CVE-2024-55642

一、漏洞信息
 漏洞编号：[CVE-2024-55642](https://nvd.nist.gov/vuln/detail/CVE-2024-55642)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.19,6.1.8,6.4.0,6.6.0
 CVSS V3.0分值：
  BaseScore：5.5 Medium
  Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:block: Prevent potential deadlocks in zone write plug error recoveryZone write plugging for handling writes to zones of a zoned blockdevice always execute a zone report whenever a write BIO to a zonefails. The intent of this is to ensure that the tracking of a zone writepointer is always correct to ensure that the alignment to a zone writepointer of write BIOs can be checked on submission and that we canalways correctly emulate zone append operations using regular writeBIOs.However, this error recovery scheme introduces a potential deadlock if adevice queue freeze is initiated while BIOs are still plugged in a zonewrite plug and one of these write operation fails. In such case, thedisk zone write plug error recovery work is scheduled and executes areport zone. This in turn can result in a request allocation in theunderlying driver to issue the report zones command to the device. Butwith the device queue freeze already started, this allocation willblock, preventing the report zone execution and the continuation of theprocessing of the plugged BIOs. As plugged BIOs hold a queue usagereference, the queue freeze itself will never complete, resulting in adeadlock.Avoid this problem by completely removing from the zone write pluggingcode the use of report zones operations after a failed write operation,instead relying on the device user to either execute a report zones,reset the zone, finish the zone, or give up writing to the device (whichis a fairly common pattern for file systems which degrade to read-onlyafter write failures). This is not an unreasonnable requirement as allwell-behaved applications, FSes and device mapper already use reportzones to recover from write errors whenever possible by comparing thecurrent position of a zone write pointer with what their assumptionabout the position is.The changes to remove the automatic error recovery are as follows: - Completely remove the error recovery work and its associated   resources (zone write plug list head, disk error list, and disk   zone_wplugs_work work struct). This also removes the functions   disk_zone_wplug_set_error() and disk_zone_wplug_clear_error(). - Change the BLK_ZONE_WPLUG_ERROR zone write plug flag into   BLK_ZONE_WPLUG_NEED_WP_UPDATE. This new flag is set for a zone write   plug whenever a write opration targetting the zone of the zone write   plug fails. This flag indicates that the zone write pointer offset is   not reliable and that it must be updated when the next report zone,   reset zone, finish zone or disk revalidation is executed. - Modify blk_zone_write_plug_bio_endio() to set the   BLK_ZONE_WPLUG_NEED_WP_UPDATE flag for the target zone of a failed   write BIO. - Modify the function disk_zone_wplug_set_wp_offset() to clear this   new flag, thus implementing recovery of a correct write pointer   offset with the reset (all) zone and finish zone operations. - Modify blkdev_report_zones() to always use the disk_report_zones_cb()   callback so that disk_zone_wplug_sync_wp_offset() can be called for   any zone marked with the BLK_ZONE_WPLUG_NEED_WP_UPDATE flag.   This implements recovery of a correct write pointer offset for zone   write plugs marked with BLK_ZONE_WPLUG_NEED_WP_UPDATE and within   the range of the report zones operation executed by the user. - Modify blk_revalidate_seq_zone() to call   disk_zone_wplug_sync_wp_offset() for all sequential write required   zones when a zoned block device is revalidated, thus always resolving   any inconsistency between the write pointer offset of zone write   plugs and the actual write pointer position of sequential zones.
 漏洞公开时间：2025-01-11 21:15:27
 漏洞创建时间：2025-01-22 16:59:55
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2024-55642
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/7fa80134cf266325fa61139320091001c9b3c477 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/fe0418eb9bd69a19a948b297c8de815e05f3cde1 |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-55642 | https://bugzilla.suse.com/show_bug.cgi?id=1235744 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2024-55642 | https://bugzilla.suse.com/show_bug.cgi?id=1235744 |
| suse_bugzilla | https://git.kernel.org/stable/c/7fa80134cf266325fa61139320091001c9b3c477 | https://bugzilla.suse.com/show_bug.cgi?id=1235744 |
| suse_bugzilla | https://git.kernel.org/stable/c/fe0418eb9bd69a19a948b297c8de815e05f3cde1 | https://bugzilla.suse.com/show_bug.cgi?id=1235744 |
| suse_bugzilla | https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2024/CVE-2024-55642.mbox | https://bugzilla.suse.com/show_bug.cgi?id=1235744 |
| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2337115 | https://bugzilla.suse.com/show_bug.cgi?id=1235744 |
| debian |  | https://security-tracker.debian.org/tracker/CVE-2024-55642 |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
|  |  | https://git.kernel.org/stable/c/7fa80134cf266325fa61139320091001c9b3c477 |  | nvd |
|  |  | https://git.kernel.org/stable/c/fe0418eb9bd69a19a948b297c8de815e05f3cde1 |  | nvd |
| linux_kernel | 6.12.6 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=7fa80134cf266325fa61139320091001c9b3c477Issue | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=dd291d77cc90eb6a86e9860ba8e6e38eebd57d12 | linuxkernelcves |
| linux_kernel | 6.13-rc3 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=fe0418eb9bd69a19a948b297c8de815e05f3cde1Please | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=dd291d77cc90eb6a86e9860ba8e6e38eebd57d12 | linuxkernelcves |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
  In the Linux kernel, the following vulnerability has been resolved:block: Prevent potential deadlocks in zone write plug error recoveryZone write plugging for handling writes to zones of a zoned blockdevice always execute a zone report whenever a write BIO to a zonefails. The intent of this is to ensure that the tracking of a zone writepointer is always correct to ensure that the alignment to a zone writepointer of write BIOs can be checked on submission and that we canalways correctly emulate zone append operations using regular writeBIOs.However, this error recovery scheme introduces a potential deadlock if adevice queue freeze is initiated while BIOs are still plugged in a zonewrite plug and one of these write operation fails. In such case, thedisk zone write plug error recovery work is scheduled and executes areport zone. This in turn can result in a request allocation in theunderlying driver to issue the report zones command to the device. Butwith the device queue freeze already started, this allocation willblock, preventing the report zone execution and the continuation of theprocessing of the plugged BIOs. As plugged BIOs hold a queue usagereference, the queue freeze itself will never complete, resulting in adeadlock.Avoid this problem by completely removing from the zone write pluggingcode the use of report zones operations after a failed write operation,instead relying on the device user to either execute a report zones,reset the zone, finish the zone, or give up writing to the device (whichis a fairly common pattern for file systems which degrade to read-onlyafter write failures). This is not an unreasonnable requirement as allwell-behaved applications, FSes and device mapper already use reportzones to recover from write errors whenever possible by comparing thecurrent position of a zone write pointer with what their assumptionabout the position is.The changes to remove the automatic error recovery are as follows: - Completely remove the error recovery work and its associated   resources (zone write plug list head, disk error list, and disk   zone_wplugs_work work struct). This also removes the functions   disk_zone_wplug_set_error() and disk_zone_wplug_clear_error(). - Change the BLK_ZONE_WPLUG_ERROR zone write plug flag into   BLK_ZONE_WPLUG_NEED_WP_UPDATE. This new flag is set for a zone write   plug whenever a write opration targetting the zone of the zone write   plug fails. This flag indicates that the zone write pointer offset is   not reliable and that it must be updated when the next report zone,   reset zone, finish zone or disk revalidation is executed. - Modify blk_zone_write_plug_bio_endio() to set the   BLK_ZONE_WPLUG_NEED_WP_UPDATE flag for the target zone of a failed   write BIO. - Modify the function disk_zone_wplug_set_wp_offset() to clear this   new flag, thus implementing recovery of a correct write pointer   offset with the reset (all) zone and finish zone operations. - Modify blkdev_report_zones() to always use the disk_report_zones_cb()   callback so that disk_zone_wplug_sync_wp_offset() can be called for   any zone marked with the BLK_ZONE_WPLUG_NEED_WP_UPDATE flag.   This implements recovery of a correct write pointer offset for zone   write plugs marked with BLK_ZONE_WPLUG_NEED_WP_UPDATE and within   the range of the report zones operation executed by the user. - Modify blk_revalidate_seq_zone() to call   disk_zone_wplug_sync_wp_offset() for all sequential write required   zones when a zoned block device is revalidated, thus always resolving   any inconsistency between the write pointer offset of zone write   plugs and the actual write pointer position of sequential zones.
 openEuler评分：
  5.5
 Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
 受影响版本排查(受影响/不受影响)：
  1.openEuler-20.03-LTS-SP4(4.19.90):不受影响
2.openEuler-22.03-LTS-SP3(5.10.0):不受影响
3.openEuler-22.03-LTS-SP4(5.10.0):不受影响
4.master(6.6.0):不受影响
5.openEuler-24.03-LTS(6.6.0):不受影响
6.openEuler-24.03-LTS-Next(6.6.0):不受影响
7.openEuler-24.03-LTS-SP1(6.6.0):不受影响

修复是否涉及abi变化(是/否)：
  1.openEuler-20.03-LTS-SP4(4.19.90):否
2.openEuler-22.03-LTS-SP3(5.10.0):否
3.master(6.6.0):否
4.openEuler-24.03-LTS(6.6.0):否
5.openEuler-24.03-LTS-Next(6.6.0):否
6.openEuler-22.03-LTS-SP4(5.10.0):否
7.openEuler-24.03-LTS-SP1(6.6.0):否

原因说明：
  1.master(6.6.0):不受影响-漏洞代码不能被攻击者触发
2.openEuler-24.03-LTS-Next(6.6.0):不受影响-漏洞代码不能被攻击者触发
3.openEuler-20.03-LTS-SP4(4.19.90):不受影响-漏洞代码不存在
4.openEuler-22.03-LTS-SP3(5.10.0):不受影响-漏洞代码不存在
5.openEuler-22.03-LTS-SP4(5.10.0):不受影响-漏洞代码不存在
6.openEuler-24.03-LTS(6.6.0):不受影响-漏洞代码不存在
7.openEuler-24.03-LTS-SP1(6.6.0):不受影响-漏洞代码不存在

src-openEuler/kernel
Closed

Content Risk Flag

Comments (8)

src-openEuler/kernelClosed .gitee-modal { width: 500px !important; }

Content Risk Flag

CVE-2024-55642

Comments (8)

Search

src-openEuler/kernel
Closed