cve-2024-40962
Vulnerability from cvelistv5
Published
2024-07-12 12:32
Modified
2024-11-05 09:34
Severity ?
Summary
btrfs: zoned: allocate dummy checksums for zoned NODATASUM writes
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/082b3d4e788953a3ff42ecdb70c4210149076285
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/25cfe59f4470a051d1b80f51fa0ca3a5048e4a19
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/cebae292e0c32a228e8f2219c270a7237be24a6a
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/082b3d4e788953a3ff42ecdb70c4210149076285
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/25cfe59f4470a051d1b80f51fa0ca3a5048e4a19
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/cebae292e0c32a228e8f2219c270a7237be24a6a
Impacted products
Vendor Product Version
Linux Linux Version: 6.5
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T04:39:55.986Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/082b3d4e788953a3ff42ecdb70c4210149076285"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/25cfe59f4470a051d1b80f51fa0ca3a5048e4a19"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/cebae292e0c32a228e8f2219c270a7237be24a6a"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-40962",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T17:03:23.008786Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:34:23.463Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/btrfs/bio.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "082b3d4e7889",
              "status": "affected",
              "version": "cbfce4c7fbde",
              "versionType": "git"
            },
            {
              "lessThan": "25cfe59f4470",
              "status": "affected",
              "version": "cbfce4c7fbde",
              "versionType": "git"
            },
            {
              "lessThan": "cebae292e0c3",
              "status": "affected",
              "version": "cbfce4c7fbde",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/btrfs/bio.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.5"
            },
            {
              "lessThan": "6.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.36",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.9.*",
              "status": "unaffected",
              "version": "6.9.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.10",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: zoned: allocate dummy checksums for zoned NODATASUM writes\n\nShin\u0027ichiro reported that when he\u0027s running fstests\u0027 test-case\nbtrfs/167 on emulated zoned devices, he\u0027s seeing the following NULL\npointer dereference in \u0027btrfs_zone_finish_endio()\u0027:\n\n  Oops: general protection fault, probably for non-canonical address 0xdffffc0000000011: 0000 [#1] PREEMPT SMP KASAN NOPTI\n  KASAN: null-ptr-deref in range [0x0000000000000088-0x000000000000008f]\n  CPU: 4 PID: 2332440 Comm: kworker/u80:15 Tainted: G        W          6.10.0-rc2-kts+ #4\n  Hardware name: Supermicro Super Server/X11SPi-TF, BIOS 3.3 02/21/2020\n  Workqueue: btrfs-endio-write btrfs_work_helper [btrfs]\n  RIP: 0010:btrfs_zone_finish_endio.part.0+0x34/0x160 [btrfs]\n\n  RSP: 0018:ffff88867f107a90 EFLAGS: 00010206\n  RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff893e5534\n  RDX: 0000000000000011 RSI: 0000000000000004 RDI: 0000000000000088\n  RBP: 0000000000000002 R08: 0000000000000001 R09: ffffed1081696028\n  R10: ffff88840b4b0143 R11: ffff88834dfff600 R12: ffff88840b4b0000\n  R13: 0000000000020000 R14: 0000000000000000 R15: ffff888530ad5210\n  FS:  0000000000000000(0000) GS:ffff888e3f800000(0000) knlGS:0000000000000000\n  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  CR2: 00007f87223fff38 CR3: 00000007a7c6a002 CR4: 00000000007706f0\n  DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n  DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n  PKRU: 55555554\n  Call Trace:\n   \u003cTASK\u003e\n   ? __die_body.cold+0x19/0x27\n   ? die_addr+0x46/0x70\n   ? exc_general_protection+0x14f/0x250\n   ? asm_exc_general_protection+0x26/0x30\n   ? do_raw_read_unlock+0x44/0x70\n   ? btrfs_zone_finish_endio.part.0+0x34/0x160 [btrfs]\n   btrfs_finish_one_ordered+0x5d9/0x19a0 [btrfs]\n   ? __pfx_lock_release+0x10/0x10\n   ? do_raw_write_lock+0x90/0x260\n   ? __pfx_do_raw_write_lock+0x10/0x10\n   ? __pfx_btrfs_finish_one_ordered+0x10/0x10 [btrfs]\n   ? _raw_write_unlock+0x23/0x40\n   ? btrfs_finish_ordered_zoned+0x5a9/0x850 [btrfs]\n   ? lock_acquire+0x435/0x500\n   btrfs_work_helper+0x1b1/0xa70 [btrfs]\n   ? __schedule+0x10a8/0x60b0\n   ? __pfx___might_resched+0x10/0x10\n   process_one_work+0x862/0x1410\n   ? __pfx_lock_acquire+0x10/0x10\n   ? __pfx_process_one_work+0x10/0x10\n   ? assign_work+0x16c/0x240\n   worker_thread+0x5e6/0x1010\n   ? __pfx_worker_thread+0x10/0x10\n   kthread+0x2c3/0x3a0\n   ? trace_irq_enable.constprop.0+0xce/0x110\n   ? __pfx_kthread+0x10/0x10\n   ret_from_fork+0x31/0x70\n   ? __pfx_kthread+0x10/0x10\n   ret_from_fork_asm+0x1a/0x30\n   \u003c/TASK\u003e\n\nEnabling CONFIG_BTRFS_ASSERT revealed the following assertion to\ntrigger:\n\n  assertion failed: !list_empty(\u0026ordered-\u003elist), in fs/btrfs/zoned.c:1815\n\nThis indicates, that we\u0027re missing the checksums list on the\nordered_extent. As btrfs/167 is doing a NOCOW write this is to be\nexpected.\n\nFurther analysis with drgn confirmed the assumption:\n\n  \u003e\u003e\u003e inode = prog.crashed_thread().stack_trace()[11][\u0027ordered\u0027].inode\n  \u003e\u003e\u003e btrfs_inode = drgn.container_of(inode, \"struct btrfs_inode\", \\\n         \t\t\t\t\"vfs_inode\")\n  \u003e\u003e\u003e print(btrfs_inode.flags)\n  (u32)1\n\nAs zoned emulation mode simulates conventional zones on regular devices,\nwe cannot use zone-append for writing. But we\u0027re only attaching dummy\nchecksums if we\u0027re doing a zone-append write.\n\nSo for NOCOW zoned data writes on conventional zones, also attach a\ndummy checksum."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-11-05T09:34:02.032Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/082b3d4e788953a3ff42ecdb70c4210149076285"
        },
        {
          "url": "https://git.kernel.org/stable/c/25cfe59f4470a051d1b80f51fa0ca3a5048e4a19"
        },
        {
          "url": "https://git.kernel.org/stable/c/cebae292e0c32a228e8f2219c270a7237be24a6a"
        }
      ],
      "title": "btrfs: zoned: allocate dummy checksums for zoned NODATASUM writes",
      "x_generator": {
        "engine": "bippy-9e1c9544281a"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-40962",
    "datePublished": "2024-07-12T12:32:03.316Z",
    "dateReserved": "2024-07-12T12:17:45.594Z",
    "dateUpdated": "2024-11-05T09:34:02.032Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-40962\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-07-12T13:15:18.180\",\"lastModified\":\"2024-11-21T09:31:57.560\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbtrfs: zoned: allocate dummy checksums for zoned NODATASUM writes\\n\\nShin\u0027ichiro reported that when he\u0027s running fstests\u0027 test-case\\nbtrfs/167 on emulated zoned devices, he\u0027s seeing the following NULL\\npointer dereference in \u0027btrfs_zone_finish_endio()\u0027:\\n\\n  Oops: general protection fault, probably for non-canonical address 0xdffffc0000000011: 0000 [#1] PREEMPT SMP KASAN NOPTI\\n  KASAN: null-ptr-deref in range [0x0000000000000088-0x000000000000008f]\\n  CPU: 4 PID: 2332440 Comm: kworker/u80:15 Tainted: G        W          6.10.0-rc2-kts+ #4\\n  Hardware name: Supermicro Super Server/X11SPi-TF, BIOS 3.3 02/21/2020\\n  Workqueue: btrfs-endio-write btrfs_work_helper [btrfs]\\n  RIP: 0010:btrfs_zone_finish_endio.part.0+0x34/0x160 [btrfs]\\n\\n  RSP: 0018:ffff88867f107a90 EFLAGS: 00010206\\n  RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff893e5534\\n  RDX: 0000000000000011 RSI: 0000000000000004 RDI: 0000000000000088\\n  RBP: 0000000000000002 R08: 0000000000000001 R09: ffffed1081696028\\n  R10: ffff88840b4b0143 R11: ffff88834dfff600 R12: ffff88840b4b0000\\n  R13: 0000000000020000 R14: 0000000000000000 R15: ffff888530ad5210\\n  FS:  0000000000000000(0000) GS:ffff888e3f800000(0000) knlGS:0000000000000000\\n  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\n  CR2: 00007f87223fff38 CR3: 00000007a7c6a002 CR4: 00000000007706f0\\n  DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\\n  DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\\n  PKRU: 55555554\\n  Call Trace:\\n   \u003cTASK\u003e\\n   ? __die_body.cold+0x19/0x27\\n   ? die_addr+0x46/0x70\\n   ? exc_general_protection+0x14f/0x250\\n   ? asm_exc_general_protection+0x26/0x30\\n   ? do_raw_read_unlock+0x44/0x70\\n   ? btrfs_zone_finish_endio.part.0+0x34/0x160 [btrfs]\\n   btrfs_finish_one_ordered+0x5d9/0x19a0 [btrfs]\\n   ? __pfx_lock_release+0x10/0x10\\n   ? do_raw_write_lock+0x90/0x260\\n   ? __pfx_do_raw_write_lock+0x10/0x10\\n   ? __pfx_btrfs_finish_one_ordered+0x10/0x10 [btrfs]\\n   ? _raw_write_unlock+0x23/0x40\\n   ? btrfs_finish_ordered_zoned+0x5a9/0x850 [btrfs]\\n   ? lock_acquire+0x435/0x500\\n   btrfs_work_helper+0x1b1/0xa70 [btrfs]\\n   ? __schedule+0x10a8/0x60b0\\n   ? __pfx___might_resched+0x10/0x10\\n   process_one_work+0x862/0x1410\\n   ? __pfx_lock_acquire+0x10/0x10\\n   ? __pfx_process_one_work+0x10/0x10\\n   ? assign_work+0x16c/0x240\\n   worker_thread+0x5e6/0x1010\\n   ? __pfx_worker_thread+0x10/0x10\\n   kthread+0x2c3/0x3a0\\n   ? trace_irq_enable.constprop.0+0xce/0x110\\n   ? __pfx_kthread+0x10/0x10\\n   ret_from_fork+0x31/0x70\\n   ? __pfx_kthread+0x10/0x10\\n   ret_from_fork_asm+0x1a/0x30\\n   \u003c/TASK\u003e\\n\\nEnabling CONFIG_BTRFS_ASSERT revealed the following assertion to\\ntrigger:\\n\\n  assertion failed: !list_empty(\u0026ordered-\u003elist), in fs/btrfs/zoned.c:1815\\n\\nThis indicates, that we\u0027re missing the checksums list on the\\nordered_extent. As btrfs/167 is doing a NOCOW write this is to be\\nexpected.\\n\\nFurther analysis with drgn confirmed the assumption:\\n\\n  \u003e\u003e\u003e inode = prog.crashed_thread().stack_trace()[11][\u0027ordered\u0027].inode\\n  \u003e\u003e\u003e btrfs_inode = drgn.container_of(inode, \\\"struct btrfs_inode\\\", \\\\\\n         \\t\\t\\t\\t\\\"vfs_inode\\\")\\n  \u003e\u003e\u003e print(btrfs_inode.flags)\\n  (u32)1\\n\\nAs zoned emulation mode simulates conventional zones on regular devices,\\nwe cannot use zone-append for writing. But we\u0027re only attaching dummy\\nchecksums if we\u0027re doing a zone-append write.\\n\\nSo for NOCOW zoned data writes on conventional zones, also attach a\\ndummy checksum.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: btrfs: zonificado: asigna sumas de verificaci\u00f3n ficticias para zonas zonificadas NODATASUM escribe Shin\u0027ichiro inform\u00f3 que cuando ejecuta el caso de prueba btrfs/167 de fstests en dispositivos zonificados emulados, ve el siguiente puntero NULL desreferencia en \u0027btrfs_zone_finish_endio()\u0027: Vaya: error de protecci\u00f3n general, probablemente para la direcci\u00f3n no can\u00f3nica 0xdffffc0000000011: 0000 [#1] PREEMPT SMP KASAN NOPTI KASAN: null-ptr-deref en el rango [0x0000000000000088-0x00000000000000 8f] CPU: 4 PID: 2332440 Comm: kworker/u80:15 Contaminado: GW 6.10.0-rc2-kts+ #4 Nombre de hardware: Supermicro Super Server/X11SPi-TF, BIOS 3.3 21/02/2020 Cola de trabajo: btrfs-endio-write btrfs_work_helper [btrfs] RIP : 0010:btrfs_zone_finish_endio.part.0+0x34/0x160 [btrfs] RSP: 0018:ffff88867f107a90 EFLAGS: 00010206 RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 893e5534 RDX: 0000000000000011 RSI: 0000000000000004 RDI: 0000000000000088 RBP: 0000000000000002 R08: 0000000000000001 R09: 6028 R10: ffff88840b4b0143 R11: ffff88834dfff600 R12: ffff88840b4b0000 R13: 0000000000020000 R14: 00000000000000000 R15: ffff888530ad5210 FS: 0000000000000(0000) GS:ffff888e3f800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f87223fff38 CR3 : 00000007a7c6a002 CR4: 00000000007706f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 00000000000000000 DR3: 0000000000000000 DR6: 000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Seguimiento de llamadas:  ? __die_body.cold+0x19/0x27 ? die_addr+0x46/0x70? exc_general_protection+0x14f/0x250? asm_exc_general_protection+0x26/0x30? do_raw_read_unlock+0x44/0x70? btrfs_zone_finish_endio.part.0+0x34/0x160 [btrfs] btrfs_finish_one_ordered+0x5d9/0x19a0 [btrfs] ? __pfx_lock_release+0x10/0x10? do_raw_write_lock+0x90/0x260? __pfx_do_raw_write_lock+0x10/0x10? __pfx_btrfs_finish_one_ordered+0x10/0x10 [btrfs]? _raw_write_unlock+0x23/0x40? btrfs_finish_ordered_zoned+0x5a9/0x850 [btrfs]? lock_acquire+0x435/0x500 btrfs_work_helper+0x1b1/0xa70 [btrfs]? __programar+0x10a8/0x60b0? __pfx___might_resched+0x10/0x10 proceso_one_work+0x862/0x1410 ? __pfx_lock_acquire+0x10/0x10? __pfx_process_one_work+0x10/0x10? asignar_trabajo+0x16c/0x240 trabajador_hilo+0x5e6/0x1010? __pfx_worker_thread+0x10/0x10 kthread+0x2c3/0x3a0 ? trace_irq_enable.constprop.0+0xce/0x110? __pfx_kthread+0x10/0x10 ret_from_fork+0x31/0x70 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30  Al habilitar CONFIG_BTRFS_ASSERT se revel\u00f3 la siguiente aserci\u00f3n para activar: aserci\u00f3n fallida: !list_empty(\u0026amp;ordered-\u0026gt;list), en fs/btrfs/zoned.c:1815 Esto indica que Falta la lista de sumas de verificaci\u00f3n en la extensi\u00f3n_ordenada. Como btrfs/167 est\u00e1 escribiendo NOCOW, esto es de esperarse. Un an\u00e1lisis m\u00e1s detallado con drgn confirm\u00f3 la suposici\u00f3n: \u0026gt;\u0026gt;\u0026gt; inode = prog.crashed_thread().stack_trace()[11][\u0027ordered\u0027].inode \u0026gt;\u0026gt;\u0026gt; btrfs_inode = drgn.container_of(inode, \\\"struct btrfs_inode\\\", \\\\ \\\" vfs_inode\\\") \u0026gt;\u0026gt;\u0026gt; print(btrfs_inode.flags) (u32)1 Como el modo de emulaci\u00f3n de zonas simula zonas convencionales en dispositivos normales, no podemos usar Zone-Append para escribir. Pero solo adjuntamos sumas de verificaci\u00f3n ficticias si realizamos una escritura de adici\u00f3n de zona. Entonces, para las escrituras de datos de zonas NOCOW en zonas convencionales, adjunte tambi\u00e9n una suma de verificaci\u00f3n ficticia.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/082b3d4e788953a3ff42ecdb70c4210149076285\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/25cfe59f4470a051d1b80f51fa0ca3a5048e4a19\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/cebae292e0c32a228e8f2219c270a7237be24a6a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/082b3d4e788953a3ff42ecdb70c4210149076285\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://git.kernel.org/stable/c/25cfe59f4470a051d1b80f51fa0ca3a5048e4a19\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://git.kernel.org/stable/c/cebae292e0c32a228e8f2219c270a7237be24a6a\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.