CVE-2024-35807 (GCVE-0-2024-35807)

Vulnerability from cvelistv5 – Published: 2024-05-17 13:23 – Updated: 2026-05-12 11:52
VLAI
Title
ext4: fix corruption during on-line resize
Summary
In the Linux kernel, the following vulnerability has been resolved: ext4: fix corruption during on-line resize We observed a corruption during on-line resize of a file system that is larger than 16 TiB with 4k block size. With having more then 2^32 blocks resize_inode is turned off by default by mke2fs. The issue can be reproduced on a smaller file system for convenience by explicitly turning off resize_inode. An on-line resize across an 8 GiB boundary (the size of a meta block group in this setup) then leads to a corruption: dev=/dev/<some_dev> # should be >= 16 GiB mkdir -p /corruption /sbin/mke2fs -t ext4 -b 4096 -O ^resize_inode $dev $((2 * 2**21 - 2**15)) mount -t ext4 $dev /corruption dd if=/dev/zero bs=4096 of=/corruption/test count=$((2*2**21 - 4*2**15)) sha1sum /corruption/test # 79d2658b39dcfd77274e435b0934028adafaab11 /corruption/test /sbin/resize2fs $dev $((2*2**21)) # drop page cache to force reload the block from disk echo 1 > /proc/sys/vm/drop_caches sha1sum /corruption/test # 3c2abc63cbf1a94c9e6977e0fbd72cd832c4d5c3 /corruption/test 2^21 = 2^15*2^6 equals 8 GiB whereof 2^15 is the number of blocks per block group and 2^6 are the number of block groups that make a meta block group. The last checksum might be different depending on how the file is laid out across the physical blocks. The actual corruption occurs at physical block 63*2^15 = 2064384 which would be the location of the backup of the meta block group's block descriptor. During the on-line resize the file system will be converted to meta_bg starting at s_first_meta_bg which is 2 in the example - meaning all block groups after 16 GiB. However, in ext4_flex_group_add we might add block groups that are not part of the first meta block group yet. In the reproducer we achieved this by substracting the size of a whole block group from the point where the meta block group would start. This must be considered when updating the backup block group descriptors to follow the non-meta_bg layout. The fix is to add a test whether the group to add is already part of the meta block group or not.
Severity
No CVSS data available.
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 01f795f9e0d67adeccc61a8b20c28acb45fa5fd8 , < 75cc31c2e7193b69f5d25650bda5bb42ed92f8a1 (git)
Affected: 01f795f9e0d67adeccc61a8b20c28acb45fa5fd8 , < ee4e9c1976147a850f6085a13fca95bcaa00d84c (git)
Affected: 01f795f9e0d67adeccc61a8b20c28acb45fa5fd8 , < e8e8b197317228b5089ed9e7802dadf3ccaa027a (git)
Affected: 01f795f9e0d67adeccc61a8b20c28acb45fa5fd8 , < 239c669edb2bffa1aa2612519b1d438ab35d6be6 (git)
Affected: 01f795f9e0d67adeccc61a8b20c28acb45fa5fd8 , < fb1088d51bbaa0faec5a55d4f5818a9ab79e24df (git)
Affected: 01f795f9e0d67adeccc61a8b20c28acb45fa5fd8 , < 37b6a3ba793bbbae057f5b991970ebcc52cb3db5 (git)
Affected: 01f795f9e0d67adeccc61a8b20c28acb45fa5fd8 , < b461910af8ba3bed80f48c2bf852686d05c6fc5c (git)
Affected: 01f795f9e0d67adeccc61a8b20c28acb45fa5fd8 , < 722d2c01b8b108f8283d1b7222209d5b2a5aa7bd (git)
Affected: 01f795f9e0d67adeccc61a8b20c28acb45fa5fd8 , < a6b3bfe176e8a5b05ec4447404e412c2a3fc92cc (git)
Create a notification for this product.
Linux Linux Affected: 3.7
Unaffected: 0 , < 3.7 (semver)
Unaffected: 4.19.312 , ≤ 4.19.* (semver)
Unaffected: 5.4.274 , ≤ 5.4.* (semver)
Unaffected: 5.10.215 , ≤ 5.10.* (semver)
Unaffected: 5.15.154 , ≤ 5.15.* (semver)
Unaffected: 6.1.84 , ≤ 6.1.* (semver)
Unaffected: 6.6.24 , ≤ 6.6.* (semver)
Unaffected: 6.7.12 , ≤ 6.7.* (semver)
Unaffected: 6.8.3 , ≤ 6.8.* (semver)
Unaffected: 6.9 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem Affected: 0 , < * (custom)
Create a notification for this product.
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP Affected: V3.1.0 , < V3.1.5 (custom)
Create a notification for this product.
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP Affected: V3.1.0 , < V3.1.5 (custom)
Create a notification for this product.
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP Affected: V3.1.0 , < V3.1.5 (custom)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-35807",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-12T15:25:51.499528Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-12T15:26:07.895Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T03:21:47.537Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/75cc31c2e7193b69f5d25650bda5bb42ed92f8a1"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/ee4e9c1976147a850f6085a13fca95bcaa00d84c"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/e8e8b197317228b5089ed9e7802dadf3ccaa027a"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/239c669edb2bffa1aa2612519b1d438ab35d6be6"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/fb1088d51bbaa0faec5a55d4f5818a9ab79e24df"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/37b6a3ba793bbbae057f5b991970ebcc52cb3db5"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/b461910af8ba3bed80f48c2bf852686d05c6fc5c"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/722d2c01b8b108f8283d1b7222209d5b2a5aa7bd"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/a6b3bfe176e8a5b05ec4447404e412c2a3fc92cc"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.1.5",
                "status": "affected",
                "version": "V3.1.0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.1.5",
                "status": "affected",
                "version": "V3.1.0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.1.5",
                "status": "affected",
                "version": "V3.1.0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.1.5",
                "status": "affected",
                "version": "V3.1.0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.1.5",
                "status": "affected",
                "version": "V3.1.0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-12T11:52:08.068Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-398330.html"
          },
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/ext4/resize.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "75cc31c2e7193b69f5d25650bda5bb42ed92f8a1",
              "status": "affected",
              "version": "01f795f9e0d67adeccc61a8b20c28acb45fa5fd8",
              "versionType": "git"
            },
            {
              "lessThan": "ee4e9c1976147a850f6085a13fca95bcaa00d84c",
              "status": "affected",
              "version": "01f795f9e0d67adeccc61a8b20c28acb45fa5fd8",
              "versionType": "git"
            },
            {
              "lessThan": "e8e8b197317228b5089ed9e7802dadf3ccaa027a",
              "status": "affected",
              "version": "01f795f9e0d67adeccc61a8b20c28acb45fa5fd8",
              "versionType": "git"
            },
            {
              "lessThan": "239c669edb2bffa1aa2612519b1d438ab35d6be6",
              "status": "affected",
              "version": "01f795f9e0d67adeccc61a8b20c28acb45fa5fd8",
              "versionType": "git"
            },
            {
              "lessThan": "fb1088d51bbaa0faec5a55d4f5818a9ab79e24df",
              "status": "affected",
              "version": "01f795f9e0d67adeccc61a8b20c28acb45fa5fd8",
              "versionType": "git"
            },
            {
              "lessThan": "37b6a3ba793bbbae057f5b991970ebcc52cb3db5",
              "status": "affected",
              "version": "01f795f9e0d67adeccc61a8b20c28acb45fa5fd8",
              "versionType": "git"
            },
            {
              "lessThan": "b461910af8ba3bed80f48c2bf852686d05c6fc5c",
              "status": "affected",
              "version": "01f795f9e0d67adeccc61a8b20c28acb45fa5fd8",
              "versionType": "git"
            },
            {
              "lessThan": "722d2c01b8b108f8283d1b7222209d5b2a5aa7bd",
              "status": "affected",
              "version": "01f795f9e0d67adeccc61a8b20c28acb45fa5fd8",
              "versionType": "git"
            },
            {
              "lessThan": "a6b3bfe176e8a5b05ec4447404e412c2a3fc92cc",
              "status": "affected",
              "version": "01f795f9e0d67adeccc61a8b20c28acb45fa5fd8",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/ext4/resize.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.7"
            },
            {
              "lessThan": "3.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.312",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.274",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.215",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.154",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.84",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.24",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.312",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.274",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.215",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.154",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.84",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.24",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.12",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.3",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix corruption during on-line resize\n\nWe observed a corruption during on-line resize of a file system that is\nlarger than 16 TiB with 4k block size. With having more then 2^32 blocks\nresize_inode is turned off by default by mke2fs. The issue can be\nreproduced on a smaller file system for convenience by explicitly\nturning off resize_inode. An on-line resize across an 8 GiB boundary (the\nsize of a meta block group in this setup) then leads to a corruption:\n\n  dev=/dev/\u003csome_dev\u003e # should be \u003e= 16 GiB\n  mkdir -p /corruption\n  /sbin/mke2fs -t ext4 -b 4096 -O ^resize_inode $dev $((2 * 2**21 - 2**15))\n  mount -t ext4 $dev /corruption\n\n  dd if=/dev/zero bs=4096 of=/corruption/test count=$((2*2**21 - 4*2**15))\n  sha1sum /corruption/test\n  # 79d2658b39dcfd77274e435b0934028adafaab11  /corruption/test\n\n  /sbin/resize2fs $dev $((2*2**21))\n  # drop page cache to force reload the block from disk\n  echo 1 \u003e /proc/sys/vm/drop_caches\n\n  sha1sum /corruption/test\n  # 3c2abc63cbf1a94c9e6977e0fbd72cd832c4d5c3  /corruption/test\n\n2^21 = 2^15*2^6 equals 8 GiB whereof 2^15 is the number of blocks per\nblock group and 2^6 are the number of block groups that make a meta\nblock group.\n\nThe last checksum might be different depending on how the file is laid\nout across the physical blocks. The actual corruption occurs at physical\nblock 63*2^15 = 2064384 which would be the location of the backup of the\nmeta block group\u0027s block descriptor. During the on-line resize the file\nsystem will be converted to meta_bg starting at s_first_meta_bg which is\n2 in the example - meaning all block groups after 16 GiB. However, in\next4_flex_group_add we might add block groups that are not part of the\nfirst meta block group yet. In the reproducer we achieved this by\nsubstracting the size of a whole block group from the point where the\nmeta block group would start. This must be considered when updating the\nbackup block group descriptors to follow the non-meta_bg layout. The fix\nis to add a test whether the group to add is already part of the meta\nblock group or not."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T20:11:24.344Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/75cc31c2e7193b69f5d25650bda5bb42ed92f8a1"
        },
        {
          "url": "https://git.kernel.org/stable/c/ee4e9c1976147a850f6085a13fca95bcaa00d84c"
        },
        {
          "url": "https://git.kernel.org/stable/c/e8e8b197317228b5089ed9e7802dadf3ccaa027a"
        },
        {
          "url": "https://git.kernel.org/stable/c/239c669edb2bffa1aa2612519b1d438ab35d6be6"
        },
        {
          "url": "https://git.kernel.org/stable/c/fb1088d51bbaa0faec5a55d4f5818a9ab79e24df"
        },
        {
          "url": "https://git.kernel.org/stable/c/37b6a3ba793bbbae057f5b991970ebcc52cb3db5"
        },
        {
          "url": "https://git.kernel.org/stable/c/b461910af8ba3bed80f48c2bf852686d05c6fc5c"
        },
        {
          "url": "https://git.kernel.org/stable/c/722d2c01b8b108f8283d1b7222209d5b2a5aa7bd"
        },
        {
          "url": "https://git.kernel.org/stable/c/a6b3bfe176e8a5b05ec4447404e412c2a3fc92cc"
        }
      ],
      "title": "ext4: fix corruption during on-line resize",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-35807",
    "datePublished": "2024-05-17T13:23:14.869Z",
    "dateReserved": "2024-05-17T12:19:12.342Z",
    "dateUpdated": "2026-05-12T11:52:08.068Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-35807",
      "date": "2026-06-12",
      "epss": "8e-05",
      "percentile": "0.00791"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\next4: fix corruption during on-line resize\\n\\nWe observed a corruption during on-line resize of a file system that is\\nlarger than 16 TiB with 4k block size. With having more then 2^32 blocks\\nresize_inode is turned off by default by mke2fs. The issue can be\\nreproduced on a smaller file system for convenience by explicitly\\nturning off resize_inode. An on-line resize across an 8 GiB boundary (the\\nsize of a meta block group in this setup) then leads to a corruption:\\n\\n  dev=/dev/\u003csome_dev\u003e # should be \u003e= 16 GiB\\n  mkdir -p /corruption\\n  /sbin/mke2fs -t ext4 -b 4096 -O ^resize_inode $dev $((2 * 2**21 - 2**15))\\n  mount -t ext4 $dev /corruption\\n\\n  dd if=/dev/zero bs=4096 of=/corruption/test count=$((2*2**21 - 4*2**15))\\n  sha1sum /corruption/test\\n  # 79d2658b39dcfd77274e435b0934028adafaab11  /corruption/test\\n\\n  /sbin/resize2fs $dev $((2*2**21))\\n  # drop page cache to force reload the block from disk\\n  echo 1 \u003e /proc/sys/vm/drop_caches\\n\\n  sha1sum /corruption/test\\n  # 3c2abc63cbf1a94c9e6977e0fbd72cd832c4d5c3  /corruption/test\\n\\n2^21 = 2^15*2^6 equals 8 GiB whereof 2^15 is the number of blocks per\\nblock group and 2^6 are the number of block groups that make a meta\\nblock group.\\n\\nThe last checksum might be different depending on how the file is laid\\nout across the physical blocks. The actual corruption occurs at physical\\nblock 63*2^15 = 2064384 which would be the location of the backup of the\\nmeta block group\u0027s block descriptor. During the on-line resize the file\\nsystem will be converted to meta_bg starting at s_first_meta_bg which is\\n2 in the example - meaning all block groups after 16 GiB. However, in\\next4_flex_group_add we might add block groups that are not part of the\\nfirst meta block group yet. In the reproducer we achieved this by\\nsubstracting the size of a whole block group from the point where the\\nmeta block group would start. This must be considered when updating the\\nbackup block group descriptors to follow the non-meta_bg layout. The fix\\nis to add a test whether the group to add is already part of the meta\\nblock group or not.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se resolvi\\u00f3 la siguiente vulnerabilidad: ext4: corregida la corrupci\\u00f3n durante el cambio de tama\\u00f1o en l\\u00ednea Observamos una corrupci\\u00f3n durante el cambio de tama\\u00f1o en l\\u00ednea de un sistema de archivos de m\\u00e1s de 16 TiB con un tama\\u00f1o de bloque de 4k. Al tener m\\u00e1s de 2 ^ 32 bloques, mke2fs desactiva resize_inode de forma predeterminada. El problema se puede reproducir en un sistema de archivos m\\u00e1s peque\\u00f1o por conveniencia desactivando expl\\u00edcitamente resize_inode. Un cambio de tama\\u00f1o en l\\u00ednea a trav\\u00e9s de un l\\u00edmite de 8 GiB (el tama\\u00f1o de un grupo de metabloques en esta configuraci\\u00f3n) conduce a una corrupci\\u00f3n: dev=/dev/ # deber\\u00eda ser \u0026gt;= 16 GiB mkdir -p /corruption /sbin/mke2fs -t ext4 -b 4096 -O ^resize_inode $dev $((2 * 2**21 - 2**15)) mount -t ext4 $dev /corruption dd if=/dev/zero bs=4096 of=/corruption/test count=$((2*2**21 - 4*2**15)) sha1sum /corruption/test # 79d2658b39dcfd77274e435b0934028adafaab11 /corruption/test /sbin/resize2fs $dev $((2*2**21)) # soltar cach\\u00e9 de p\\u00e1gina para forzar la recarga del bloque desde el disco echo 1 \u0026gt; /proc/sys/vm/drop_caches sha1sum /corruption/test # 3c2abc63cbf1a94c9e6977e0fbd72cd832c4d5c3 /corruption/test 2^21 = 2^15*2^6 equivale a 8 GiB de los cuales 2^15 es el n\\u00famero de bloques por grupo de bloques y 2^6 es el n\\u00famero de grupos de bloques que forman un metagrupo de bloques. La \\u00faltima suma de comprobaci\\u00f3n puede ser diferente dependiendo de c\\u00f3mo est\\u00e9 distribuido el archivo en los bloques f\\u00edsicos. La corrupci\\u00f3n real ocurre en el bloque f\\u00edsico 63*2^15 = 2064384, que ser\\u00eda la ubicaci\\u00f3n de la copia de seguridad del descriptor de bloque del grupo de metabloques. Durante el cambio de tama\\u00f1o en l\\u00ednea, el sistema de archivos se convertir\\u00e1 a meta_bg comenzando en s_first_meta_bg, que en el ejemplo es 2, es decir, todos los grupos de bloques despu\\u00e9s de 16 GiB. Sin embargo, en ext4_flex_group_add podr\\u00edamos agregar grupos de bloques que a\\u00fan no forman parte del primer metagrupo de bloques. En el reproductor logramos esto restando el tama\\u00f1o de un grupo de bloques completo desde el punto donde comenzar\\u00eda el grupo de metabloques. Esto debe tenerse en cuenta al actualizar los descriptores del grupo de bloques de respaldo para que sigan el dise\\u00f1o que no es meta_bg. La soluci\\u00f3n es agregar una prueba de si el grupo a agregar ya forma parte del grupo de metabloques o no.\"}]",
      "id": "CVE-2024-35807",
      "lastModified": "2024-11-21T09:20:56.490",
      "published": "2024-05-17T14:15:14.213",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/239c669edb2bffa1aa2612519b1d438ab35d6be6\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/37b6a3ba793bbbae057f5b991970ebcc52cb3db5\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/722d2c01b8b108f8283d1b7222209d5b2a5aa7bd\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/75cc31c2e7193b69f5d25650bda5bb42ed92f8a1\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/a6b3bfe176e8a5b05ec4447404e412c2a3fc92cc\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/b461910af8ba3bed80f48c2bf852686d05c6fc5c\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/e8e8b197317228b5089ed9e7802dadf3ccaa027a\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/ee4e9c1976147a850f6085a13fca95bcaa00d84c\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/fb1088d51bbaa0faec5a55d4f5818a9ab79e24df\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/239c669edb2bffa1aa2612519b1d438ab35d6be6\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/37b6a3ba793bbbae057f5b991970ebcc52cb3db5\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/722d2c01b8b108f8283d1b7222209d5b2a5aa7bd\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/75cc31c2e7193b69f5d25650bda5bb42ed92f8a1\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/a6b3bfe176e8a5b05ec4447404e412c2a3fc92cc\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/b461910af8ba3bed80f48c2bf852686d05c6fc5c\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/e8e8b197317228b5089ed9e7802dadf3ccaa027a\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/ee4e9c1976147a850f6085a13fca95bcaa00d84c\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/fb1088d51bbaa0faec5a55d4f5818a9ab79e24df\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-35807\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-17T14:15:14.213\",\"lastModified\":\"2026-05-12T12:16:36.587\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\next4: fix corruption during on-line resize\\n\\nWe observed a corruption during on-line resize of a file system that is\\nlarger than 16 TiB with 4k block size. With having more then 2^32 blocks\\nresize_inode is turned off by default by mke2fs. The issue can be\\nreproduced on a smaller file system for convenience by explicitly\\nturning off resize_inode. An on-line resize across an 8 GiB boundary (the\\nsize of a meta block group in this setup) then leads to a corruption:\\n\\n  dev=/dev/\u003csome_dev\u003e # should be \u003e= 16 GiB\\n  mkdir -p /corruption\\n  /sbin/mke2fs -t ext4 -b 4096 -O ^resize_inode $dev $((2 * 2**21 - 2**15))\\n  mount -t ext4 $dev /corruption\\n\\n  dd if=/dev/zero bs=4096 of=/corruption/test count=$((2*2**21 - 4*2**15))\\n  sha1sum /corruption/test\\n  # 79d2658b39dcfd77274e435b0934028adafaab11  /corruption/test\\n\\n  /sbin/resize2fs $dev $((2*2**21))\\n  # drop page cache to force reload the block from disk\\n  echo 1 \u003e /proc/sys/vm/drop_caches\\n\\n  sha1sum /corruption/test\\n  # 3c2abc63cbf1a94c9e6977e0fbd72cd832c4d5c3  /corruption/test\\n\\n2^21 = 2^15*2^6 equals 8 GiB whereof 2^15 is the number of blocks per\\nblock group and 2^6 are the number of block groups that make a meta\\nblock group.\\n\\nThe last checksum might be different depending on how the file is laid\\nout across the physical blocks. The actual corruption occurs at physical\\nblock 63*2^15 = 2064384 which would be the location of the backup of the\\nmeta block group\u0027s block descriptor. During the on-line resize the file\\nsystem will be converted to meta_bg starting at s_first_meta_bg which is\\n2 in the example - meaning all block groups after 16 GiB. However, in\\next4_flex_group_add we might add block groups that are not part of the\\nfirst meta block group yet. In the reproducer we achieved this by\\nsubstracting the size of a whole block group from the point where the\\nmeta block group would start. This must be considered when updating the\\nbackup block group descriptors to follow the non-meta_bg layout. The fix\\nis to add a test whether the group to add is already part of the meta\\nblock group or not.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: ext4: corregida la corrupci\u00f3n durante el cambio de tama\u00f1o en l\u00ednea Observamos una corrupci\u00f3n durante el cambio de tama\u00f1o en l\u00ednea de un sistema de archivos de m\u00e1s de 16 TiB con un tama\u00f1o de bloque de 4k. Al tener m\u00e1s de 2 ^ 32 bloques, mke2fs desactiva resize_inode de forma predeterminada. El problema se puede reproducir en un sistema de archivos m\u00e1s peque\u00f1o por conveniencia desactivando expl\u00edcitamente resize_inode. Un cambio de tama\u00f1o en l\u00ednea a trav\u00e9s de un l\u00edmite de 8 GiB (el tama\u00f1o de un grupo de metabloques en esta configuraci\u00f3n) conduce a una corrupci\u00f3n: dev=/dev/ # deber\u00eda ser \u0026gt;= 16 GiB mkdir -p /corruption /sbin/mke2fs -t ext4 -b 4096 -O ^resize_inode $dev $((2 * 2**21 - 2**15)) mount -t ext4 $dev /corruption dd if=/dev/zero bs=4096 of=/corruption/test count=$((2*2**21 - 4*2**15)) sha1sum /corruption/test # 79d2658b39dcfd77274e435b0934028adafaab11 /corruption/test /sbin/resize2fs $dev $((2*2**21)) # soltar cach\u00e9 de p\u00e1gina para forzar la recarga del bloque desde el disco echo 1 \u0026gt; /proc/sys/vm/drop_caches sha1sum /corruption/test # 3c2abc63cbf1a94c9e6977e0fbd72cd832c4d5c3 /corruption/test 2^21 = 2^15*2^6 equivale a 8 GiB de los cuales 2^15 es el n\u00famero de bloques por grupo de bloques y 2^6 es el n\u00famero de grupos de bloques que forman un metagrupo de bloques. La \u00faltima suma de comprobaci\u00f3n puede ser diferente dependiendo de c\u00f3mo est\u00e9 distribuido el archivo en los bloques f\u00edsicos. La corrupci\u00f3n real ocurre en el bloque f\u00edsico 63*2^15 = 2064384, que ser\u00eda la ubicaci\u00f3n de la copia de seguridad del descriptor de bloque del grupo de metabloques. Durante el cambio de tama\u00f1o en l\u00ednea, el sistema de archivos se convertir\u00e1 a meta_bg comenzando en s_first_meta_bg, que en el ejemplo es 2, es decir, todos los grupos de bloques despu\u00e9s de 16 GiB. Sin embargo, en ext4_flex_group_add podr\u00edamos agregar grupos de bloques que a\u00fan no forman parte del primer metagrupo de bloques. En el reproductor logramos esto restando el tama\u00f1o de un grupo de bloques completo desde el punto donde comenzar\u00eda el grupo de metabloques. Esto debe tenerse en cuenta al actualizar los descriptores del grupo de bloques de respaldo para que sigan el dise\u00f1o que no es meta_bg. La soluci\u00f3n es agregar una prueba de si el grupo a agregar ya forma parte del grupo de metabloques o no.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.7\",\"versionEndExcluding\":\"4.19.312\",\"matchCriteriaId\":\"48A978A1-082D-4FD8-B0A8-15D857F7935B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.20\",\"versionEndExcluding\":\"5.4.274\",\"matchCriteriaId\":\"F45A0F3C-C16D-49C4-86D6-D021C3D4B834\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.215\",\"matchCriteriaId\":\"9CD5894E-58E9-4B4A-B0F4-3E6BC134B8F5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.154\",\"matchCriteriaId\":\"577E212E-7E95-4A71-9B5C-F1D1A3AFFF46\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.84\",\"matchCriteriaId\":\"834D9BD5-42A6-4D74-979E-4D6D93F630FD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.24\",\"matchCriteriaId\":\"8018C1D0-0A5F-48D0-BC72-A2B33FDDA693\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.7.12\",\"matchCriteriaId\":\"6BE9771A-BAFD-4624-95F9-58D536540C53\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.8\",\"versionEndExcluding\":\"6.8.3\",\"matchCriteriaId\":\"4C59BBC3-6495-4A77-9C82-55EC7CDF5E02\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"07B237A9-69A3-4A9C-9DA0-4E06BD37AE73\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/239c669edb2bffa1aa2612519b1d438ab35d6be6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/37b6a3ba793bbbae057f5b991970ebcc52cb3db5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/722d2c01b8b108f8283d1b7222209d5b2a5aa7bd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/75cc31c2e7193b69f5d25650bda5bb42ed92f8a1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a6b3bfe176e8a5b05ec4447404e412c2a3fc92cc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b461910af8ba3bed80f48c2bf852686d05c6fc5c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e8e8b197317228b5089ed9e7802dadf3ccaa027a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ee4e9c1976147a850f6085a13fca95bcaa00d84c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/fb1088d51bbaa0faec5a55d4f5818a9ab79e24df\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/239c669edb2bffa1aa2612519b1d438ab35d6be6\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/37b6a3ba793bbbae057f5b991970ebcc52cb3db5\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/722d2c01b8b108f8283d1b7222209d5b2a5aa7bd\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/75cc31c2e7193b69f5d25650bda5bb42ed92f8a1\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a6b3bfe176e8a5b05ec4447404e412c2a3fc92cc\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b461910af8ba3bed80f48c2bf852686d05c6fc5c\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e8e8b197317228b5089ed9e7802dadf3ccaa027a\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ee4e9c1976147a850f6085a13fca95bcaa00d84c\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/fb1088d51bbaa0faec5a55d4f5818a9ab79e24df\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://cert-portal.siemens.com/productcert/html/ssa-265688.html\",\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\"},{\"url\":\"https://cert-portal.siemens.com/productcert/html/ssa-398330.html\",\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/75cc31c2e7193b69f5d25650bda5bb42ed92f8a1\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/ee4e9c1976147a850f6085a13fca95bcaa00d84c\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/e8e8b197317228b5089ed9e7802dadf3ccaa027a\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/239c669edb2bffa1aa2612519b1d438ab35d6be6\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/fb1088d51bbaa0faec5a55d4f5818a9ab79e24df\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/37b6a3ba793bbbae057f5b991970ebcc52cb3db5\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/b461910af8ba3bed80f48c2bf852686d05c6fc5c\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/722d2c01b8b108f8283d1b7222209d5b2a5aa7bd\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/a6b3bfe176e8a5b05ec4447404e412c2a3fc92cc\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T03:21:47.537Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-35807\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-06-12T15:25:51.499528Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-06-12T15:26:04.379Z\"}}], \"cna\": {\"title\": \"ext4: fix corruption during on-line resize\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"01f795f9e0d67adeccc61a8b20c28acb45fa5fd8\", \"lessThan\": \"75cc31c2e7193b69f5d25650bda5bb42ed92f8a1\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"01f795f9e0d67adeccc61a8b20c28acb45fa5fd8\", \"lessThan\": \"ee4e9c1976147a850f6085a13fca95bcaa00d84c\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"01f795f9e0d67adeccc61a8b20c28acb45fa5fd8\", \"lessThan\": \"e8e8b197317228b5089ed9e7802dadf3ccaa027a\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"01f795f9e0d67adeccc61a8b20c28acb45fa5fd8\", \"lessThan\": \"239c669edb2bffa1aa2612519b1d438ab35d6be6\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"01f795f9e0d67adeccc61a8b20c28acb45fa5fd8\", \"lessThan\": \"fb1088d51bbaa0faec5a55d4f5818a9ab79e24df\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"01f795f9e0d67adeccc61a8b20c28acb45fa5fd8\", \"lessThan\": \"37b6a3ba793bbbae057f5b991970ebcc52cb3db5\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"01f795f9e0d67adeccc61a8b20c28acb45fa5fd8\", \"lessThan\": \"b461910af8ba3bed80f48c2bf852686d05c6fc5c\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"01f795f9e0d67adeccc61a8b20c28acb45fa5fd8\", \"lessThan\": \"722d2c01b8b108f8283d1b7222209d5b2a5aa7bd\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"01f795f9e0d67adeccc61a8b20c28acb45fa5fd8\", \"lessThan\": \"a6b3bfe176e8a5b05ec4447404e412c2a3fc92cc\", \"versionType\": \"git\"}], \"programFiles\": [\"fs/ext4/resize.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"3.7\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"3.7\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"4.19.312\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.19.*\"}, {\"status\": \"unaffected\", \"version\": \"5.4.274\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.215\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.154\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.84\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.24\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.7.12\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.7.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8.3\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.8.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"fs/ext4/resize.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/75cc31c2e7193b69f5d25650bda5bb42ed92f8a1\"}, {\"url\": \"https://git.kernel.org/stable/c/ee4e9c1976147a850f6085a13fca95bcaa00d84c\"}, {\"url\": \"https://git.kernel.org/stable/c/e8e8b197317228b5089ed9e7802dadf3ccaa027a\"}, {\"url\": \"https://git.kernel.org/stable/c/239c669edb2bffa1aa2612519b1d438ab35d6be6\"}, {\"url\": \"https://git.kernel.org/stable/c/fb1088d51bbaa0faec5a55d4f5818a9ab79e24df\"}, {\"url\": \"https://git.kernel.org/stable/c/37b6a3ba793bbbae057f5b991970ebcc52cb3db5\"}, {\"url\": \"https://git.kernel.org/stable/c/b461910af8ba3bed80f48c2bf852686d05c6fc5c\"}, {\"url\": \"https://git.kernel.org/stable/c/722d2c01b8b108f8283d1b7222209d5b2a5aa7bd\"}, {\"url\": \"https://git.kernel.org/stable/c/a6b3bfe176e8a5b05ec4447404e412c2a3fc92cc\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\next4: fix corruption during on-line resize\\n\\nWe observed a corruption during on-line resize of a file system that is\\nlarger than 16 TiB with 4k block size. With having more then 2^32 blocks\\nresize_inode is turned off by default by mke2fs. The issue can be\\nreproduced on a smaller file system for convenience by explicitly\\nturning off resize_inode. An on-line resize across an 8 GiB boundary (the\\nsize of a meta block group in this setup) then leads to a corruption:\\n\\n  dev=/dev/\u003csome_dev\u003e # should be \u003e= 16 GiB\\n  mkdir -p /corruption\\n  /sbin/mke2fs -t ext4 -b 4096 -O ^resize_inode $dev $((2 * 2**21 - 2**15))\\n  mount -t ext4 $dev /corruption\\n\\n  dd if=/dev/zero bs=4096 of=/corruption/test count=$((2*2**21 - 4*2**15))\\n  sha1sum /corruption/test\\n  # 79d2658b39dcfd77274e435b0934028adafaab11  /corruption/test\\n\\n  /sbin/resize2fs $dev $((2*2**21))\\n  # drop page cache to force reload the block from disk\\n  echo 1 \u003e /proc/sys/vm/drop_caches\\n\\n  sha1sum /corruption/test\\n  # 3c2abc63cbf1a94c9e6977e0fbd72cd832c4d5c3  /corruption/test\\n\\n2^21 = 2^15*2^6 equals 8 GiB whereof 2^15 is the number of blocks per\\nblock group and 2^6 are the number of block groups that make a meta\\nblock group.\\n\\nThe last checksum might be different depending on how the file is laid\\nout across the physical blocks. The actual corruption occurs at physical\\nblock 63*2^15 = 2064384 which would be the location of the backup of the\\nmeta block group\u0027s block descriptor. During the on-line resize the file\\nsystem will be converted to meta_bg starting at s_first_meta_bg which is\\n2 in the example - meaning all block groups after 16 GiB. However, in\\next4_flex_group_add we might add block groups that are not part of the\\nfirst meta block group yet. In the reproducer we achieved this by\\nsubstracting the size of a whole block group from the point where the\\nmeta block group would start. This must be considered when updating the\\nbackup block group descriptors to follow the non-meta_bg layout. The fix\\nis to add a test whether the group to add is already part of the meta\\nblock group or not.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.19.312\", \"versionStartIncluding\": \"3.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.274\", \"versionStartIncluding\": \"3.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.215\", \"versionStartIncluding\": \"3.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.154\", \"versionStartIncluding\": \"3.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.84\", \"versionStartIncluding\": \"3.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.24\", \"versionStartIncluding\": \"3.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.7.12\", \"versionStartIncluding\": \"3.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8.3\", \"versionStartIncluding\": \"3.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9\", \"versionStartIncluding\": \"3.7\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2025-05-04T09:05:50.120Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-35807\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-05-04T09:05:50.120Z\", \"dateReserved\": \"2024-05-17T12:19:12.342Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-05-17T13:23:14.869Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.