cve-2024-26792
Vulnerability from cvelistv5
Published
2024-04-04 08:20
Modified
2024-09-11 17:33
Severity
Summary
btrfs: fix double free of anonymous device after snapshot creation failure
References
SourceURLTags
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/c34adc20b91a8e55e048b18d63f4f4ae003ecf8f
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/c8ab7521665bd0f8bc4a900244d1d5a7095cc3b9
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/e2b54eaf28df0c978626c9736b94f003b523b451
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/eb3441093aad251418921246fc3b224fd1575701
Impacted products
VendorProduct
LinuxLinux
LinuxLinux
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:14:13.341Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/c34adc20b91a8e55e048b18d63f4f4ae003ecf8f"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/eb3441093aad251418921246fc3b224fd1575701"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/c8ab7521665bd0f8bc4a900244d1d5a7095cc3b9"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/e2b54eaf28df0c978626c9736b94f003b523b451"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-26792",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T15:50:55.740284Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:33:49.282Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/btrfs/disk-io.c",
            "fs/btrfs/disk-io.h",
            "fs/btrfs/ioctl.c",
            "fs/btrfs/transaction.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c34adc20b91a",
              "status": "affected",
              "version": "66b317a2fc45",
              "versionType": "git"
            },
            {
              "lessThan": "eb3441093aad",
              "status": "affected",
              "version": "833775656d44",
              "versionType": "git"
            },
            {
              "lessThan": "c8ab7521665b",
              "status": "affected",
              "version": "5a172344bfda",
              "versionType": "git"
            },
            {
              "lessThan": "e2b54eaf28df",
              "status": "affected",
              "version": "e03ee2fe873e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/btrfs/disk-io.c",
            "fs/btrfs/disk-io.h",
            "fs/btrfs/ioctl.c",
            "fs/btrfs/transaction.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6.1.81",
              "status": "affected",
              "version": "6.1.79",
              "versionType": "custom"
            },
            {
              "lessThan": "6.6.21",
              "status": "affected",
              "version": "6.6.18",
              "versionType": "custom"
            },
            {
              "lessThan": "6.7.9",
              "status": "affected",
              "version": "6.7.6",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix double free of anonymous device after snapshot creation failure\n\nWhen creating a snapshot we may do a double free of an anonymous device\nin case there\u0027s an error committing the transaction. The second free may\nresult in freeing an anonymous device number that was allocated by some\nother subsystem in the kernel or another btrfs filesystem.\n\nThe steps that lead to this:\n\n1) At ioctl.c:create_snapshot() we allocate an anonymous device number\n   and assign it to pending_snapshot-\u003eanon_dev;\n\n2) Then we call btrfs_commit_transaction() and end up at\n   transaction.c:create_pending_snapshot();\n\n3) There we call btrfs_get_new_fs_root() and pass it the anonymous device\n   number stored in pending_snapshot-\u003eanon_dev;\n\n4) btrfs_get_new_fs_root() frees that anonymous device number because\n   btrfs_lookup_fs_root() returned a root - someone else did a lookup\n   of the new root already, which could some task doing backref walking;\n\n5) After that some error happens in the transaction commit path, and at\n   ioctl.c:create_snapshot() we jump to the \u0027fail\u0027 label, and after\n   that we free again the same anonymous device number, which in the\n   meanwhile may have been reallocated somewhere else, because\n   pending_snapshot-\u003eanon_dev still has the same value as in step 1.\n\nRecently syzbot ran into this and reported the following trace:\n\n  ------------[ cut here ]------------\n  ida_free called for id=51 which is not allocated.\n  WARNING: CPU: 1 PID: 31038 at lib/idr.c:525 ida_free+0x370/0x420 lib/idr.c:525\n  Modules linked in:\n  CPU: 1 PID: 31038 Comm: syz-executor.2 Not tainted 6.8.0-rc4-syzkaller-00410-gc02197fc9076 #0\n  Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024\n  RIP: 0010:ida_free+0x370/0x420 lib/idr.c:525\n  Code: 10 42 80 3c 28 (...)\n  RSP: 0018:ffffc90015a67300 EFLAGS: 00010246\n  RAX: be5130472f5dd000 RBX: 0000000000000033 RCX: 0000000000040000\n  RDX: ffffc90009a7a000 RSI: 000000000003ffff RDI: 0000000000040000\n  RBP: ffffc90015a673f0 R08: ffffffff81577992 R09: 1ffff92002b4cdb4\n  R10: dffffc0000000000 R11: fffff52002b4cdb5 R12: 0000000000000246\n  R13: dffffc0000000000 R14: ffffffff8e256b80 R15: 0000000000000246\n  FS:  00007fca3f4b46c0(0000) GS:ffff8880b9500000(0000) knlGS:0000000000000000\n  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  CR2: 00007f167a17b978 CR3: 000000001ed26000 CR4: 0000000000350ef0\n  Call Trace:\n   \u003cTASK\u003e\n   btrfs_get_root_ref+0xa48/0xaf0 fs/btrfs/disk-io.c:1346\n   create_pending_snapshot+0xff2/0x2bc0 fs/btrfs/transaction.c:1837\n   create_pending_snapshots+0x195/0x1d0 fs/btrfs/transaction.c:1931\n   btrfs_commit_transaction+0xf1c/0x3740 fs/btrfs/transaction.c:2404\n   create_snapshot+0x507/0x880 fs/btrfs/ioctl.c:848\n   btrfs_mksubvol+0x5d0/0x750 fs/btrfs/ioctl.c:998\n   btrfs_mksnapshot+0xb5/0xf0 fs/btrfs/ioctl.c:1044\n   __btrfs_ioctl_snap_create+0x387/0x4b0 fs/btrfs/ioctl.c:1306\n   btrfs_ioctl_snap_create_v2+0x1ca/0x400 fs/btrfs/ioctl.c:1393\n   btrfs_ioctl+0xa74/0xd40\n   vfs_ioctl fs/ioctl.c:51 [inline]\n   __do_sys_ioctl fs/ioctl.c:871 [inline]\n   __se_sys_ioctl+0xfe/0x170 fs/ioctl.c:857\n   do_syscall_64+0xfb/0x240\n   entry_SYSCALL_64_after_hwframe+0x6f/0x77\n  RIP: 0033:0x7fca3e67dda9\n  Code: 28 00 00 00 (...)\n  RSP: 002b:00007fca3f4b40c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010\n  RAX: ffffffffffffffda RBX: 00007fca3e7abf80 RCX: 00007fca3e67dda9\n  RDX: 00000000200005c0 RSI: 0000000050009417 RDI: 0000000000000003\n  RBP: 00007fca3e6ca47a R08: 0000000000000000 R09: 0000000000000000\n  R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000\n  R13: 000000000000000b R14: 00007fca3e7abf80 R15: 00007fff6bf95658\n   \u003c/TASK\u003e\n\nWhere we get an explicit message where we attempt to free an anonymous\ndevice number that is not currently allocated. It happens in a different\ncode path from the example below, at btrfs_get_root_ref(), so this change\nmay not fix the case triggered by sy\n---truncated---"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-05-29T05:22:50.625Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c34adc20b91a8e55e048b18d63f4f4ae003ecf8f"
        },
        {
          "url": "https://git.kernel.org/stable/c/eb3441093aad251418921246fc3b224fd1575701"
        },
        {
          "url": "https://git.kernel.org/stable/c/c8ab7521665bd0f8bc4a900244d1d5a7095cc3b9"
        },
        {
          "url": "https://git.kernel.org/stable/c/e2b54eaf28df0c978626c9736b94f003b523b451"
        }
      ],
      "title": "btrfs: fix double free of anonymous device after snapshot creation failure",
      "x_generator": {
        "engine": "bippy-a5840b7849dd"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-26792",
    "datePublished": "2024-04-04T08:20:23.075Z",
    "dateReserved": "2024-02-19T14:20:24.178Z",
    "dateUpdated": "2024-09-11T17:33:49.282Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-26792\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-04-04T09:15:08.563\",\"lastModified\":\"2024-04-04T14:15:09.783\",\"vulnStatus\":\"Awaiting Analysis\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbtrfs: fix double free of anonymous device after snapshot creation failure\\n\\nWhen creating a snapshot we may do a double free of an anonymous device\\nin case there\u0027s an error committing the transaction. The second free may\\nresult in freeing an anonymous device number that was allocated by some\\nother subsystem in the kernel or another btrfs filesystem.\\n\\nThe steps that lead to this:\\n\\n1) At ioctl.c:create_snapshot() we allocate an anonymous device number\\n   and assign it to pending_snapshot-\u003eanon_dev;\\n\\n2) Then we call btrfs_commit_transaction() and end up at\\n   transaction.c:create_pending_snapshot();\\n\\n3) There we call btrfs_get_new_fs_root() and pass it the anonymous device\\n   number stored in pending_snapshot-\u003eanon_dev;\\n\\n4) btrfs_get_new_fs_root() frees that anonymous device number because\\n   btrfs_lookup_fs_root() returned a root - someone else did a lookup\\n   of the new root already, which could some task doing backref walking;\\n\\n5) After that some error happens in the transaction commit path, and at\\n   ioctl.c:create_snapshot() we jump to the \u0027fail\u0027 label, and after\\n   that we free again the same anonymous device number, which in the\\n   meanwhile may have been reallocated somewhere else, because\\n   pending_snapshot-\u003eanon_dev still has the same value as in step 1.\\n\\nRecently syzbot ran into this and reported the following trace:\\n\\n  ------------[ cut here ]------------\\n  ida_free called for id=51 which is not allocated.\\n  WARNING: CPU: 1 PID: 31038 at lib/idr.c:525 ida_free+0x370/0x420 lib/idr.c:525\\n  Modules linked in:\\n  CPU: 1 PID: 31038 Comm: syz-executor.2 Not tainted 6.8.0-rc4-syzkaller-00410-gc02197fc9076 #0\\n  Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024\\n  RIP: 0010:ida_free+0x370/0x420 lib/idr.c:525\\n  Code: 10 42 80 3c 28 (...)\\n  RSP: 0018:ffffc90015a67300 EFLAGS: 00010246\\n  RAX: be5130472f5dd000 RBX: 0000000000000033 RCX: 0000000000040000\\n  RDX: ffffc90009a7a000 RSI: 000000000003ffff RDI: 0000000000040000\\n  RBP: ffffc90015a673f0 R08: ffffffff81577992 R09: 1ffff92002b4cdb4\\n  R10: dffffc0000000000 R11: fffff52002b4cdb5 R12: 0000000000000246\\n  R13: dffffc0000000000 R14: ffffffff8e256b80 R15: 0000000000000246\\n  FS:  00007fca3f4b46c0(0000) GS:ffff8880b9500000(0000) knlGS:0000000000000000\\n  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\n  CR2: 00007f167a17b978 CR3: 000000001ed26000 CR4: 0000000000350ef0\\n  Call Trace:\\n   \u003cTASK\u003e\\n   btrfs_get_root_ref+0xa48/0xaf0 fs/btrfs/disk-io.c:1346\\n   create_pending_snapshot+0xff2/0x2bc0 fs/btrfs/transaction.c:1837\\n   create_pending_snapshots+0x195/0x1d0 fs/btrfs/transaction.c:1931\\n   btrfs_commit_transaction+0xf1c/0x3740 fs/btrfs/transaction.c:2404\\n   create_snapshot+0x507/0x880 fs/btrfs/ioctl.c:848\\n   btrfs_mksubvol+0x5d0/0x750 fs/btrfs/ioctl.c:998\\n   btrfs_mksnapshot+0xb5/0xf0 fs/btrfs/ioctl.c:1044\\n   __btrfs_ioctl_snap_create+0x387/0x4b0 fs/btrfs/ioctl.c:1306\\n   btrfs_ioctl_snap_create_v2+0x1ca/0x400 fs/btrfs/ioctl.c:1393\\n   btrfs_ioctl+0xa74/0xd40\\n   vfs_ioctl fs/ioctl.c:51 [inline]\\n   __do_sys_ioctl fs/ioctl.c:871 [inline]\\n   __se_sys_ioctl+0xfe/0x170 fs/ioctl.c:857\\n   do_syscall_64+0xfb/0x240\\n   entry_SYSCALL_64_after_hwframe+0x6f/0x77\\n  RIP: 0033:0x7fca3e67dda9\\n  Code: 28 00 00 00 (...)\\n  RSP: 002b:00007fca3f4b40c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010\\n  RAX: ffffffffffffffda RBX: 00007fca3e7abf80 RCX: 00007fca3e67dda9\\n  RDX: 00000000200005c0 RSI: 0000000050009417 RDI: 0000000000000003\\n  RBP: 00007fca3e6ca47a R08: 0000000000000000 R09: 0000000000000000\\n  R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000\\n  R13: 000000000000000b R14: 00007fca3e7abf80 R15: 00007fff6bf95658\\n   \u003c/TASK\u003e\\n\\nWhere we get an explicit message where we attempt to free an anonymous\\ndevice number that is not currently allocated. It happens in a different\\ncode path from the example below, at btrfs_get_root_ref(), so this change\\nmay not fix the case triggered by sy\\n---truncated---\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux se ha resuelto la siguiente vulnerabilidad: btrfs: corrige la doble liberaci\u00f3n de un dispositivo an\u00f3nimo despu\u00e9s de un error en la creaci\u00f3n de la instant\u00e1nea. Al crear una instant\u00e1nea podemos hacer una doble liberaci\u00f3n de un dispositivo an\u00f3nimo en caso de que haya un error al realizar la transacci\u00f3n. La segunda liberaci\u00f3n puede resultar en la liberaci\u00f3n de un n\u00famero de dispositivo an\u00f3nimo asignado por alg\u00fan otro subSYSTEM en el kernel u otro SYSTEM de archivos btrfs. Los pasos que conducen a esto: 1) En ioctl.c:create_snapshot() asignamos un n\u00famero de dispositivo an\u00f3nimo y lo asignamos a pendiente_snapshot-\u0026gt;anon_dev; 2) Luego llamamos a btrfs_commit_transaction() y terminamos en transaction.c:create_pending_snapshot(); 3) All\u00ed llamamos a btrfs_get_new_fs_root() y le pasamos el n\u00famero de dispositivo an\u00f3nimo almacenado en pendiente_snapshot-\u0026gt;anon_dev; 4) btrfs_get_new_fs_root() libera ese n\u00famero de dispositivo an\u00f3nimo porque btrfs_lookup_fs_root() devolvi\u00f3 una ra\u00edz; alguien m\u00e1s ya hizo una b\u00fasqueda de la nueva ra\u00edz, lo que podr\u00eda realizar alguna tarea haciendo retroceder la referencia; 5) Despu\u00e9s de eso, ocurre alg\u00fan error en la ruta de confirmaci\u00f3n de la transacci\u00f3n, y en ioctl.c:create_snapshot() saltamos a la etiqueta \u0027fail\u0027, y luego liberamos nuevamente el mismo n\u00famero de dispositivo an\u00f3nimo, que mientras tanto puede haber sido reasignado en otro lugar, porque pendiente_snapshot-\u0026gt;anon_dev todav\u00eda tiene el mismo valor que en el paso 1. Recientemente, syzbot se encontr\u00f3 con esto e inform\u00f3 el siguiente seguimiento: ------------[ cortar aqu\u00ed ]---- -------- ida_free solicit\u00f3 id=51 que no est\u00e1 asignado. ADVERTENCIA: CPU: 1 PID: 31038 en lib/idr.c:525 ida_free+0x370/0x420 lib/idr.c:525 M\u00f3dulos vinculados en: CPU: 1 PID: 31038 Comm: syz-executor.2 No contaminado 6.8.0 -rc4-syzkaller-00410-gc02197fc9076 #0 Nombre del hardware: Google Google Compute Engine/Google Compute Engine, BIOS Google 25/01/2024 RIP: 0010:ida_free+0x370/0x420 lib/idr.c:525 C\u00f3digo: 10 42 80 3c 28 (...) RSP: 0018:ffffc90015a67300 EFLAGS: 00010246 RAX: be5130472f5dd000 RBX: 00000000000000033 RCX: 0000000000040000 RDX: ffffc90009a7a000 R SI: 000000000003ffff RDI: 0000000000040000 RBP: ffffc90015a673f0 R08: ffffffff81577992 R09: 1ffff92002b4cdb4 R10: dffffc0000000000 R11: ffff52002b4cdb5 R12: 0000000000000246 R13: dffffc0000000000 R14: ffffffff8e256b80 R15: 0000000000000246 FS: 00007fca3f4b46c0(0000) GS:ffff8880b9500000(0000) knlGS :0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f167a17b978 CR3: 000000001ed26000 CR4: 0000000000350ef0 Rastreo de llamadas: \u0026lt; TAREA\u0026gt; btrfs_get_root_ref+0xa48/0xaf0 fs/btrfs/disk-io.c:1346 create_pending_snapshot+0xff2/0x2bc0 fs/btrfs/transaction.c:1837 create_pending_snapshots+0x195/0x1d0 fs/btrfs/transaction.c:1931 btrfs_ transacci\u00f3n_commit+0xf1c/ 0x3740 fs/btrfs/transaction.c:2404 create_snapshot+0x507/0x880 fs/btrfs/ioctl.c:848 btrfs_mksubvol+0x5d0/0x750 fs/btrfs/ioctl.c:998 btrfs_mksnapshot+0xb5/0xf0 fs/btrfs /ioctl.c :1044 __btrfs_ioctl_snap_create+0x387/0x4b0 fs/btrfs/ioctl.c:1306 btrfs_ioctl_snap_create_v2+0x1ca/0x400 fs/btrfs/ioctl.c:1393 btrfs_ioctl+0xa74/0xd40 vfs_ioct l fs/ioctl.c:51 [en l\u00ednea] __do_sys_ioctl fs/ioctl .c:871 [en l\u00ednea] __se_sys_ioctl+0xfe/0x170 fs/ioctl.c:857 do_syscall_64+0xfb/0x240 Entry_SYSCALL_64_after_hwframe+0x6f/0x77 RIP: 0033:0x7fca3e67dda9 C\u00f3digo: 28 00 00 00 ( ...) RSP: 002b:00007fca3f4b40c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007fca3e7abf80 RCX: 00007fca3e67dda9 RDX: 00000000200005c0 RSI: 0000000050009 417 RDI: 0000000000000003 RBP: 00007fca3e6ca47a R08: 0000000000000000 R09: 00000000000000000 R10: 00000000000000000 R11: 00000000000000246 R12: 0000000000000000 R13: 000000000000000b R14: 00007fca3e7abf80 R15: 00007fff6bf95658  Donde recibimos un mensaje expl\u00edcito donde intentamos liberar un n\u00famero de dispositivo an\u00f3nimo que no est\u00e1 asignado actualmente.,---truncado---\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/c34adc20b91a8e55e048b18d63f4f4ae003ecf8f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c8ab7521665bd0f8bc4a900244d1d5a7095cc3b9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/e2b54eaf28df0c978626c9736b94f003b523b451\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/eb3441093aad251418921246fc3b224fd1575701\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.