CVE-2024-45003 (GCVE-0-2024-45003)

Vulnerability from cvelistv5 – Published: 2024-09-04 19:54 – Updated: 2026-05-11 20:33
VLAI
Title
vfs: Don't evict inode under the inode lru traversing context
Summary
In the Linux kernel, the following vulnerability has been resolved: vfs: Don't evict inode under the inode lru traversing context The inode reclaiming process(See function prune_icache_sb) collects all reclaimable inodes and mark them with I_FREEING flag at first, at that time, other processes will be stuck if they try getting these inodes (See function find_inode_fast), then the reclaiming process destroy the inodes by function dispose_list(). Some filesystems(eg. ext4 with ea_inode feature, ubifs with xattr) may do inode lookup in the inode evicting callback function, if the inode lookup is operated under the inode lru traversing context, deadlock problems may happen. Case 1: In function ext4_evict_inode(), the ea inode lookup could happen if ea_inode feature is enabled, the lookup process will be stuck under the evicting context like this: 1. File A has inode i_reg and an ea inode i_ea 2. getfattr(A, xattr_buf) // i_ea is added into lru // lru->i_ea 3. Then, following three processes running like this: PA PB echo 2 > /proc/sys/vm/drop_caches shrink_slab prune_dcache_sb // i_reg is added into lru, lru->i_ea->i_reg prune_icache_sb list_lru_walk_one inode_lru_isolate i_ea->i_state |= I_FREEING // set inode state inode_lru_isolate __iget(i_reg) spin_unlock(&i_reg->i_lock) spin_unlock(lru_lock) rm file A i_reg->nlink = 0 iput(i_reg) // i_reg->nlink is 0, do evict ext4_evict_inode ext4_xattr_delete_inode ext4_xattr_inode_dec_ref_all ext4_xattr_inode_iget ext4_iget(i_ea->i_ino) iget_locked find_inode_fast __wait_on_freeing_inode(i_ea) ----→ AA deadlock dispose_list // cannot be executed by prune_icache_sb wake_up_bit(&i_ea->i_state) Case 2: In deleted inode writing function ubifs_jnl_write_inode(), file deleting process holds BASEHD's wbuf->io_mutex while getting the xattr inode, which could race with inode reclaiming process(The reclaiming process could try locking BASEHD's wbuf->io_mutex in inode evicting function), then an ABBA deadlock problem would happen as following: 1. File A has inode ia and a xattr(with inode ixa), regular file B has inode ib and a xattr. 2. getfattr(A, xattr_buf) // ixa is added into lru // lru->ixa 3. Then, following three processes running like this: PA PB PC echo 2 > /proc/sys/vm/drop_caches shrink_slab prune_dcache_sb // ib and ia are added into lru, lru->ixa->ib->ia prune_icache_sb list_lru_walk_one inode_lru_isolate ixa->i_state |= I_FREEING // set inode state inode_lru_isolate __iget(ib) spin_unlock(&ib->i_lock) spin_unlock(lru_lock) rm file B ib->nlink = 0 rm file A iput(ia) ubifs_evict_inode(ia) ubifs_jnl_delete_inode(ia) ubifs_jnl_write_inode(ia) make_reservation(BASEHD) // Lock wbuf->io_mutex ubifs_iget(ixa->i_ino) iget_locked find_inode_fast __wait_on_freeing_inode(ixa) | iput(ib) // ib->nlink is 0, do evict | ubifs_evict_inode | ubifs_jnl_delete_inode(ib) ↓ ubifs_jnl_write_inode ABBA deadlock ←-----make_reservation(BASEHD) dispose_list // cannot be executed by prune_icache_sb wake_up_bit(&ixa->i_state) Fix the possible deadlock by using new inode state flag I_LRU_ISOLATING to pin the inode in memory while inode_lru_isolate( ---truncated---
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: e50e5129f384ae282adebfb561189cdb19b81cee , < 3525ad25240dfdd8c78f3470911ed10aa727aa72 (git)
Affected: e50e5129f384ae282adebfb561189cdb19b81cee , < 03880af02a78bc9a98b5a581f529cf709c88a9b8 (git)
Affected: e50e5129f384ae282adebfb561189cdb19b81cee , < cda54ec82c0f9d05393242b20b13f69b083f7e88 (git)
Affected: e50e5129f384ae282adebfb561189cdb19b81cee , < 437741eba63bf4e437e2beb5583f8633556a2b98 (git)
Affected: e50e5129f384ae282adebfb561189cdb19b81cee , < b9bda5f6012dd00372f3a06a82ed8971a4c57c32 (git)
Affected: e50e5129f384ae282adebfb561189cdb19b81cee , < 9063ab49c11e9518a3f2352434bb276cc8134c5f (git)
Affected: e50e5129f384ae282adebfb561189cdb19b81cee , < 2a0629834cd82f05d424bbc193374f9a43d1f87d (git)
Create a notification for this product.
Linux Linux Affected: 4.13
Unaffected: 0 , < 4.13 (semver)
Unaffected: 5.4.283 , ≤ 5.4.* (semver)
Unaffected: 5.10.225 , ≤ 5.10.* (semver)
Unaffected: 5.15.166 , ≤ 5.15.* (semver)
Unaffected: 6.1.107 , ≤ 6.1.* (semver)
Unaffected: 6.6.48 , ≤ 6.6.* (semver)
Unaffected: 6.10.7 , ≤ 6.10.* (semver)
Unaffected: 6.11 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-45003",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-04T20:18:27.700271Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-04T20:18:52.460Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:15:06.309Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2024/10/msg00003.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/inode.c",
            "include/linux/fs.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3525ad25240dfdd8c78f3470911ed10aa727aa72",
              "status": "affected",
              "version": "e50e5129f384ae282adebfb561189cdb19b81cee",
              "versionType": "git"
            },
            {
              "lessThan": "03880af02a78bc9a98b5a581f529cf709c88a9b8",
              "status": "affected",
              "version": "e50e5129f384ae282adebfb561189cdb19b81cee",
              "versionType": "git"
            },
            {
              "lessThan": "cda54ec82c0f9d05393242b20b13f69b083f7e88",
              "status": "affected",
              "version": "e50e5129f384ae282adebfb561189cdb19b81cee",
              "versionType": "git"
            },
            {
              "lessThan": "437741eba63bf4e437e2beb5583f8633556a2b98",
              "status": "affected",
              "version": "e50e5129f384ae282adebfb561189cdb19b81cee",
              "versionType": "git"
            },
            {
              "lessThan": "b9bda5f6012dd00372f3a06a82ed8971a4c57c32",
              "status": "affected",
              "version": "e50e5129f384ae282adebfb561189cdb19b81cee",
              "versionType": "git"
            },
            {
              "lessThan": "9063ab49c11e9518a3f2352434bb276cc8134c5f",
              "status": "affected",
              "version": "e50e5129f384ae282adebfb561189cdb19b81cee",
              "versionType": "git"
            },
            {
              "lessThan": "2a0629834cd82f05d424bbc193374f9a43d1f87d",
              "status": "affected",
              "version": "e50e5129f384ae282adebfb561189cdb19b81cee",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/inode.c",
            "include/linux/fs.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.13"
            },
            {
              "lessThan": "4.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.283",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.225",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.166",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.107",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.48",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.11",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.283",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.225",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.166",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.107",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.48",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.7",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvfs: Don\u0027t evict inode under the inode lru traversing context\n\nThe inode reclaiming process(See function prune_icache_sb) collects all\nreclaimable inodes and mark them with I_FREEING flag at first, at that\ntime, other processes will be stuck if they try getting these inodes\n(See function find_inode_fast), then the reclaiming process destroy the\ninodes by function dispose_list(). Some filesystems(eg. ext4 with\nea_inode feature, ubifs with xattr) may do inode lookup in the inode\nevicting callback function, if the inode lookup is operated under the\ninode lru traversing context, deadlock problems may happen.\n\nCase 1: In function ext4_evict_inode(), the ea inode lookup could happen\n        if ea_inode feature is enabled, the lookup process will be stuck\n\tunder the evicting context like this:\n\n 1. File A has inode i_reg and an ea inode i_ea\n 2. getfattr(A, xattr_buf) // i_ea is added into lru // lru-\u003ei_ea\n 3. Then, following three processes running like this:\n\n    PA                              PB\n echo 2 \u003e /proc/sys/vm/drop_caches\n  shrink_slab\n   prune_dcache_sb\n   // i_reg is added into lru, lru-\u003ei_ea-\u003ei_reg\n   prune_icache_sb\n    list_lru_walk_one\n     inode_lru_isolate\n      i_ea-\u003ei_state |= I_FREEING // set inode state\n     inode_lru_isolate\n      __iget(i_reg)\n      spin_unlock(\u0026i_reg-\u003ei_lock)\n      spin_unlock(lru_lock)\n                                     rm file A\n                                      i_reg-\u003enlink = 0\n      iput(i_reg) // i_reg-\u003enlink is 0, do evict\n       ext4_evict_inode\n        ext4_xattr_delete_inode\n         ext4_xattr_inode_dec_ref_all\n          ext4_xattr_inode_iget\n           ext4_iget(i_ea-\u003ei_ino)\n            iget_locked\n             find_inode_fast\n              __wait_on_freeing_inode(i_ea) ----\u2192 AA deadlock\n    dispose_list // cannot be executed by prune_icache_sb\n     wake_up_bit(\u0026i_ea-\u003ei_state)\n\nCase 2: In deleted inode writing function ubifs_jnl_write_inode(), file\n        deleting process holds BASEHD\u0027s wbuf-\u003eio_mutex while getting the\n\txattr inode, which could race with inode reclaiming process(The\n        reclaiming process could try locking BASEHD\u0027s wbuf-\u003eio_mutex in\n\tinode evicting function), then an ABBA deadlock problem would\n\thappen as following:\n\n 1. File A has inode ia and a xattr(with inode ixa), regular file B has\n    inode ib and a xattr.\n 2. getfattr(A, xattr_buf) // ixa is added into lru // lru-\u003eixa\n 3. Then, following three processes running like this:\n\n        PA                PB                        PC\n                echo 2 \u003e /proc/sys/vm/drop_caches\n                 shrink_slab\n                  prune_dcache_sb\n                  // ib and ia are added into lru, lru-\u003eixa-\u003eib-\u003eia\n                  prune_icache_sb\n                   list_lru_walk_one\n                    inode_lru_isolate\n                     ixa-\u003ei_state |= I_FREEING // set inode state\n                    inode_lru_isolate\n                     __iget(ib)\n                     spin_unlock(\u0026ib-\u003ei_lock)\n                     spin_unlock(lru_lock)\n                                                   rm file B\n                                                    ib-\u003enlink = 0\n rm file A\n  iput(ia)\n   ubifs_evict_inode(ia)\n    ubifs_jnl_delete_inode(ia)\n     ubifs_jnl_write_inode(ia)\n      make_reservation(BASEHD) // Lock wbuf-\u003eio_mutex\n      ubifs_iget(ixa-\u003ei_ino)\n       iget_locked\n        find_inode_fast\n         __wait_on_freeing_inode(ixa)\n          |          iput(ib) // ib-\u003enlink is 0, do evict\n          |           ubifs_evict_inode\n          |            ubifs_jnl_delete_inode(ib)\n          \u2193             ubifs_jnl_write_inode\n     ABBA deadlock \u2190-----make_reservation(BASEHD)\n                   dispose_list // cannot be executed by prune_icache_sb\n                    wake_up_bit(\u0026ixa-\u003ei_state)\n\nFix the possible deadlock by using new inode state flag I_LRU_ISOLATING\nto pin the inode in memory while inode_lru_isolate(\n---truncated---"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T20:33:34.796Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3525ad25240dfdd8c78f3470911ed10aa727aa72"
        },
        {
          "url": "https://git.kernel.org/stable/c/03880af02a78bc9a98b5a581f529cf709c88a9b8"
        },
        {
          "url": "https://git.kernel.org/stable/c/cda54ec82c0f9d05393242b20b13f69b083f7e88"
        },
        {
          "url": "https://git.kernel.org/stable/c/437741eba63bf4e437e2beb5583f8633556a2b98"
        },
        {
          "url": "https://git.kernel.org/stable/c/b9bda5f6012dd00372f3a06a82ed8971a4c57c32"
        },
        {
          "url": "https://git.kernel.org/stable/c/9063ab49c11e9518a3f2352434bb276cc8134c5f"
        },
        {
          "url": "https://git.kernel.org/stable/c/2a0629834cd82f05d424bbc193374f9a43d1f87d"
        }
      ],
      "title": "vfs: Don\u0027t evict inode under the inode lru traversing context",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-45003",
    "datePublished": "2024-09-04T19:54:46.276Z",
    "dateReserved": "2024-08-21T05:34:56.678Z",
    "dateUpdated": "2026-05-11T20:33:34.796Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-45003",
      "date": "2026-05-26",
      "epss": "0.00014",
      "percentile": "0.0269"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"4.13\", \"versionEndExcluding\": \"5.4.283\", \"matchCriteriaId\": \"233C3D30-5FAC-4A42-AEF4-308BEE3563D3\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.5\", \"versionEndExcluding\": \"5.10.225\", \"matchCriteriaId\": \"C57B46A9-B105-4792-8481-1870DEFB436A\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.11\", \"versionEndExcluding\": \"5.15.166\", \"matchCriteriaId\": \"913ED6CD-8ACF-48AF-AA18-7880881DD402\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.16\", \"versionEndExcluding\": \"6.1.107\", \"matchCriteriaId\": \"53954FF8-CB48-4302-BC4C-9DA7A88F44A2\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.2\", \"versionEndExcluding\": \"6.6.48\", \"matchCriteriaId\": \"9DE9201A-CE6B-4726-BABB-8265EA0F8AE4\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.7\", \"versionEndExcluding\": \"6.10.7\", \"matchCriteriaId\": \"D2AFDFD1-D95A-4EB7-843B-5E7659518B67\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.11:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"8B3CE743-2126-47A3-8B7C-822B502CF119\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.11:rc2:*:*:*:*:*:*\", \"matchCriteriaId\": \"4DEB27E7-30AA-45CC-8934-B89263EF3551\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.11:rc3:*:*:*:*:*:*\", \"matchCriteriaId\": \"E0005AEF-856E-47EB-BFE4-90C46899394D\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nvfs: Don\u0027t evict inode under the inode lru traversing context\\n\\nThe inode reclaiming process(See function prune_icache_sb) collects all\\nreclaimable inodes and mark them with I_FREEING flag at first, at that\\ntime, other processes will be stuck if they try getting these inodes\\n(See function find_inode_fast), then the reclaiming process destroy the\\ninodes by function dispose_list(). Some filesystems(eg. ext4 with\\nea_inode feature, ubifs with xattr) may do inode lookup in the inode\\nevicting callback function, if the inode lookup is operated under the\\ninode lru traversing context, deadlock problems may happen.\\n\\nCase 1: In function ext4_evict_inode(), the ea inode lookup could happen\\n        if ea_inode feature is enabled, the lookup process will be stuck\\n\\tunder the evicting context like this:\\n\\n 1. File A has inode i_reg and an ea inode i_ea\\n 2. getfattr(A, xattr_buf) // i_ea is added into lru // lru-\u003ei_ea\\n 3. Then, following three processes running like this:\\n\\n    PA                              PB\\n echo 2 \u003e /proc/sys/vm/drop_caches\\n  shrink_slab\\n   prune_dcache_sb\\n   // i_reg is added into lru, lru-\u003ei_ea-\u003ei_reg\\n   prune_icache_sb\\n    list_lru_walk_one\\n     inode_lru_isolate\\n      i_ea-\u003ei_state |= I_FREEING // set inode state\\n     inode_lru_isolate\\n      __iget(i_reg)\\n      spin_unlock(\u0026i_reg-\u003ei_lock)\\n      spin_unlock(lru_lock)\\n                                     rm file A\\n                                      i_reg-\u003enlink = 0\\n      iput(i_reg) // i_reg-\u003enlink is 0, do evict\\n       ext4_evict_inode\\n        ext4_xattr_delete_inode\\n         ext4_xattr_inode_dec_ref_all\\n          ext4_xattr_inode_iget\\n           ext4_iget(i_ea-\u003ei_ino)\\n            iget_locked\\n             find_inode_fast\\n              __wait_on_freeing_inode(i_ea) ----\\u2192 AA deadlock\\n    dispose_list // cannot be executed by prune_icache_sb\\n     wake_up_bit(\u0026i_ea-\u003ei_state)\\n\\nCase 2: In deleted inode writing function ubifs_jnl_write_inode(), file\\n        deleting process holds BASEHD\u0027s wbuf-\u003eio_mutex while getting the\\n\\txattr inode, which could race with inode reclaiming process(The\\n        reclaiming process could try locking BASEHD\u0027s wbuf-\u003eio_mutex in\\n\\tinode evicting function), then an ABBA deadlock problem would\\n\\thappen as following:\\n\\n 1. File A has inode ia and a xattr(with inode ixa), regular file B has\\n    inode ib and a xattr.\\n 2. getfattr(A, xattr_buf) // ixa is added into lru // lru-\u003eixa\\n 3. Then, following three processes running like this:\\n\\n        PA                PB                        PC\\n                echo 2 \u003e /proc/sys/vm/drop_caches\\n                 shrink_slab\\n                  prune_dcache_sb\\n                  // ib and ia are added into lru, lru-\u003eixa-\u003eib-\u003eia\\n                  prune_icache_sb\\n                   list_lru_walk_one\\n                    inode_lru_isolate\\n                     ixa-\u003ei_state |= I_FREEING // set inode state\\n                    inode_lru_isolate\\n                     __iget(ib)\\n                     spin_unlock(\u0026ib-\u003ei_lock)\\n                     spin_unlock(lru_lock)\\n                                                   rm file B\\n                                                    ib-\u003enlink = 0\\n rm file A\\n  iput(ia)\\n   ubifs_evict_inode(ia)\\n    ubifs_jnl_delete_inode(ia)\\n     ubifs_jnl_write_inode(ia)\\n      make_reservation(BASEHD) // Lock wbuf-\u003eio_mutex\\n      ubifs_iget(ixa-\u003ei_ino)\\n       iget_locked\\n        find_inode_fast\\n         __wait_on_freeing_inode(ixa)\\n          |          iput(ib) // ib-\u003enlink is 0, do evict\\n          |           ubifs_evict_inode\\n          |            ubifs_jnl_delete_inode(ib)\\n          \\u2193             ubifs_jnl_write_inode\\n     ABBA deadlock \\u2190-----make_reservation(BASEHD)\\n                   dispose_list // cannot be executed by prune_icache_sb\\n                    wake_up_bit(\u0026ixa-\u003ei_state)\\n\\nFix the possible deadlock by using new inode state flag I_LRU_ISOLATING\\nto pin the inode in memory while inode_lru_isolate(\\n---truncated---\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: vfs: No desalojar inodo bajo el contexto de recorrido lru de inodo El proceso de recuperaci\\u00f3n de inodo (ver funci\\u00f3n prune_icache_sb) recopila todos los inodos recuperables y los marca con el indicador I_FREEING al principio, en ese momento, otros procesos se atascar\\u00e1n si intentan obtener estos inodos (ver funci\\u00f3n find_inode_fast), luego el proceso de recuperaci\\u00f3n destruye los inodos mediante la funci\\u00f3n dispose_list(). Algunos sistemas de archivos (por ejemplo, ext4 con la funci\\u00f3n ea_inode, ubifs con xattr) pueden realizar una b\\u00fasqueda de inodo en la funci\\u00f3n de devoluci\\u00f3n de llamada de expulsi\\u00f3n de inodo, si la b\\u00fasqueda de inodo se opera bajo el contexto de recorrido lru de inodo, pueden ocurrir problemas de interbloqueo. Caso 1: En la funci\\u00f3n ext4_evict_inode(), la b\\u00fasqueda de inodo ea podr\\u00eda ocurrir si la caracter\\u00edstica ea_inode est\\u00e1 habilitada, el proceso de b\\u00fasqueda se quedar\\u00e1 atascado bajo el contexto de desalojo de esta manera: 1. El archivo A tiene un inodo i_reg y un inodo ea i_ea 2. getfattr(A, xattr_buf) // i_ea se agrega a lru // lru-\u0026gt;i_ea 3. Luego, los siguientes tres procesos se ejecutan de esta manera: PA PB echo 2 \u0026gt; /proc/sys/vm/drop_caches shrink_slab prune_dcache_sb // i_reg se agrega a lru, lru-\u0026gt;i_ea-\u0026gt;i_reg prune_icache_sb list_lru_walk_one inode_lru_isolate i_ea-\u0026gt;i_state |= I_FREEING // establece el estado del inodo inode_lru_isolate __iget(i_reg) spin_unlock(\u0026amp;i_reg-\u0026gt;i_lock) spin_unlock(lru_lock) rm archivo A i_reg-\u0026gt;nlink = 0 iput(i_reg) // i_reg-\u0026gt;nlink es 0, desalojar ext4_evict_inode ext4_xattr_delete_inode ext4_xattr_inode_dec_ref_all ext4_xattr_inode_iget ext4_iget(i_ea-\u0026gt;i_ino) iget_locked find_inode_fast __wait_on_freeing_inode(i_ea) ----? Bloqueo AA dispose_list // no puede ser ejecutado por prune_icache_sb wake_up_bit(\u0026amp;i_ea-\u0026gt;i_state) Caso 2: En la funci\\u00f3n de escritura de inodo eliminado ubifs_jnl_write_inode(), el proceso de eliminaci\\u00f3n de archivo retiene BASEHD wbuf-\u0026gt;io_mutex mientras obtiene el inodo xattr, que podr\\u00eda competir con el proceso de recuperaci\\u00f3n de inodo (el proceso de recuperaci\\u00f3n podr\\u00eda intentar bloquear wbuf-\u0026gt;io_mutex de BASEHD en la funci\\u00f3n de desalojo de inodo), entonces ocurrir\\u00eda un problema de bloqueo ABBA de la siguiente manera: 1. El archivo A tiene un inodo ia y un xattr (con un inodo ixa), el archivo B normal tiene un inodo ib y un xattr. 2. getfattr(A, xattr_buf) // ixa se agrega a lru // lru-\u0026gt;ixa 3. Luego, los siguientes tres procesos se ejecutan de esta manera: PA PB PC echo 2 \u0026gt; /proc/sys/vm/drop_caches shrink_slab prune_dcache_sb // ib e ia se agregan a lru, lru-\u0026gt;ixa-\u0026gt;ib-\u0026gt;ia prune_icache_sb list_lru_walk_one inode_lru_isolate ixa-\u0026gt;i_state |= I_FREEING // establece el estado del inodo inode_lru_isolate __iget(ib) spin_unlock(\u0026amp;ib-\u0026gt;i_lock) spin_unlock(lru_lock) rm archivo B ib-\u0026gt;nlink = 0 rm archivo A iput(ia) ubifs_evict_inode(ia) ubifs_jnl_delete_inode(ia) ubifs_jnl_write_inode(ia) make_reservation(BASEHD) // Bloquear wbuf-\u0026gt;io_mutex ubifs_iget(ixa-\u0026gt;i_ino) iget_locked find_inode_fast __wait_on_freeing_inode(ixa) | iput(ib) // ib-\u0026gt;nlink es 0, desalojar | ubifs_evict_inode | ubifs_jnl_delete_inode(ib) ? ubifs_jnl_write_inode Bloqueo ABBA ?-----make_reservation(BASEHD) dispose_list // no puede ser ejecutado por prune_icache_sb wake_up_bit(\u0026amp;ixa-\u0026gt;i_state) Corrija el posible bloqueo utilizando el nuevo indicador de estado de inodo I_LRU_ISOLATING para fijar el inodo en la memoria mientras inode_lru_isolate( ---truncado---\"}]",
      "id": "CVE-2024-45003",
      "lastModified": "2024-11-05T10:19:21.327",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 4.7, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.0, \"impactScore\": 3.6}]}",
      "published": "2024-09-04T20:15:08.823",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/03880af02a78bc9a98b5a581f529cf709c88a9b8\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/2a0629834cd82f05d424bbc193374f9a43d1f87d\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/3525ad25240dfdd8c78f3470911ed10aa727aa72\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/437741eba63bf4e437e2beb5583f8633556a2b98\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/9063ab49c11e9518a3f2352434bb276cc8134c5f\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/b9bda5f6012dd00372f3a06a82ed8971a4c57c32\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/cda54ec82c0f9d05393242b20b13f69b083f7e88\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-667\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-45003\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-09-04T20:15:08.823\",\"lastModified\":\"2025-11-03T23:15:48.460\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nvfs: Don\u0027t evict inode under the inode lru traversing context\\n\\nThe inode reclaiming process(See function prune_icache_sb) collects all\\nreclaimable inodes and mark them with I_FREEING flag at first, at that\\ntime, other processes will be stuck if they try getting these inodes\\n(See function find_inode_fast), then the reclaiming process destroy the\\ninodes by function dispose_list(). Some filesystems(eg. ext4 with\\nea_inode feature, ubifs with xattr) may do inode lookup in the inode\\nevicting callback function, if the inode lookup is operated under the\\ninode lru traversing context, deadlock problems may happen.\\n\\nCase 1: In function ext4_evict_inode(), the ea inode lookup could happen\\n        if ea_inode feature is enabled, the lookup process will be stuck\\n\\tunder the evicting context like this:\\n\\n 1. File A has inode i_reg and an ea inode i_ea\\n 2. getfattr(A, xattr_buf) // i_ea is added into lru // lru-\u003ei_ea\\n 3. Then, following three processes running like this:\\n\\n    PA                              PB\\n echo 2 \u003e /proc/sys/vm/drop_caches\\n  shrink_slab\\n   prune_dcache_sb\\n   // i_reg is added into lru, lru-\u003ei_ea-\u003ei_reg\\n   prune_icache_sb\\n    list_lru_walk_one\\n     inode_lru_isolate\\n      i_ea-\u003ei_state |= I_FREEING // set inode state\\n     inode_lru_isolate\\n      __iget(i_reg)\\n      spin_unlock(\u0026i_reg-\u003ei_lock)\\n      spin_unlock(lru_lock)\\n                                     rm file A\\n                                      i_reg-\u003enlink = 0\\n      iput(i_reg) // i_reg-\u003enlink is 0, do evict\\n       ext4_evict_inode\\n        ext4_xattr_delete_inode\\n         ext4_xattr_inode_dec_ref_all\\n          ext4_xattr_inode_iget\\n           ext4_iget(i_ea-\u003ei_ino)\\n            iget_locked\\n             find_inode_fast\\n              __wait_on_freeing_inode(i_ea) ----\u2192 AA deadlock\\n    dispose_list // cannot be executed by prune_icache_sb\\n     wake_up_bit(\u0026i_ea-\u003ei_state)\\n\\nCase 2: In deleted inode writing function ubifs_jnl_write_inode(), file\\n        deleting process holds BASEHD\u0027s wbuf-\u003eio_mutex while getting the\\n\\txattr inode, which could race with inode reclaiming process(The\\n        reclaiming process could try locking BASEHD\u0027s wbuf-\u003eio_mutex in\\n\\tinode evicting function), then an ABBA deadlock problem would\\n\\thappen as following:\\n\\n 1. File A has inode ia and a xattr(with inode ixa), regular file B has\\n    inode ib and a xattr.\\n 2. getfattr(A, xattr_buf) // ixa is added into lru // lru-\u003eixa\\n 3. Then, following three processes running like this:\\n\\n        PA                PB                        PC\\n                echo 2 \u003e /proc/sys/vm/drop_caches\\n                 shrink_slab\\n                  prune_dcache_sb\\n                  // ib and ia are added into lru, lru-\u003eixa-\u003eib-\u003eia\\n                  prune_icache_sb\\n                   list_lru_walk_one\\n                    inode_lru_isolate\\n                     ixa-\u003ei_state |= I_FREEING // set inode state\\n                    inode_lru_isolate\\n                     __iget(ib)\\n                     spin_unlock(\u0026ib-\u003ei_lock)\\n                     spin_unlock(lru_lock)\\n                                                   rm file B\\n                                                    ib-\u003enlink = 0\\n rm file A\\n  iput(ia)\\n   ubifs_evict_inode(ia)\\n    ubifs_jnl_delete_inode(ia)\\n     ubifs_jnl_write_inode(ia)\\n      make_reservation(BASEHD) // Lock wbuf-\u003eio_mutex\\n      ubifs_iget(ixa-\u003ei_ino)\\n       iget_locked\\n        find_inode_fast\\n         __wait_on_freeing_inode(ixa)\\n          |          iput(ib) // ib-\u003enlink is 0, do evict\\n          |           ubifs_evict_inode\\n          |            ubifs_jnl_delete_inode(ib)\\n          \u2193             ubifs_jnl_write_inode\\n     ABBA deadlock \u2190-----make_reservation(BASEHD)\\n                   dispose_list // cannot be executed by prune_icache_sb\\n                    wake_up_bit(\u0026ixa-\u003ei_state)\\n\\nFix the possible deadlock by using new inode state flag I_LRU_ISOLATING\\nto pin the inode in memory while inode_lru_isolate(\\n---truncated---\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: vfs: No desalojar inodo bajo el contexto de recorrido lru de inodo El proceso de recuperaci\u00f3n de inodo (ver funci\u00f3n prune_icache_sb) recopila todos los inodos recuperables y los marca con el indicador I_FREEING al principio, en ese momento, otros procesos se atascar\u00e1n si intentan obtener estos inodos (ver funci\u00f3n find_inode_fast), luego el proceso de recuperaci\u00f3n destruye los inodos mediante la funci\u00f3n dispose_list(). Algunos sistemas de archivos (por ejemplo, ext4 con la funci\u00f3n ea_inode, ubifs con xattr) pueden realizar una b\u00fasqueda de inodo en la funci\u00f3n de devoluci\u00f3n de llamada de expulsi\u00f3n de inodo, si la b\u00fasqueda de inodo se opera bajo el contexto de recorrido lru de inodo, pueden ocurrir problemas de interbloqueo. Caso 1: En la funci\u00f3n ext4_evict_inode(), la b\u00fasqueda de inodo ea podr\u00eda ocurrir si la caracter\u00edstica ea_inode est\u00e1 habilitada, el proceso de b\u00fasqueda se quedar\u00e1 atascado bajo el contexto de desalojo de esta manera: 1. El archivo A tiene un inodo i_reg y un inodo ea i_ea 2. getfattr(A, xattr_buf) // i_ea se agrega a lru // lru-\u0026gt;i_ea 3. Luego, los siguientes tres procesos se ejecutan de esta manera: PA PB echo 2 \u0026gt; /proc/sys/vm/drop_caches shrink_slab prune_dcache_sb // i_reg se agrega a lru, lru-\u0026gt;i_ea-\u0026gt;i_reg prune_icache_sb list_lru_walk_one inode_lru_isolate i_ea-\u0026gt;i_state |= I_FREEING // establece el estado del inodo inode_lru_isolate __iget(i_reg) spin_unlock(\u0026amp;i_reg-\u0026gt;i_lock) spin_unlock(lru_lock) rm archivo A i_reg-\u0026gt;nlink = 0 iput(i_reg) // i_reg-\u0026gt;nlink es 0, desalojar ext4_evict_inode ext4_xattr_delete_inode ext4_xattr_inode_dec_ref_all ext4_xattr_inode_iget ext4_iget(i_ea-\u0026gt;i_ino) iget_locked find_inode_fast __wait_on_freeing_inode(i_ea) ----? Bloqueo AA dispose_list // no puede ser ejecutado por prune_icache_sb wake_up_bit(\u0026amp;i_ea-\u0026gt;i_state) Caso 2: En la funci\u00f3n de escritura de inodo eliminado ubifs_jnl_write_inode(), el proceso de eliminaci\u00f3n de archivo retiene BASEHD wbuf-\u0026gt;io_mutex mientras obtiene el inodo xattr, que podr\u00eda competir con el proceso de recuperaci\u00f3n de inodo (el proceso de recuperaci\u00f3n podr\u00eda intentar bloquear wbuf-\u0026gt;io_mutex de BASEHD en la funci\u00f3n de desalojo de inodo), entonces ocurrir\u00eda un problema de bloqueo ABBA de la siguiente manera: 1. El archivo A tiene un inodo ia y un xattr (con un inodo ixa), el archivo B normal tiene un inodo ib y un xattr. 2. getfattr(A, xattr_buf) // ixa se agrega a lru // lru-\u0026gt;ixa 3. Luego, los siguientes tres procesos se ejecutan de esta manera: PA PB PC echo 2 \u0026gt; /proc/sys/vm/drop_caches shrink_slab prune_dcache_sb // ib e ia se agregan a lru, lru-\u0026gt;ixa-\u0026gt;ib-\u0026gt;ia prune_icache_sb list_lru_walk_one inode_lru_isolate ixa-\u0026gt;i_state |= I_FREEING // establece el estado del inodo inode_lru_isolate __iget(ib) spin_unlock(\u0026amp;ib-\u0026gt;i_lock) spin_unlock(lru_lock) rm archivo B ib-\u0026gt;nlink = 0 rm archivo A iput(ia) ubifs_evict_inode(ia) ubifs_jnl_delete_inode(ia) ubifs_jnl_write_inode(ia) make_reservation(BASEHD) // Bloquear wbuf-\u0026gt;io_mutex ubifs_iget(ixa-\u0026gt;i_ino) iget_locked find_inode_fast __wait_on_freeing_inode(ixa) | iput(ib) // ib-\u0026gt;nlink es 0, desalojar | ubifs_evict_inode | ubifs_jnl_delete_inode(ib) ? ubifs_jnl_write_inode Bloqueo ABBA ?-----make_reservation(BASEHD) dispose_list // no puede ser ejecutado por prune_icache_sb wake_up_bit(\u0026amp;ixa-\u0026gt;i_state) Corrija el posible bloqueo utilizando el nuevo indicador de estado de inodo I_LRU_ISOLATING para fijar el inodo en la memoria mientras inode_lru_isolate( ---truncado---\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":4.7,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.0,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-667\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.13\",\"versionEndExcluding\":\"5.4.283\",\"matchCriteriaId\":\"233C3D30-5FAC-4A42-AEF4-308BEE3563D3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.225\",\"matchCriteriaId\":\"C57B46A9-B105-4792-8481-1870DEFB436A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.166\",\"matchCriteriaId\":\"913ED6CD-8ACF-48AF-AA18-7880881DD402\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.107\",\"matchCriteriaId\":\"53954FF8-CB48-4302-BC4C-9DA7A88F44A2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.48\",\"matchCriteriaId\":\"9DE9201A-CE6B-4726-BABB-8265EA0F8AE4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.10.7\",\"matchCriteriaId\":\"D2AFDFD1-D95A-4EB7-843B-5E7659518B67\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"8B3CE743-2126-47A3-8B7C-822B502CF119\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"4DEB27E7-30AA-45CC-8934-B89263EF3551\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"E0005AEF-856E-47EB-BFE4-90C46899394D\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/03880af02a78bc9a98b5a581f529cf709c88a9b8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/2a0629834cd82f05d424bbc193374f9a43d1f87d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3525ad25240dfdd8c78f3470911ed10aa727aa72\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/437741eba63bf4e437e2beb5583f8633556a2b98\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9063ab49c11e9518a3f2352434bb276cc8134c5f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b9bda5f6012dd00372f3a06a82ed8971a4c57c32\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/cda54ec82c0f9d05393242b20b13f69b083f7e88\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2024/10/msg00003.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/10/msg00003.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T22:15:06.309Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-45003\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-04T20:18:27.700271Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-04T20:18:30.592Z\"}}], \"cna\": {\"title\": \"vfs: Don\u0027t evict inode under the inode lru traversing context\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"e50e5129f384ae282adebfb561189cdb19b81cee\", \"lessThan\": \"3525ad25240dfdd8c78f3470911ed10aa727aa72\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e50e5129f384ae282adebfb561189cdb19b81cee\", \"lessThan\": \"03880af02a78bc9a98b5a581f529cf709c88a9b8\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e50e5129f384ae282adebfb561189cdb19b81cee\", \"lessThan\": \"cda54ec82c0f9d05393242b20b13f69b083f7e88\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e50e5129f384ae282adebfb561189cdb19b81cee\", \"lessThan\": \"437741eba63bf4e437e2beb5583f8633556a2b98\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e50e5129f384ae282adebfb561189cdb19b81cee\", \"lessThan\": \"b9bda5f6012dd00372f3a06a82ed8971a4c57c32\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e50e5129f384ae282adebfb561189cdb19b81cee\", \"lessThan\": \"9063ab49c11e9518a3f2352434bb276cc8134c5f\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e50e5129f384ae282adebfb561189cdb19b81cee\", \"lessThan\": \"2a0629834cd82f05d424bbc193374f9a43d1f87d\", \"versionType\": \"git\"}], \"programFiles\": [\"fs/inode.c\", \"include/linux/fs.h\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.13\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"4.13\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.4.283\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.225\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.166\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.107\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.48\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10.7\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.10.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"fs/inode.c\", \"include/linux/fs.h\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/3525ad25240dfdd8c78f3470911ed10aa727aa72\"}, {\"url\": \"https://git.kernel.org/stable/c/03880af02a78bc9a98b5a581f529cf709c88a9b8\"}, {\"url\": \"https://git.kernel.org/stable/c/cda54ec82c0f9d05393242b20b13f69b083f7e88\"}, {\"url\": \"https://git.kernel.org/stable/c/437741eba63bf4e437e2beb5583f8633556a2b98\"}, {\"url\": \"https://git.kernel.org/stable/c/b9bda5f6012dd00372f3a06a82ed8971a4c57c32\"}, {\"url\": \"https://git.kernel.org/stable/c/9063ab49c11e9518a3f2352434bb276cc8134c5f\"}, {\"url\": \"https://git.kernel.org/stable/c/2a0629834cd82f05d424bbc193374f9a43d1f87d\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nvfs: Don\u0027t evict inode under the inode lru traversing context\\n\\nThe inode reclaiming process(See function prune_icache_sb) collects all\\nreclaimable inodes and mark them with I_FREEING flag at first, at that\\ntime, other processes will be stuck if they try getting these inodes\\n(See function find_inode_fast), then the reclaiming process destroy the\\ninodes by function dispose_list(). Some filesystems(eg. ext4 with\\nea_inode feature, ubifs with xattr) may do inode lookup in the inode\\nevicting callback function, if the inode lookup is operated under the\\ninode lru traversing context, deadlock problems may happen.\\n\\nCase 1: In function ext4_evict_inode(), the ea inode lookup could happen\\n        if ea_inode feature is enabled, the lookup process will be stuck\\n\\tunder the evicting context like this:\\n\\n 1. File A has inode i_reg and an ea inode i_ea\\n 2. getfattr(A, xattr_buf) // i_ea is added into lru // lru-\u003ei_ea\\n 3. Then, following three processes running like this:\\n\\n    PA                              PB\\n echo 2 \u003e /proc/sys/vm/drop_caches\\n  shrink_slab\\n   prune_dcache_sb\\n   // i_reg is added into lru, lru-\u003ei_ea-\u003ei_reg\\n   prune_icache_sb\\n    list_lru_walk_one\\n     inode_lru_isolate\\n      i_ea-\u003ei_state |= I_FREEING // set inode state\\n     inode_lru_isolate\\n      __iget(i_reg)\\n      spin_unlock(\u0026i_reg-\u003ei_lock)\\n      spin_unlock(lru_lock)\\n                                     rm file A\\n                                      i_reg-\u003enlink = 0\\n      iput(i_reg) // i_reg-\u003enlink is 0, do evict\\n       ext4_evict_inode\\n        ext4_xattr_delete_inode\\n         ext4_xattr_inode_dec_ref_all\\n          ext4_xattr_inode_iget\\n           ext4_iget(i_ea-\u003ei_ino)\\n            iget_locked\\n             find_inode_fast\\n              __wait_on_freeing_inode(i_ea) ----\\u2192 AA deadlock\\n    dispose_list // cannot be executed by prune_icache_sb\\n     wake_up_bit(\u0026i_ea-\u003ei_state)\\n\\nCase 2: In deleted inode writing function ubifs_jnl_write_inode(), file\\n        deleting process holds BASEHD\u0027s wbuf-\u003eio_mutex while getting the\\n\\txattr inode, which could race with inode reclaiming process(The\\n        reclaiming process could try locking BASEHD\u0027s wbuf-\u003eio_mutex in\\n\\tinode evicting function), then an ABBA deadlock problem would\\n\\thappen as following:\\n\\n 1. File A has inode ia and a xattr(with inode ixa), regular file B has\\n    inode ib and a xattr.\\n 2. getfattr(A, xattr_buf) // ixa is added into lru // lru-\u003eixa\\n 3. Then, following three processes running like this:\\n\\n        PA                PB                        PC\\n                echo 2 \u003e /proc/sys/vm/drop_caches\\n                 shrink_slab\\n                  prune_dcache_sb\\n                  // ib and ia are added into lru, lru-\u003eixa-\u003eib-\u003eia\\n                  prune_icache_sb\\n                   list_lru_walk_one\\n                    inode_lru_isolate\\n                     ixa-\u003ei_state |= I_FREEING // set inode state\\n                    inode_lru_isolate\\n                     __iget(ib)\\n                     spin_unlock(\u0026ib-\u003ei_lock)\\n                     spin_unlock(lru_lock)\\n                                                   rm file B\\n                                                    ib-\u003enlink = 0\\n rm file A\\n  iput(ia)\\n   ubifs_evict_inode(ia)\\n    ubifs_jnl_delete_inode(ia)\\n     ubifs_jnl_write_inode(ia)\\n      make_reservation(BASEHD) // Lock wbuf-\u003eio_mutex\\n      ubifs_iget(ixa-\u003ei_ino)\\n       iget_locked\\n        find_inode_fast\\n         __wait_on_freeing_inode(ixa)\\n          |          iput(ib) // ib-\u003enlink is 0, do evict\\n          |           ubifs_evict_inode\\n          |            ubifs_jnl_delete_inode(ib)\\n          \\u2193             ubifs_jnl_write_inode\\n     ABBA deadlock \\u2190-----make_reservation(BASEHD)\\n                   dispose_list // cannot be executed by prune_icache_sb\\n                    wake_up_bit(\u0026ixa-\u003ei_state)\\n\\nFix the possible deadlock by using new inode state flag I_LRU_ISOLATING\\nto pin the inode in memory while inode_lru_isolate(\\n---truncated---\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.283\", \"versionStartIncluding\": \"4.13\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.225\", \"versionStartIncluding\": \"4.13\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.166\", \"versionStartIncluding\": \"4.13\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.107\", \"versionStartIncluding\": \"4.13\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.48\", \"versionStartIncluding\": \"4.13\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10.7\", \"versionStartIncluding\": \"4.13\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11\", \"versionStartIncluding\": \"4.13\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2025-05-04T09:30:49.156Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-45003\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-11-03T22:15:06.309Z\", \"dateReserved\": \"2024-08-21T05:34:56.678Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-09-04T19:54:46.276Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.