CVE-2024-56581

一、漏洞信息
 漏洞编号：[CVE-2024-56581](https://nvd.nist.gov/vuln/detail/CVE-2024-56581)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.19,6.4.0,6.6.0
 CVSS V3.0分值：
  BaseScore：5.5 Medium
  Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:btrfs: ref-verify: fix use-after-free after invalid ref actionAt btrfs_ref_tree_mod() after we successfully inserted the new ref entry(local variable  ref ) into the respective block entry s rbtree (localvariable  be ), if we find an unexpected action of BTRFS_DROP_DELAYED_REF,we error out and free the ref entry without removing it from the blockentry s rbtree. Then in the error path of btrfs_ref_tree_mod() we callbtrfs_free_ref_cache(), which iterates over all block entries and thencalls free_block_entry() for each one, and there we will trigger ause-after-free when we are called against the block entry to which weadded the freed ref entry to its rbtree, since the rbtree still pointsto the block entry, as we didn t remove it from the rbtree before freeingit in the error path at btrfs_ref_tree_mod(). Fix this by removing thenew ref entry from the rbtree before freeing it.Syzbot report this with the following stack traces:   BTRFS error (device loop0 state EA):   Ref action 2, root 5, ref_root 0, parent 8564736, owner 0, offset 0, num_refs 18446744073709551615      __btrfs_mod_ref+0x7dd/0xac0 fs/btrfs/extent-tree.c:2523      update_ref_for_cow+0x9cd/0x11f0 fs/btrfs/ctree.c:512      btrfs_force_cow_block+0x9f6/0x1da0 fs/btrfs/ctree.c:594      btrfs_cow_block+0x35e/0xa40 fs/btrfs/ctree.c:754      btrfs_search_slot+0xbdd/0x30d0 fs/btrfs/ctree.c:2116      btrfs_insert_empty_items+0x9c/0x1a0 fs/btrfs/ctree.c:4314      btrfs_insert_empty_item fs/btrfs/ctree.h:669 [inline]      btrfs_insert_orphan_item+0x1f1/0x320 fs/btrfs/orphan.c:23      btrfs_orphan_add+0x6d/0x1a0 fs/btrfs/inode.c:3482      btrfs_unlink+0x267/0x350 fs/btrfs/inode.c:4293      vfs_unlink+0x365/0x650 fs/namei.c:4469      do_unlinkat+0x4ae/0x830 fs/namei.c:4533      __do_sys_unlinkat fs/namei.c:4576 [inline]      __se_sys_unlinkat fs/namei.c:4569 [inline]      __x64_sys_unlinkat+0xcc/0xf0 fs/namei.c:4569      do_syscall_x64 arch/x86/entry/common.c:52 [inline]      do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83      entry_SYSCALL_64_after_hwframe+0x77/0x7f   BTRFS error (device loop0 state EA):   Ref action 1, root 5, ref_root 5, parent 0, owner 260, offset 0, num_refs 1      __btrfs_mod_ref+0x76b/0xac0 fs/btrfs/extent-tree.c:2521      update_ref_for_cow+0x96a/0x11f0      btrfs_force_cow_block+0x9f6/0x1da0 fs/btrfs/ctree.c:594      btrfs_cow_block+0x35e/0xa40 fs/btrfs/ctree.c:754      btrfs_search_slot+0xbdd/0x30d0 fs/btrfs/ctree.c:2116      btrfs_lookup_inode+0xdc/0x480 fs/btrfs/inode-item.c:411      __btrfs_update_delayed_inode+0x1e7/0xb90 fs/btrfs/delayed-inode.c:1030      btrfs_update_delayed_inode fs/btrfs/delayed-inode.c:1114 [inline]      __btrfs_commit_inode_delayed_items+0x2318/0x24a0 fs/btrfs/delayed-inode.c:1137      __btrfs_run_delayed_items+0x213/0x490 fs/btrfs/delayed-inode.c:1171      btrfs_commit_transaction+0x8a8/0x3740 fs/btrfs/transaction.c:2313      prepare_to_relocate+0x3c4/0x4c0 fs/btrfs/relocation.c:3586      relocate_block_group+0x16c/0xd40 fs/btrfs/relocation.c:3611      btrfs_relocate_block_group+0x77d/0xd90 fs/btrfs/relocation.c:4081      btrfs_relocate_chunk+0x12c/0x3b0 fs/btrfs/volumes.c:3377      __btrfs_balance+0x1b0f/0x26b0 fs/btrfs/volumes.c:4161      btrfs_balance+0xbdc/0x10c0 fs/btrfs/volumes.c:4538   BTRFS error (device loop0 state EA):   Ref action 2, root 5, ref_root 0, parent 8564736, owner 0, offset 0, num_refs 18446744073709551615      __btrfs_mod_ref+0x7dd/0xac0 fs/btrfs/extent-tree.c:2523      update_ref_for_cow+0x9cd/0x11f0 fs/btrfs/ctree.c:512      btrfs_force_cow_block+0x9f6/0x1da0 fs/btrfs/ctree.c:594      btrfs_cow_block+0x35e/0xa40 fs/btrfs/ctree.c:754      btrfs_search_slot+0xbdd/0x30d0 fs/btrfs/ctree.c:2116      btrfs_lookup_inode+0xdc/0x480 fs/btrfs/inode-item.c:411      __btrfs_update_delayed_inode+0x1e7/0xb90 fs/btrfs/delayed-inode.c:1030      btrfs_update_delayed_i---truncated---.
 漏洞公开时间：2024-12-27 23:15:17
 漏洞创建时间：2024-12-28 00:01:46
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2024-56581
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/4275ac2741941c9c7c2293619fdbacb9f70ba85b |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/6370db28af9a8ae3bbdfe97f8a48f8f995e144cf |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/6fd018aa168e472ce35be32296d109db6adb87ea |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/7c4e39f9d2af4abaf82ca0e315d1fd340456620f |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/a6f9e7a0bf1185c9070c0de03bb85eafb9abd650 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/d2b85ce0561fde894e28fa01bd5d32820d585006 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/dfb9fe7de61f34cc241ab3900bdde93341096e0e |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-56581 | https://bugzilla.suse.com/show_bug.cgi?id=1235124 |
| suse_bugzilla | https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2024/CVE-2024-56581.mbox | https://bugzilla.suse.com/show_bug.cgi?id=1235124 |
| suse_bugzilla | https://git.kernel.org/stable/c/dfb9fe7de61f34cc241ab3900bdde93341096e0e | https://bugzilla.suse.com/show_bug.cgi?id=1235124 |
| suse_bugzilla | https://git.kernel.org/stable/c/6fd018aa168e472ce35be32296d109db6adb87ea | https://bugzilla.suse.com/show_bug.cgi?id=1235124 |
| suse_bugzilla | https://git.kernel.org/stable/c/d2b85ce0561fde894e28fa01bd5d32820d585006 | https://bugzilla.suse.com/show_bug.cgi?id=1235124 |
| suse_bugzilla | https://git.kernel.org/stable/c/6370db28af9a8ae3bbdfe97f8a48f8f995e144cf | https://bugzilla.suse.com/show_bug.cgi?id=1235124 |
| suse_bugzilla | https://git.kernel.org/stable/c/4275ac2741941c9c7c2293619fdbacb9f70ba85b | https://bugzilla.suse.com/show_bug.cgi?id=1235124 |
| suse_bugzilla | https://git.kernel.org/stable/c/a6f9e7a0bf1185c9070c0de03bb85eafb9abd650 | https://bugzilla.suse.com/show_bug.cgi?id=1235124 |
| suse_bugzilla | https://git.kernel.org/stable/c/7c4e39f9d2af4abaf82ca0e315d1fd340456620f | https://bugzilla.suse.com/show_bug.cgi?id=1235124 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2024-56581 | https://bugzilla.suse.com/show_bug.cgi?id=1235124 |
| redhat_bugzilla | https://lore.kernel.org/linux-cve-announce/2024122720-CVE-2024-56581-501d@gregkh/T | https://bugzilla.redhat.com/show_bug.cgi?id=2334460 |
| debian |  | https://security-tracker.debian.org/tracker/CVE-2024-56581 |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
| linux_kernel | 5.4.287 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=dfb9fe7de61f34cc241ab3900bdde93341096e0eIssue | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=fd708b81d972a0714b02a60eb4792fdbf15868c4 | linuxkernelcves |
| linux_kernel | 5.10.231 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=6fd018aa168e472ce35be32296d109db6adb87eaIssue | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=fd708b81d972a0714b02a60eb4792fdbf15868c4 | linuxkernelcves |
| linux_kernel | 5.15.174 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=d2b85ce0561fde894e28fa01bd5d32820d585006Issue | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=fd708b81d972a0714b02a60eb4792fdbf15868c4 | linuxkernelcves |
| linux_kernel | 6.1.120 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=6370db28af9a8ae3bbdfe97f8a48f8f995e144cfIssue | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=fd708b81d972a0714b02a60eb4792fdbf15868c4 | linuxkernelcves |
| linux_kernel | 6.6.64 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=4275ac2741941c9c7c2293619fdbacb9f70ba85bIssue | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=fd708b81d972a0714b02a60eb4792fdbf15868c4 | linuxkernelcves |
| linux_kernel | 6.12.4 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=a6f9e7a0bf1185c9070c0de03bb85eafb9abd650Issue | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=fd708b81d972a0714b02a60eb4792fdbf15868c4 | linuxkernelcves |
| linux_kernel | 6.13-rc2 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=7c4e39f9d2af4abaf82ca0e315d1fd340456620fPlease | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=fd708b81d972a0714b02a60eb4792fdbf15868c4 | linuxkernelcves |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
  In the Linux kernel, the following vulnerability has been resolved:btrfs: ref-verify: fix use-after-free after invalid ref actionAt btrfs_ref_tree_mod() after we successfully inserted the new ref entry(local variable &#39;ref&#39;) into the respective block entry&#39;s rbtree (localvariable &#39;be&#39;), if we find an unexpected action of BTRFS_DROP_DELAYED_REF,we error out and free the ref entry without removing it from the blockentry&#39;s rbtree. Then in the error path of btrfs_ref_tree_mod() we callbtrfs_free_ref_cache(), which iterates over all block entries and thencalls free_block_entry() for each one, and there we will trigger ause-after-free when we are called against the block entry to which weadded the freed ref entry to its rbtree, since the rbtree still pointsto the block entry, as we didn&#39;t remove it from the rbtree before freeingit in the error path at btrfs_ref_tree_mod(). Fix this by removing thenew ref entry from the rbtree before freeing it.Syzbot report this with the following stack traces:   BTRFS error (device loop0 state EA):   Ref action 2, root 5, ref_root 0, parent 8564736, owner 0, offset 0, num_refs 18446744073709551615      __btrfs_mod_ref+0x7dd/0xac0 fs/btrfs/extent-tree.c:2523      update_ref_for_cow+0x9cd/0x11f0 fs/btrfs/ctree.c:512      btrfs_force_cow_block+0x9f6/0x1da0 fs/btrfs/ctree.c:594      btrfs_cow_block+0x35e/0xa40 fs/btrfs/ctree.c:754      btrfs_search_slot+0xbdd/0x30d0 fs/btrfs/ctree.c:2116      btrfs_insert_empty_items+0x9c/0x1a0 fs/btrfs/ctree.c:4314      btrfs_insert_empty_item fs/btrfs/ctree.h:669 [inline]      btrfs_insert_orphan_item+0x1f1/0x320 fs/btrfs/orphan.c:23      btrfs_orphan_add+0x6d/0x1a0 fs/btrfs/inode.c:3482      btrfs_unlink+0x267/0x350 fs/btrfs/inode.c:4293      vfs_unlink+0x365/0x650 fs/namei.c:4469      do_unlinkat+0x4ae/0x830 fs/namei.c:4533      __do_sys_unlinkat fs/namei.c:4576 [inline]      __se_sys_unlinkat fs/namei.c:4569 [inline]      __x64_sys_unlinkat+0xcc/0xf0 fs/namei.c:4569      do_syscall_x64 arch/x86/entry/common.c:52 [inline]      do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83      entry_SYSCALL_64_after_hwframe+0x77/0x7f   BTRFS error (device loop0 state EA):   Ref action 1, root 5, ref_root 5, parent 0, owner 260, offset 0, num_refs 1      __btrfs_mod_ref+0x76b/0xac0 fs/btrfs/extent-tree.c:2521      update_ref_for_cow+0x96a/0x11f0      btrfs_force_cow_block+0x9f6/0x1da0 fs/btrfs/ctree.c:594      btrfs_cow_block+0x35e/0xa40 fs/btrfs/ctree.c:754      btrfs_search_slot+0xbdd/0x30d0 fs/btrfs/ctree.c:2116      btrfs_lookup_inode+0xdc/0x480 fs/btrfs/inode-item.c:411      __btrfs_update_delayed_inode+0x1e7/0xb90 fs/btrfs/delayed-inode.c:1030      btrfs_update_delayed_inode fs/btrfs/delayed-inode.c:1114 [inline]      __btrfs_commit_inode_delayed_items+0x2318/0x24a0 fs/btrfs/delayed-inode.c:1137      __btrfs_run_delayed_items+0x213/0x490 fs/btrfs/delayed-inode.c:1171      btrfs_commit_transaction+0x8a8/0x3740 fs/btrfs/transaction.c:2313      prepare_to_relocate+0x3c4/0x4c0 fs/btrfs/relocation.c:3586      relocate_block_group+0x16c/0xd40 fs/btrfs/relocation.c:3611      btrfs_relocate_block_group+0x77d/0xd90 fs/btrfs/relocation.c:4081      btrfs_relocate_chunk+0x12c/0x3b0 fs/btrfs/volumes.c:3377      __btrfs_balance+0x1b0f/0x26b0 fs/btrfs/volumes.c:4161      btrfs_balance+0xbdc/0x10c0 fs/btrfs/volumes.c:4538   BTRFS error (device loop0 state EA):   Ref action 2, root 5, ref_root 0, parent 8564736, owner 0, offset 0, num_refs 18446744073709551615      __btrfs_mod_ref+0x7dd/0xac0 fs/btrfs/extent-tree.c:2523      update_ref_for_cow+0x9cd/0x11f0 fs/btrfs/ctree.c:512      btrfs_force_cow_block+0x9f6/0x1da0 fs/btrfs/ctree.c:594      btrfs_cow_block+0x35e/0xa40 fs/btrfs/ctree.c:754      btrfs_search_slot+0xbdd/0x30d0 fs/btrfs/ctree.c:2116      btrfs_lookup_inode+0xdc/0x480 fs/btrfs/inode-item.c:411      __btrfs_update_delayed_inode+0x1e7/0xb90 fs/btrfs/delayed-inode.c:1030      btrfs_update_delayed_inode fs/btrfs/delayed-inode.c:1114 [inline]      __btrfs_commit_inode_delayed_items+0x2318/0x24a0 fs/btrfs/delayed-inode.c:1137      __btrfs_run_delay
 openEuler评分：
  3.9
 Vector：CVSS：3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L
 受影响版本排查(受影响/不受影响)：
  1.openEuler-20.03-LTS-SP4(4.19.90):受影响
2.openEuler-22.03-LTS-SP1(5.10.0):受影响
3.openEuler-22.03-LTS-SP3(5.10.0):受影响
4.openEuler-22.03-LTS-SP4(5.10.0):受影响
5.openEuler-24.03-LTS(6.6.0):受影响
6.openEuler-24.03-LTS-SP1(6.6.0):受影响
7.master(6.6.0):不受影响
8.openEuler-24.03-LTS-Next(6.6.0):不受影响

修复是否涉及abi变化(是/否)：
  1.openEuler-20.03-LTS-SP4(4.19.90):否
2.openEuler-22.03-LTS-SP1(5.10.0):否
3.openEuler-22.03-LTS-SP3(5.10.0):否
4.master(6.6.0):否
5.openEuler-24.03-LTS(6.6.0):否
6.openEuler-24.03-LTS-Next(6.6.0):否
7.openEuler-22.03-LTS-SP4(5.10.0):否
8.openEuler-24.03-LTS-SP1(6.6.0):否

原因说明：
  1.openEuler-22.03-LTS-SP1(5.10.0):正常修复
2.openEuler-22.03-LTS-SP3(5.10.0):正常修复
3.openEuler-22.03-LTS-SP4(5.10.0):正常修复
4.openEuler-24.03-LTS(6.6.0):正常修复
5.openEuler-24.03-LTS-SP1(6.6.0):正常修复
6.openEuler-20.03-LTS-SP4(4.19.90):暂不修复-暂无解决方案或补丁
7.master(6.6.0):不受影响-漏洞代码不能被攻击者触发
8.openEuler-24.03-LTS-Next(6.6.0):不受影响-漏洞代码不能被攻击者触发

三、漏洞修复
安全公告链接：https://www.openeuler.org/zh/security/safety-bulletin/detail/?id=openEuler-SA-2025-1037

src-openEuler/kernel

内容风险标识

评论 (13)

src-openEuler/kernel .gitee-modal { width: 500px !important; }

内容风险标识

CVE-2024-56581

评论 (13)

搜索帮助

src-openEuler/kernel