// For flags

CVE-2024-36966

erofs: reliably distinguish block based and fscache mode

Severity Score

"-"
*CVSS v-

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Track
*SSVC
Descriptions

In the Linux kernel, the following vulnerability has been resolved:

erofs: reliably distinguish block based and fscache mode

When erofs_kill_sb() is called in block dev based mode, s_bdev may not
have been initialised yet, and if CONFIG_EROFS_FS_ONDEMAND is enabled,
it will be mistaken for fscache mode, and then attempt to free an anon_dev
that has never been allocated, triggering the following warning:

============================================
ida_free called for id=0 which is not allocated.
WARNING: CPU: 14 PID: 926 at lib/idr.c:525 ida_free+0x134/0x140
Modules linked in:
CPU: 14 PID: 926 Comm: mount Not tainted 6.9.0-rc3-dirty #630
RIP: 0010:ida_free+0x134/0x140
Call Trace:
<TASK>
erofs_kill_sb+0x81/0x90
deactivate_locked_super+0x35/0x80
get_tree_bdev+0x136/0x1e0
vfs_get_tree+0x2c/0xf0
do_new_mount+0x190/0x2f0
[...]
============================================

Now when erofs_kill_sb() is called, erofs_sb_info must have been
initialised, so use sbi->fsid to distinguish between the two modes.

En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: erofs: distingue de manera confiable el modo basado en bloques y el modo fscache cuando se llama a erofs_kill_sb() en el modo basado en desarrollo de bloques, es posible que s_bdev aún no se haya inicializado y, si CONFIG_EROFS_FS_ONDEMAND está habilitado, se confundido con el modo fscache y luego intenta liberar un anon_dev que nunca ha sido asignado, lo que genera la siguiente advertencia: ============================= ================= ida_free solicitó id=0 que no está asignado. ADVERTENCIA: CPU: 14 PID: 926 en lib/idr.c:525 ida_free+0x134/0x140 Módulos vinculados en: CPU: 14 PID: 926 Comm: mount No contaminado 6.9.0-rc3-dirty #630 RIP: 0010:ida_free +0x134/0x140 Seguimiento de llamadas: erofs_kill_sb+0x81/0x90 desactivar_locked_super+0x35/0x80 get_tree_bdev+0x136/0x1e0 vfs_get_tree+0x2c/0xf0 do_new_mount+0x190/0x2f0 [...] ========== ================================== Ahora, cuando se llama a erofs_kill_sb(), erofs_sb_info debe haberse inicializado, así que use sbi-&gt;fsid para distinguir entre los dos modos.

*Credits: N/A
CVSS Scores
Attack Vector
-
Attack Complexity
-
Privileges Required
-
User Interaction
-
Scope
-
Confidentiality
-
Integrity
-
Availability
-
* Common Vulnerability Scoring System
SSVC
  • Decision:Track
Exploitation
None
Automatable
No
Tech. Impact
Partial
* Organization's Worst-case Scenario
Timeline
  • 2024-05-30 CVE Reserved
  • 2024-06-08 CVE Published
  • 2024-06-09 EPSS Updated
  • 2024-08-02 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Linux
Search vendor "Linux"
 Linux Kernel
Search vendor "Linux" for product "Linux Kernel"
 >= 6.6 < 6.6.32
Search vendor "Linux" for product "Linux Kernel" and version " >= 6.6 < 6.6.32"
en
Affected
Linux
Search vendor "Linux"
 Linux Kernel
Search vendor "Linux" for product "Linux Kernel"
 >= 6.6 < 6.8.11
Search vendor "Linux" for product "Linux Kernel" and version " >= 6.6 < 6.8.11"
en
Affected
Linux
Search vendor "Linux"
 Linux Kernel
Search vendor "Linux" for product "Linux Kernel"
 >= 6.6 < 6.9
Search vendor "Linux" for product "Linux Kernel" and version " >= 6.6 < 6.9"
en
Affected