CVE-2024-53218

一、漏洞信息
 漏洞编号：[CVE-2024-53218](https://nvd.nist.gov/vuln/detail/CVE-2024-53218)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.19,6.1.8,6.4.0,6.6.0
 CVSS V3.0分值：
  BaseScore：7.8 High
  Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:f2fs: fix race in concurrent f2fs_stop_gc_threadIn my test case, concurrent calls to f2fs shutdown report the followingstack trace: Oops: general protection fault, probably for non-canonical address 0xc6cfff63bb5513fc: 0000 [#1] PREEMPT SMP PTI CPU: 0 UID: 0 PID: 678 Comm: f2fs_rep_shutdo Not tainted 6.12.0-rc5-next-20241029-g6fb2fa9805c5-dirty #85 Call Trace:  <TASK>  ? show_regs+0x8b/0xa0  ? __die_body+0x26/0xa0  ? die_addr+0x54/0x90  ? exc_general_protection+0x24b/0x5c0  ? asm_exc_general_protection+0x26/0x30  ? kthread_stop+0x46/0x390  f2fs_stop_gc_thread+0x6c/0x110  f2fs_do_shutdown+0x309/0x3a0  f2fs_ioc_shutdown+0x150/0x1c0  __f2fs_ioctl+0xffd/0x2ac0  f2fs_ioctl+0x76/0xe0  vfs_ioctl+0x23/0x60  __x64_sys_ioctl+0xce/0xf0  x64_sys_call+0x2b1b/0x4540  do_syscall_64+0xa7/0x240  entry_SYSCALL_64_after_hwframe+0x76/0x7eThe root cause is a race condition in f2fs_stop_gc_thread() called fromdifferent f2fs shutdown paths:  [CPU0]                       [CPU1]  ----------------------       -----------------------  f2fs_stop_gc_thread          f2fs_stop_gc_thread                                 gc_th = sbi->gc_thread    gc_th = sbi->gc_thread    kfree(gc_th)    sbi->gc_thread = NULL                                 < gc_th != NULL >                                 kthread_stop(gc_th->f2fs_gc_task) //UAFThe commit c7f114d864ac ( f2fs: fix to avoid use-after-free inf2fs_stop_gc_thread() ) attempted to fix this issue by using a readsemaphore to prevent races between shutdown and remount threads, butit fails to prevent all race conditions.Fix it by converting to write lock of s_umount in f2fs_do_shutdown().
 漏洞公开时间：2024-12-27 22:15:29
 漏洞创建时间：2024-12-27 22:46:16
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2024-53218
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/60457ed6c67625c87861f96912b4179dc2293896 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/794fa8792d4eacac191f1cbcc2e81b7369e4662a |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/7b0033dbc48340a1c1c3f12448ba17d6587ca092 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/c631207897a9b3d41167ceca58e07f8f94720e42 |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-53218 | https://bugzilla.suse.com/show_bug.cgi?id=1234966 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2024-53218 | https://bugzilla.suse.com/show_bug.cgi?id=1234966 |
| suse_bugzilla | https://git.kernel.org/stable/c/60457ed6c67625c87861f96912b4179dc2293896 | https://bugzilla.suse.com/show_bug.cgi?id=1234966 |
| suse_bugzilla | https://git.kernel.org/stable/c/794fa8792d4eacac191f1cbcc2e81b7369e4662a | https://bugzilla.suse.com/show_bug.cgi?id=1234966 |
| suse_bugzilla | https://git.kernel.org/stable/c/7b0033dbc48340a1c1c3f12448ba17d6587ca092 | https://bugzilla.suse.com/show_bug.cgi?id=1234966 |
| suse_bugzilla | https://git.kernel.org/stable/c/c631207897a9b3d41167ceca58e07f8f94720e42 | https://bugzilla.suse.com/show_bug.cgi?id=1234966 |
| suse_bugzilla | https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2024/CVE-2024-53218.mbox | https://bugzilla.suse.com/show_bug.cgi?id=1234966 |
| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2334372 | https://bugzilla.suse.com/show_bug.cgi?id=1234966 |
| redhat_bugzilla | https://lore.kernel.org/linux-cve-announce/2024122732-CVE-2024-53218-4330@gregkh/T | https://bugzilla.redhat.com/show_bug.cgi?id=2334372 |
| debian |  | https://security-tracker.debian.org/tracker/CVE-2024-53218 |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
|  |  | https://git.kernel.org/stable/c/60457ed6c67625c87861f96912b4179dc2293896 |  | nvd |
|  |  | https://git.kernel.org/stable/c/794fa8792d4eacac191f1cbcc2e81b7369e4662a |  | nvd |
|  |  | https://git.kernel.org/stable/c/7b0033dbc48340a1c1c3f12448ba17d6587ca092 |  | nvd |
|  |  | https://git.kernel.org/stable/c/c631207897a9b3d41167ceca58e07f8f94720e42 |  | nvd |
| linux_kernel | 6.6.64 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=794fa8792d4eacac191f1cbcc2e81b7369e4662aIssue | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=7950e9ac638e84518fbdd5c930939ad46a1068c5 | linuxkernelcves |
| linux_kernel | 6.11.11 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=60457ed6c67625c87861f96912b4179dc2293896Issue | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=7950e9ac638e84518fbdd5c930939ad46a1068c5 | linuxkernelcves |
| linux_kernel | 6.12.2 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=c631207897a9b3d41167ceca58e07f8f94720e42Issue | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=7950e9ac638e84518fbdd5c930939ad46a1068c5 | linuxkernelcves |
| linux_kernel | 6.13-rc1 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=7b0033dbc48340a1c1c3f12448ba17d6587ca092Please | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=7950e9ac638e84518fbdd5c930939ad46a1068c5 | linuxkernelcves |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
  In the Linux kernel, the following vulnerability has been resolved:f2fs: fix race in concurrent f2fs_stop_gc_threadIn my test case, concurrent calls to f2fs shutdown report the followingstack trace: Oops: general protection fault, probably for non-canonical address 0xc6cfff63bb5513fc: 0000 [#1] PREEMPT SMP PTI CPU: 0 UID: 0 PID: 678 Comm: f2fs_rep_shutdo Not tainted 6.12.0-rc5-next-20241029-g6fb2fa9805c5-dirty #85 Call Trace:  &lt;TASK&gt;  ? show_regs+0x8b/0xa0  ? __die_body+0x26/0xa0  ? die_addr+0x54/0x90  ? exc_general_protection+0x24b/0x5c0  ? asm_exc_general_protection+0x26/0x30  ? kthread_stop+0x46/0x390  f2fs_stop_gc_thread+0x6c/0x110  f2fs_do_shutdown+0x309/0x3a0  f2fs_ioc_shutdown+0x150/0x1c0  __f2fs_ioctl+0xffd/0x2ac0  f2fs_ioctl+0x76/0xe0  vfs_ioctl+0x23/0x60  __x64_sys_ioctl+0xce/0xf0  x64_sys_call+0x2b1b/0x4540  do_syscall_64+0xa7/0x240  entry_SYSCALL_64_after_hwframe+0x76/0x7eThe root cause is a race condition in f2fs_stop_gc_thread() called fromdifferent f2fs shutdown paths:  [CPU0]                       [CPU1]  ----------------------       -----------------------  f2fs_stop_gc_thread          f2fs_stop_gc_thread                                 gc_th = sbi-&gt;gc_thread    gc_th = sbi-&gt;gc_thread    kfree(gc_th)    sbi-&gt;gc_thread = NULL                                 &lt; gc_th != NULL &gt;                                 kthread_stop(gc_th-&gt;f2fs_gc_task) //UAFThe commit c7f114d864ac (&#34;f2fs: fix to avoid use-after-free inf2fs_stop_gc_thread()&#34;) attempted to fix this issue by using a readsemaphore to prevent races between shutdown and remount threads, butit fails to prevent all race conditions.Fix it by converting to write lock of s_umount in f2fs_do_shutdown().The Linux kernel CVE team has assigned CVE-2024-53218 to this issue.
 openEuler评分：
  4.7
 Vector：CVSS：3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
 受影响版本排查(受影响/不受影响)：
  1.openEuler-20.03-LTS-SP4(4.19.90):受影响
2.openEuler-22.03-LTS-SP1(5.10.0):受影响
3.openEuler-22.03-LTS-SP3(5.10.0):受影响
4.openEuler-22.03-LTS-SP4:受影响
5.openEuler-24.03-LTS(6.6.0):受影响
6.openEuler-24.03-LTS-SP1(6.6.0):受影响
7.master(6.6.0):不受影响
8.openEuler-24.03-LTS-Next(6.6.0):不受影响

修复是否涉及abi变化(是/否)：
  1.openEuler-20.03-LTS-SP4(4.19.90):否
2.openEuler-22.03-LTS-SP1(5.10.0):否
3.openEuler-22.03-LTS-SP3(5.10.0):否
4.master(6.6.0):否
5.openEuler-24.03-LTS(6.6.0):否
6.openEuler-24.03-LTS-Next(6.6.0):否
7.openEuler-22.03-LTS-SP4:否
8.openEuler-24.03-LTS-SP1(6.6.0):否

原因说明：
  1.openEuler-22.03-LTS-SP1(5.10.0):正常修复
2.openEuler-22.03-LTS-SP3(5.10.0):正常修复
3.openEuler-22.03-LTS-SP4:正常修复
4.openEuler-24.03-LTS(6.6.0):正常修复
5.openEuler-24.03-LTS-SP1(6.6.0):正常修复
6.openEuler-20.03-LTS-SP4(4.19.90):暂不修复-暂无解决方案或补丁
7.master(6.6.0):不受影响-漏洞代码不能被攻击者触发
8.openEuler-24.03-LTS-Next(6.6.0):不受影响-漏洞代码不能被攻击者触发

三、漏洞修复
安全公告链接：https://www.openeuler.org/zh/security/safety-bulletin/detail/?id=openEuler-SA-2025-1079

src-openEuler / kernel
Closed

Content Risk Flag

Comments (11)

src-openEuler / kernelClosed .gitee-modal { width: 500px !important; }

Content Risk Flag

CVE-2024-53218

Comments (11)

Search

src-openEuler / kernel
Closed