CVE-2024-39276
ext4: fix mb_cache_entry's e_refcnt leak in ext4_xattr_block_cache_find()
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
In the Linux kernel, the following vulnerability has been resolved:
ext4: fix mb_cache_entry's e_refcnt leak in ext4_xattr_block_cache_find()
Syzbot reports a warning as follows:
============================================
WARNING: CPU: 0 PID: 5075 at fs/mbcache.c:419 mb_cache_destroy+0x224/0x290
Modules linked in:
CPU: 0 PID: 5075 Comm: syz-executor199 Not tainted 6.9.0-rc6-gb947cc5bf6d7
RIP: 0010:mb_cache_destroy+0x224/0x290 fs/mbcache.c:419
Call Trace:
<TASK>
ext4_put_super+0x6d4/0xcd0 fs/ext4/super.c:1375
generic_shutdown_super+0x136/0x2d0 fs/super.c:641
kill_block_super+0x44/0x90 fs/super.c:1675
ext4_kill_sb+0x68/0xa0 fs/ext4/super.c:7327
[...]
============================================
This is because when finding an entry in ext4_xattr_block_cache_find(), if
ext4_sb_bread() returns -ENOMEM, the ce's e_refcnt, which has already grown
in the __entry_find(), won't be put away, and eventually trigger the above
issue in mb_cache_destroy() due to reference count leakage.
So call mb_cache_entry_put() on the -ENOMEM error branch as a quick fix.
CVSS Scores
SSVC
- Decision:Track
Timeline
- 2024-06-24 CVE Reserved
- 2024-06-25 CVE Published
- 2024-06-26 EPSS Updated
- 2024-08-02 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-402: Transmission of Private Resources into a New Sphere ('Resource Leak')
CAPEC
References (14)
URL | Tag | Source |
---|---|---|
https://git.kernel.org/stable/c/b878c8a7f08f0c225b6a46ba1ac867e9c5d17807 | Vuln. Introduced | |
https://git.kernel.org/stable/c/fb265c9cb49e2074ddcdd4de99728aefdd3b3592 | Vuln. Introduced | |
https://git.kernel.org/stable/c/9da1f6d06b7a6d068e68fcfd7cbbf6b586d888e1 | Vuln. Introduced | |
https://git.kernel.org/stable/c/81313ed2c705d958744882a269bf4a5e3ddec95e | Vuln. Introduced |
URL | Date | SRC |
---|
URL | Date | SRC |
---|---|---|
https://access.redhat.com/security/cve/CVE-2024-39276 | 2024-08-08 | |
https://bugzilla.redhat.com/show_bug.cgi?id=2294274 | 2024-08-08 |
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 4.19.14 < 4.19.316 Search vendor "Linux" for product "Linux Kernel" and version " >= 4.19.14 < 4.19.316" | en |
Affected
| ||||||
Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 5.0 < 5.4.278 Search vendor "Linux" for product "Linux Kernel" and version " >= 5.0 < 5.4.278" | en |
Affected
| ||||||
Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 5.0 < 5.10.219 Search vendor "Linux" for product "Linux Kernel" and version " >= 5.0 < 5.10.219" | en |
Affected
| ||||||
Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 5.0 < 5.15.161 Search vendor "Linux" for product "Linux Kernel" and version " >= 5.0 < 5.15.161" | en |
Affected
| ||||||
Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 5.0 < 6.1.94 Search vendor "Linux" for product "Linux Kernel" and version " >= 5.0 < 6.1.94" | en |
Affected
| ||||||
Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 5.0 < 6.6.34 Search vendor "Linux" for product "Linux Kernel" and version " >= 5.0 < 6.6.34" | en |
Affected
| ||||||
Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 5.0 < 6.9.5 Search vendor "Linux" for product "Linux Kernel" and version " >= 5.0 < 6.9.5" | en |
Affected
| ||||||
Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 5.0 < 6.10 Search vendor "Linux" for product "Linux Kernel" and version " >= 5.0 < 6.10" | en |
Affected
| ||||||
Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | 4.14.92 Search vendor "Linux" for product "Linux Kernel" and version "4.14.92" | en |
Affected
| ||||||
Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | 4.20.1 Search vendor "Linux" for product "Linux Kernel" and version "4.20.1" | en |
Affected
|