CVE-2024-53171

一、漏洞信息
 漏洞编号：[CVE-2024-53171](https://nvd.nist.gov/vuln/detail/CVE-2024-53171)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.19,6.4.0,6.6.0
 CVSS V3.0分值：
  BaseScore：7.8 High
  Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:ubifs: authentication: Fix use-after-free in ubifs_tnc_end_commitAfter an insertion in TNC, the tree might split and cause a node tochange its `znode->parent`. A further deletion of other nodes in thetree (which also could free the nodes), the aforementioned node s`znode->cparent` could still point to a freed node. This`znode->cparent` may not be updated when getting nodes to commit in`ubifs_tnc_start_commit()`. This could then trigger a use-after-freewhen accessing the `znode->cparent` in `write_index()` in`ubifs_tnc_end_commit()`.This can be triggered by running  rm -f /etc/test-file.bin  dd if=/dev/urandom of=/etc/test-file.bin bs=1M count=60 conv=fsyncin a loop, and with `CONFIG_UBIFS_FS_AUTHENTICATION`. KASAN thenreports:  BUG: KASAN: use-after-free in ubifs_tnc_end_commit+0xa5c/0x1950  Write of size 32 at addr ffffff800a3af86c by task ubifs_bgt0_20/153  Call trace:   dump_backtrace+0x0/0x340   show_stack+0x18/0x24   dump_stack_lvl+0x9c/0xbc   print_address_description.constprop.0+0x74/0x2b0   kasan_report+0x1d8/0x1f0   kasan_check_range+0xf8/0x1a0   memcpy+0x84/0xf4   ubifs_tnc_end_commit+0xa5c/0x1950   do_commit+0x4e0/0x1340   ubifs_bg_thread+0x234/0x2e0   kthread+0x36c/0x410   ret_from_fork+0x10/0x20  Allocated by task 401:   kasan_save_stack+0x38/0x70   __kasan_kmalloc+0x8c/0xd0   __kmalloc+0x34c/0x5bc   tnc_insert+0x140/0x16a4   ubifs_tnc_add+0x370/0x52c   ubifs_jnl_write_data+0x5d8/0x870   do_writepage+0x36c/0x510   ubifs_writepage+0x190/0x4dc   __writepage+0x58/0x154   write_cache_pages+0x394/0x830   do_writepages+0x1f0/0x5b0   filemap_fdatawrite_wbc+0x170/0x25c   file_write_and_wait_range+0x140/0x190   ubifs_fsync+0xe8/0x290   vfs_fsync_range+0xc0/0x1e4   do_fsync+0x40/0x90   __arm64_sys_fsync+0x34/0x50   invoke_syscall.constprop.0+0xa8/0x260   do_el0_svc+0xc8/0x1f0   el0_svc+0x34/0x70   el0t_64_sync_handler+0x108/0x114   el0t_64_sync+0x1a4/0x1a8  Freed by task 403:   kasan_save_stack+0x38/0x70   kasan_set_track+0x28/0x40   kasan_set_free_info+0x28/0x4c   __kasan_slab_free+0xd4/0x13c   kfree+0xc4/0x3a0   tnc_delete+0x3f4/0xe40   ubifs_tnc_remove_range+0x368/0x73c   ubifs_tnc_remove_ino+0x29c/0x2e0   ubifs_jnl_delete_inode+0x150/0x260   ubifs_evict_inode+0x1d4/0x2e4   evict+0x1c8/0x450   iput+0x2a0/0x3c4   do_unlinkat+0x2cc/0x490   __arm64_sys_unlinkat+0x90/0x100   invoke_syscall.constprop.0+0xa8/0x260   do_el0_svc+0xc8/0x1f0   el0_svc+0x34/0x70   el0t_64_sync_handler+0x108/0x114   el0t_64_sync+0x1a4/0x1a8The offending `memcpy()` in `ubifs_copy_hash()` has a use-after-freewhen a node becomes root in TNC but still has a `cparent` to an alreadyfreed node. More specifically, consider the following TNC:         zroot         /        /      zp1      /     /    znInserting a new node `zn_new` with a key smaller then `zn` will triggera split in `tnc_insert()` if `zp1` is full:         zroot         /            /            zp1     zp2      /               /              zn_new          zn`zn->parent` has now been moved to `zp2`, *but* `zn->cparent` stillpoints to `zp1`.Now, consider a removal of all the nodes _except_ `zn`. Just when`tnc_delete()` is about to delete `zroot` and `zp2`:         zroot                                           zp2                                                    zn`zroot` and `zp2` get freed and the tree collapses:           zn`zn` now becomes the new `zroot`.`get_znodes_to_commit()` will now only find `zn`, the new `zroot`, and`write_index()` will check its `znode->cparent` that wrongly points tothe already freed `zp1`. `ubifs_copy_hash()` thus gets wrongly calledwith `znode->cparent->zbranch[znode->iip].hash` that triggers theuse-after-free!Fix this by explicitly setting `znode->cparent` to `NULL` in`get_znodes_to_commit()` for the root node. The search for the dirtynodes---truncated---
 漏洞公开时间：2024-12-27 22:15:24
 漏洞创建时间：2024-12-27 22:49:19
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2024-53171
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/01d3a2293d7e4edfff96618c15727db7e51f11b6 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/2497479aecebe869d23a0064e0fd1a03e34f0e2a |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/398a91599d263e41c5f95a2fd4ebdb6280b5c6c3 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/4617fb8fc15effe8eda4dd898d4e33eb537a7140 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/4d9807048b851d7a58d5bd089c16254af896e4df |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/74981f7577d183acad1cd58f74c10d263711a215 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/8d8b3f5f4cbfbf6cb0ea4a4d5dc296872b4151eb |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/daac4aa1825de0dbc1a6eede2fa7f9fc53f14223 |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-53171 | https://bugzilla.suse.com/show_bug.cgi?id=1234889 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2024-53171 | https://bugzilla.suse.com/show_bug.cgi?id=1234889 |
| suse_bugzilla | https://git.kernel.org/stable/c/01d3a2293d7e4edfff96618c15727db7e51f11b6 | https://bugzilla.suse.com/show_bug.cgi?id=1234889 |
| suse_bugzilla | https://git.kernel.org/stable/c/2497479aecebe869d23a0064e0fd1a03e34f0e2a | https://bugzilla.suse.com/show_bug.cgi?id=1234889 |
| suse_bugzilla | https://git.kernel.org/stable/c/398a91599d263e41c5f95a2fd4ebdb6280b5c6c3 | https://bugzilla.suse.com/show_bug.cgi?id=1234889 |
| suse_bugzilla | https://git.kernel.org/stable/c/4617fb8fc15effe8eda4dd898d4e33eb537a7140 | https://bugzilla.suse.com/show_bug.cgi?id=1234889 |
| suse_bugzilla | https://git.kernel.org/stable/c/4d9807048b851d7a58d5bd089c16254af896e4df | https://bugzilla.suse.com/show_bug.cgi?id=1234889 |
| suse_bugzilla | https://git.kernel.org/stable/c/74981f7577d183acad1cd58f74c10d263711a215 | https://bugzilla.suse.com/show_bug.cgi?id=1234889 |
| suse_bugzilla | https://git.kernel.org/stable/c/8d8b3f5f4cbfbf6cb0ea4a4d5dc296872b4151eb | https://bugzilla.suse.com/show_bug.cgi?id=1234889 |
| suse_bugzilla | https://git.kernel.org/stable/c/daac4aa1825de0dbc1a6eede2fa7f9fc53f14223 | https://bugzilla.suse.com/show_bug.cgi?id=1234889 |
| suse_bugzilla | https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2024/CVE-2024-53171.mbox | https://bugzilla.suse.com/show_bug.cgi?id=1234889 |
| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2334371 | https://bugzilla.suse.com/show_bug.cgi?id=1234889 |
| redhat_bugzilla | https://lore.kernel.org/linux-cve-announce/2024122716-CVE-2024-53171-7a80@gregkh/T | https://bugzilla.redhat.com/show_bug.cgi?id=2334371 |
| debian |  | https://security-tracker.debian.org/tracker/CVE-2024-53171 |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

无
</details>

二、漏洞分析结构反馈
 影响性分析说明：
  In the Linux kernel, the following vulnerability has been resolved:ubifs: authentication: Fix use-after-free in ubifs_tnc_end_commitAfter an insertion in TNC, the tree might split and cause a node tochange its `znode->parent`. A further deletion of other nodes in thetree (which also could free the nodes), the aforementioned node s`znode->cparent` could still point to a freed node. This`znode->cparent` may not be updated when getting nodes to commit in`ubifs_tnc_start_commit()`. This could then trigger a use-after-freewhen accessing the `znode->cparent` in `write_index()` in`ubifs_tnc_end_commit()`.This can be triggered by running  rm -f /etc/test-file.bin  dd if=/dev/urandom of=/etc/test-file.bin bs=1M count=60 conv=fsyncin a loop, and with `CONFIG_UBIFS_FS_AUTHENTICATION`. KASAN thenreports:  BUG: KASAN: use-after-free in ubifs_tnc_end_commit+0xa5c/0x1950  Write of size 32 at addr ffffff800a3af86c by task ubifs_bgt0_20/153  Call trace:   dump_backtrace+0x0/0x340   show_stack+0x18/0x24   dump_stack_lvl+0x9c/0xbc   print_address_description.constprop.0+0x74/0x2b0   kasan_report+0x1d8/0x1f0   kasan_check_range+0xf8/0x1a0   memcpy+0x84/0xf4   ubifs_tnc_end_commit+0xa5c/0x1950   do_commit+0x4e0/0x1340   ubifs_bg_thread+0x234/0x2e0   kthread+0x36c/0x410   ret_from_fork+0x10/0x20  Allocated by task 401:   kasan_save_stack+0x38/0x70   __kasan_kmalloc+0x8c/0xd0   __kmalloc+0x34c/0x5bc   tnc_insert+0x140/0x16a4   ubifs_tnc_add+0x370/0x52c   ubifs_jnl_write_data+0x5d8/0x870   do_writepage+0x36c/0x510   ubifs_writepage+0x190/0x4dc   __writepage+0x58/0x154   write_cache_pages+0x394/0x830   do_writepages+0x1f0/0x5b0   filemap_fdatawrite_wbc+0x170/0x25c   file_write_and_wait_range+0x140/0x190   ubifs_fsync+0xe8/0x290   vfs_fsync_range+0xc0/0x1e4   do_fsync+0x40/0x90   __arm64_sys_fsync+0x34/0x50   invoke_syscall.constprop.0+0xa8/0x260   do_el0_svc+0xc8/0x1f0   el0_svc+0x34/0x70   el0t_64_sync_handler+0x108/0x114   el0t_64_sync+0x1a4/0x1a8  Freed by task 403:   kasan_save_stack+0x38/0x70   kasan_set_track+0x28/0x40   kasan_set_free_info+0x28/0x4c   __kasan_slab_free+0xd4/0x13c   kfree+0xc4/0x3a0   tnc_delete+0x3f4/0xe40   ubifs_tnc_remove_range+0x368/0x73c   ubifs_tnc_remove_ino+0x29c/0x2e0   ubifs_jnl_delete_inode+0x150/0x260   ubifs_evict_inode+0x1d4/0x2e4   evict+0x1c8/0x450   iput+0x2a0/0x3c4   do_unlinkat+0x2cc/0x490   __arm64_sys_unlinkat+0x90/0x100   invoke_syscall.constprop.0+0xa8/0x260   do_el0_svc+0xc8/0x1f0   el0_svc+0x34/0x70   el0t_64_sync_handler+0x108/0x114   el0t_64_sync+0x1a4/0x1a8The offending `memcpy()` in `ubifs_copy_hash()` has a use-after-freewhen a node becomes root in TNC but still has a `cparent` to an alreadyfreed node. More specifically, consider the following TNC:         zroot         /        /      zp1      /     /    znInserting a new node `zn_new` with a key smaller then `zn` will triggera split in `tnc_insert()` if `zp1` is full:         zroot         /            /            zp1     zp2      /               /              zn_new          zn`zn->parent` has now been moved to `zp2`, *but* `zn->cparent` stillpoints to `zp1`.Now, consider a removal of all the nodes _except_ `zn`. Just when`tnc_delete()` is about to delete `zroot` and `zp2`:         zroot                                           zp2                                                    zn`zroot` and `zp2` get freed and the tree collapses:           zn`zn` now becomes the new `zroot`.`get_znodes_to_commit()` will now only find `zn`, the new `zroot`, and`write_index()` will check its `znode->cparent` that wrongly points tothe already freed `zp1`. `ubifs_copy_hash()` thus gets wrongly calledwith `znode->cparent->zbranch[znode->iip].hash` that triggers theuse-after-free!Fix this by explicitly setting `znode->cparent` to `NULL` in`get_znodes_to_commit()` for the root node. The search for the dirtynodes---truncated---
 openEuler评分：
  7.8
 Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
 受影响版本排查(受影响/不受影响)：
  1.openEuler-22.03-LTS-SP3(5.10.0):受影响
2.openEuler-22.03-LTS-SP4(5.10.0):受影响
3.openEuler-24.03-LTS(6.6.0):受影响
4.openEuler-24.03-LTS-SP1(6.6.0):受影响
5.openEuler-20.03-LTS-SP4(4.19.90):不受影响
6.master:不受影响
7.openEuler-24.03-LTS-Next(6.6.0):不受影响

修复是否涉及abi变化(是/否)：
  1.openEuler-20.03-LTS-SP4(4.19.90):否
2.openEuler-22.03-LTS-SP1(5.10.0):否
3.openEuler-22.03-LTS-SP3(5.10.0):否
4.master:否
5.openEuler-24.03-LTS(6.6.0):否
6.openEuler-24.03-LTS-Next(6.6.0):否
7.openEuler-22.03-LTS-SP4(5.10.0):否
8.openEuler-24.03-LTS-SP1(6.6.0):否

原因说明：
  1.openEuler-22.03-LTS-SP3(5.10.0):正常修复
2.openEuler-22.03-LTS-SP4(5.10.0):正常修复
3.openEuler-24.03-LTS(6.6.0):正常修复
4.openEuler-24.03-LTS-SP1(6.6.0):正常修复
5.master:不受影响-漏洞代码不能被攻击者触发
6.openEuler-24.03-LTS-Next(6.6.0):不受影响-漏洞代码不能被攻击者触发
7.openEuler-20.03-LTS-SP4(4.19.90):不受影响-漏洞代码不存在

三、漏洞修复
安全公告链接：https://www.openeuler.org/zh/security/safety-bulletin/detail/?id=openEuler-SA-2025-1079

src-openEuler/kernel

内容风险标识

评论 (13)

src-openEuler/kernel .gitee-modal { width: 500px !important; }

内容风险标识

CVE-2024-53171

评论 (13)

搜索帮助

src-openEuler/kernel