351        1  2310          2139           2777375        2  4449          1221           2778399        3  5670          731            2779423        4  6401          566            2780447        .......          ....           .......        .......          ....           .......The issue was in the reflink workfow while reserving space for inlinexattr.  The problematic function is ocfs2_reflink_xattr_inline().  By thetime this function is called the reflink tree is already recreated at thedestination inode from the source inode.  At this point, this functionreserves space for inline xattrs at the destination inode without evenchecking if there is space at the root metadata block.  It simply reducesthe l_count from 243 to 227 thereby making space of 256 bytes for inlinexattr whereas the inode already has extents beyond this index (in thiscase up to 230), thereby causing corruption.The fix for this is to reserve space for inline metadata at the destinationinode before the reflink tree gets recreated. The customer has verified thefix.
 漏洞公开时间：2024-10-22 02:15:17
 漏洞创建时间：2024-10-22 03:02:34
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2024-49958
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/020f5c53c17f66c0a8f2d37dad27ace301b8d8a1 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/5c2072f02c0d75802ec28ec703b7d43a0dd008b5 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/5c9807c523b4fca81d3e8e864dabc8c806402121 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/5ca60b86f57a4d9648f68418a725b3a7de2816b0 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/637c00e06564a945e9d0edb3d78d362d64935f9f |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/74364cb578dcc0b6c9109519d19cbe5a56afac9a |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/96ce4c3537114d1698be635f5e36c62dc49df7a4 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/9f9a8f3ac65b4147f1a7b6c05fad5192c0e3c3d9 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/aac31d654a0a31cb0d2fa36ae694f4e164a52707 |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-49958 | https://bugzilla.suse.com/show_bug.cgi?id=1232151 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2024-49958 | https://bugzilla.suse.com/show_bug.cgi?id=1232151 |
| suse_bugzilla | https://git.kernel.org/stable/c/020f5c53c17f66c0a8f2d37dad27ace301b8d8a1 | https://bugzilla.suse.com/show_bug.cgi?id=1232151 |
| suse_bugzilla | https://git.kernel.org/stable/c/5c2072f02c0d75802ec28ec703b7d43a0dd008b5 | https://bugzilla.suse.com/show_bug.cgi?id=1232151 |
| suse_bugzilla | https://git.kernel.org/stable/c/5ca60b86f57a4d9648f68418a725b3a7de2816b0 | https://bugzilla.suse.com/show_bug.cgi?id=1232151 |
| suse_bugzilla | https://git.kernel.org/stable/c/637c00e06564a945e9d0edb3d78d362d64935f9f | https://bugzilla.suse.com/show_bug.cgi?id=1232151 |
| suse_bugzilla | https://git.kernel.org/stable/c/96ce4c3537114d1698be635f5e36c62dc49df7a4 | https://bugzilla.suse.com/show_bug.cgi?id=1232151 |
| suse_bugzilla | https://git.kernel.org/stable/c/9f9a8f3ac65b4147f1a7b6c05fad5192c0e3c3d9 | https://bugzilla.suse.com/show_bug.cgi?id=1232151 |
| suse_bugzilla | https://git.kernel.org/stable/c/aac31d654a0a31cb0d2fa36ae694f4e164a52707 | https://bugzilla.suse.com/show_bug.cgi?id=1232151 |
| suse_bugzilla | https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2024/CVE-2024-49958.mbox | https://bugzilla.suse.com/show_bug.cgi?id=1232151 |
| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2320444 | https://bugzilla.suse.com/show_bug.cgi?id=1232151 |
| redhat_bugzilla | https://lore.kernel.org/linux-cve-announce/2024102131-CVE-2024-49958-1bc6@gregkh/T | https://bugzilla.redhat.com/show_bug.cgi?id=2320444 |
| debian |  | https://security-tracker.debian.org/tracker/CVE-2024-49958 |
| anolis |  | https://anas.openanolis.cn/cves/detail/CVE-2024-49958 |
| mageia |  | http://advisories.mageia.org/MGASA-2024-0345.html |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
|  |  | https://git.kernel.org/stable/c/020f5c53c17f66c0a8f2d37dad27ace301b8d8a1 |  | nvd |
|  |  | https://git.kernel.org/stable/c/5c2072f02c0d75802ec28ec703b7d43a0dd008b5 |  | nvd |
|  |  | https://git.kernel.org/stable/c/5ca60b86f57a4d9648f68418a725b3a7de2816b0 |  | nvd |
|  |  | https://git.kernel.org/stable/c/637c00e06564a945e9d0edb3d78d362d64935f9f |  | nvd |
|  |  | https://git.kernel.org/stable/c/96ce4c3537114d1698be635f5e36c62dc49df7a4 |  | nvd |
|  |  | https://git.kernel.org/stable/c/9f9a8f3ac65b4147f1a7b6c05fad5192c0e3c3d9 |  | nvd |
|  |  | https://git.kernel.org/stable/c/aac31d654a0a31cb0d2fa36ae694f4e164a52707 |  | nvd |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
  In the Linux kernel, the following vulnerability has been resolved:ocfs2: reserve space for inline xattr before attaching reflink treeOne of our customers reported a crash and a corrupted ocfs2 filesystem. The crash was due to the detection of corruption.  Upon troubleshooting,the fsck -fn output showed the below corruption[EXTENT_LIST_FREE] Extent list in owner 33080590 claims 230 as the next free chain record,but fsck believes the largest valid value is 227.  Clamp the next record value? nThe stat output from the debugfs.ocfs2 showed the following corruptionwhere the  Next Free Rec:  had overshot the  Count:  in the root metadatablock.        Inode: 33080590   Mode: 0640   Generation: 2619713622 (0x9c25a856)        FS Generation: 904309833 (0x35e6ac49)        CRC32: 00000000   ECC: 0000        Type: Regular   Attr: 0x0   Flags: Valid        Dynamic Features: (0x16) HasXattr InlineXattr Refcounted        Extended Attributes Block: 0  Extended Attributes Inline Size: 256        User: 0 (root)   Group: 0 (root)   Size: 281320357888        Links: 1   Clusters: 141738        ctime: 0x66911b56 0x316edcb8 -- Fri Jul 12 06:02:30.829349048 2024        atime: 0x66911d6b 0x7f7a28d -- Fri Jul 12 06:11:23.133669517 2024        mtime: 0x66911b56 0x12ed75d7 -- Fri Jul 12 06:02:30.317552087 2024        dtime: 0x0 -- Wed Dec 31 17:00:00 1969        Refcount Block: 2777346        Last Extblk: 2886943   Orphan Slot: 0        Sub Alloc Slot: 0   Sub Alloc Bit: 14        Tree Depth: 1   Count: 227   Next Free Rec: 230        ## Offset        Clusters       Block#        0  0             2310           2776351        1  2310          2139           2777375        2  4449          1221           2778399        3  5670          731            2779423        4  6401          566            2780447        .......          ....           .......        .......          ....           .......The issue was in the reflink workfow while reserving space for inlinexattr.  The problematic function is ocfs2_reflink_xattr_inline().  By thetime this function is called the reflink tree is already recreated at thedestination inode from the source inode.  At this point, this functionreserves space for inline xattrs at the destination inode without evenchecking if there is space at the root metadata block.  It simply reducesthe l_count from 243 to 227 thereby making space of 256 bytes for inlinexattr whereas the inode already has extents beyond this index (in thiscase up to 230), thereby causing corruption.The fix for this is to reserve space for inline metadata at the destinationinode before the reflink tree gets recreated. The customer has verified thefix.
 openEuler评分：
  3.9
 Vector：CVSS：3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L
 受影响版本排查(受影响/不受影响)：
  1.openEuler-20.03-LTS-SP4:受影响
2.openEuler-22.03-LTS-SP1:受影响
3.openEuler-22.03-LTS-SP3:受影响
4.openEuler-22.03-LTS-SP4:受影响
5.openEuler-24.03-LTS:受影响
6.master:不受影响
7.openEuler-24.03-LTS-Next:不受影响

修复是否涉及abi变化(是/否)：
  1.openEuler-20.03-LTS-SP4:否
2.openEuler-22.03-LTS-SP1:否
3.openEuler-22.03-LTS-SP3:否
4.master:否
5.openEuler-24.03-LTS:否
6.openEuler-24.03-LTS-Next:否
7.openEuler-22.03-LTS-SP4:否

原因说明：
  1.master:
2.openEuler-20.03-LTS-SP4:
3.openEuler-22.03-LTS-SP3:
4.openEuler-22.03-LTS-SP4:
5.openEuler-24.03-LTS:
6.openEuler-24.03-LTS-Next:
7.openEuler-24.03-LTS-SP1:
8.openEuler-24.03-LTS-SP2:

三、漏洞修复
安全公告链接：https://www.openeuler.org/zh/security/safety-bulletin/detail/?id=openEuler-SA-2024-2367

src-openEuler/kernel

Content Risk Flag

Comments (8)

src-openEuler/kernel .gitee-modal { width: 500px !important; }

Content Risk Flag

CVE-2024-49958

Comments (8)

Search

src-openEuler/kernel