cve-2024-26956
Vulnerability from cvelistv5
Published
2024-05-01 05:18
Modified
2024-08-02 00:21
Severity
Summary
nilfs2: fix failure to detect DAT corruption in btree and direct mappings
References
SourceURLTags
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/2e2619ff5d0def4bb6c2037a32a6eaa28dd95c84
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/46b832e09d43b394ac0f6d9485d2b1a06593f0b7
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/82827ca21e7c8a91384c5baa656f78a5adfa4ab4
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/9cbe1ad5f4354f4df1445e5f4883983328cd6d8e
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/a8e4d098de1c0f4c5c1f2ed4633a860f0da6d713
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/b67189690eb4b7ecc84ae16fa1e880e0123eaa35
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/c3b5c5c31e723b568f83d8cafab8629d9d830ffb
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/f2f26b4a84a0ef41791bd2d70861c8eac748f4ba
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/f69e81396aea66304d214f175aa371f1b5578862
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html
Impacted products
VendorProduct
LinuxLinux
LinuxLinux
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-26956",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-06T18:55:00.382518Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-06T18:55:25.009Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:21:05.748Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/b67189690eb4b7ecc84ae16fa1e880e0123eaa35"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/9cbe1ad5f4354f4df1445e5f4883983328cd6d8e"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/c3b5c5c31e723b568f83d8cafab8629d9d830ffb"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/2e2619ff5d0def4bb6c2037a32a6eaa28dd95c84"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/46b832e09d43b394ac0f6d9485d2b1a06593f0b7"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/f69e81396aea66304d214f175aa371f1b5578862"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/a8e4d098de1c0f4c5c1f2ed4633a860f0da6d713"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/82827ca21e7c8a91384c5baa656f78a5adfa4ab4"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/f2f26b4a84a0ef41791bd2d70861c8eac748f4ba"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/nilfs2/btree.c",
            "fs/nilfs2/direct.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b67189690eb4",
              "status": "affected",
              "version": "c3a7abf06ce7",
              "versionType": "git"
            },
            {
              "lessThan": "9cbe1ad5f435",
              "status": "affected",
              "version": "c3a7abf06ce7",
              "versionType": "git"
            },
            {
              "lessThan": "c3b5c5c31e72",
              "status": "affected",
              "version": "c3a7abf06ce7",
              "versionType": "git"
            },
            {
              "lessThan": "2e2619ff5d0d",
              "status": "affected",
              "version": "c3a7abf06ce7",
              "versionType": "git"
            },
            {
              "lessThan": "46b832e09d43",
              "status": "affected",
              "version": "c3a7abf06ce7",
              "versionType": "git"
            },
            {
              "lessThan": "f69e81396aea",
              "status": "affected",
              "version": "c3a7abf06ce7",
              "versionType": "git"
            },
            {
              "lessThan": "a8e4d098de1c",
              "status": "affected",
              "version": "c3a7abf06ce7",
              "versionType": "git"
            },
            {
              "lessThan": "82827ca21e7c",
              "status": "affected",
              "version": "c3a7abf06ce7",
              "versionType": "git"
            },
            {
              "lessThan": "f2f26b4a84a0",
              "status": "affected",
              "version": "c3a7abf06ce7",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/nilfs2/btree.c",
            "fs/nilfs2/direct.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.31"
            },
            {
              "lessThan": "2.6.31",
              "status": "unaffected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.312",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.274",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.215",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.154",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.84",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.24",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.12",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.3",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: fix failure to detect DAT corruption in btree and direct mappings\n\nPatch series \"nilfs2: fix kernel bug at submit_bh_wbc()\".\n\nThis resolves a kernel BUG reported by syzbot.  Since there are two\nflaws involved, I\u0027ve made each one a separate patch.\n\nThe first patch alone resolves the syzbot-reported bug, but I think\nboth fixes should be sent to stable, so I\u0027ve tagged them as such.\n\n\nThis patch (of 2):\n\nSyzbot has reported a kernel bug in submit_bh_wbc() when writing file data\nto a nilfs2 file system whose metadata is corrupted.\n\nThere are two flaws involved in this issue.\n\nThe first flaw is that when nilfs_get_block() locates a data block using\nbtree or direct mapping, if the disk address translation routine\nnilfs_dat_translate() fails with internal code -ENOENT due to DAT metadata\ncorruption, it can be passed back to nilfs_get_block().  This causes\nnilfs_get_block() to misidentify an existing block as non-existent,\ncausing both data block lookup and insertion to fail inconsistently.\n\nThe second flaw is that nilfs_get_block() returns a successful status in\nthis inconsistent state.  This causes the caller __block_write_begin_int()\nor others to request a read even though the buffer is not mapped,\nresulting in a BUG_ON check for the BH_Mapped flag in submit_bh_wbc()\nfailing.\n\nThis fixes the first issue by changing the return value to code -EINVAL\nwhen a conversion using DAT fails with code -ENOENT, avoiding the\nconflicting condition that leads to the kernel bug described above.  Here,\ncode -EINVAL indicates that metadata corruption was detected during the\nblock lookup, which will be properly handled as a file system error and\nconverted to -EIO when passing through the nilfs2 bmap layer."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-05-29T05:25:50.130Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b67189690eb4b7ecc84ae16fa1e880e0123eaa35"
        },
        {
          "url": "https://git.kernel.org/stable/c/9cbe1ad5f4354f4df1445e5f4883983328cd6d8e"
        },
        {
          "url": "https://git.kernel.org/stable/c/c3b5c5c31e723b568f83d8cafab8629d9d830ffb"
        },
        {
          "url": "https://git.kernel.org/stable/c/2e2619ff5d0def4bb6c2037a32a6eaa28dd95c84"
        },
        {
          "url": "https://git.kernel.org/stable/c/46b832e09d43b394ac0f6d9485d2b1a06593f0b7"
        },
        {
          "url": "https://git.kernel.org/stable/c/f69e81396aea66304d214f175aa371f1b5578862"
        },
        {
          "url": "https://git.kernel.org/stable/c/a8e4d098de1c0f4c5c1f2ed4633a860f0da6d713"
        },
        {
          "url": "https://git.kernel.org/stable/c/82827ca21e7c8a91384c5baa656f78a5adfa4ab4"
        },
        {
          "url": "https://git.kernel.org/stable/c/f2f26b4a84a0ef41791bd2d70861c8eac748f4ba"
        },
        {
          "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html"
        },
        {
          "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html"
        }
      ],
      "title": "nilfs2: fix failure to detect DAT corruption in btree and direct mappings",
      "x_generator": {
        "engine": "bippy-a5840b7849dd"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-26956",
    "datePublished": "2024-05-01T05:18:56.101Z",
    "dateReserved": "2024-02-19T14:20:24.200Z",
    "dateUpdated": "2024-08-02T00:21:05.748Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-26956\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-01T06:15:11.837\",\"lastModified\":\"2024-06-27T13:15:57.290\",\"vulnStatus\":\"Awaiting Analysis\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnilfs2: fix failure to detect DAT corruption in btree and direct mappings\\n\\nPatch series \\\"nilfs2: fix kernel bug at submit_bh_wbc()\\\".\\n\\nThis resolves a kernel BUG reported by syzbot.  Since there are two\\nflaws involved, I\u0027ve made each one a separate patch.\\n\\nThe first patch alone resolves the syzbot-reported bug, but I think\\nboth fixes should be sent to stable, so I\u0027ve tagged them as such.\\n\\n\\nThis patch (of 2):\\n\\nSyzbot has reported a kernel bug in submit_bh_wbc() when writing file data\\nto a nilfs2 file system whose metadata is corrupted.\\n\\nThere are two flaws involved in this issue.\\n\\nThe first flaw is that when nilfs_get_block() locates a data block using\\nbtree or direct mapping, if the disk address translation routine\\nnilfs_dat_translate() fails with internal code -ENOENT due to DAT metadata\\ncorruption, it can be passed back to nilfs_get_block().  This causes\\nnilfs_get_block() to misidentify an existing block as non-existent,\\ncausing both data block lookup and insertion to fail inconsistently.\\n\\nThe second flaw is that nilfs_get_block() returns a successful status in\\nthis inconsistent state.  This causes the caller __block_write_begin_int()\\nor others to request a read even though the buffer is not mapped,\\nresulting in a BUG_ON check for the BH_Mapped flag in submit_bh_wbc()\\nfailing.\\n\\nThis fixes the first issue by changing the return value to code -EINVAL\\nwhen a conversion using DAT fails with code -ENOENT, avoiding the\\nconflicting condition that leads to the kernel bug described above.  Here,\\ncode -EINVAL indicates that metadata corruption was detected during the\\nblock lookup, which will be properly handled as a file system error and\\nconverted to -EIO when passing through the nilfs2 bmap layer.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: nilfs2: corrige el error al detectar da\u00f1os en DAT en btree y asignaciones directas Serie de parches \\\"nilfs2: corrige el error del kernel en submit_bh_wbc()\\\". Esto resuelve un ERROR del kernel informado por syzbot. Dado que hay dos fallas involucradas, hice un parche para cada uno por separado. El primer parche por s\u00ed solo resuelve el error reportado por syzbot, pero creo que ambas correcciones deber\u00edan enviarse a estable, as\u00ed que las etiquet\u00e9 como tales. Este parche (de 2): Syzbot ha informado de un error en el kernel en submit_bh_wbc() al escribir datos de archivos en un sistema de archivos nilfs2 cuyos metadatos est\u00e1n da\u00f1ados. Hay dos errores involucrados en este tema. El primer defecto es que cuando nilfs_get_block() localiza un bloque de datos usando btree o mapeo directo, si la rutina de traducci\u00f3n de direcciones de disco nilfs_dat_translate() falla con el c\u00f3digo interno -ENOENT debido a la corrupci\u00f3n de los metadatos DAT, se puede devolver a nilfs_get_block(). Esto hace que nilfs_get_block() identifique err\u00f3neamente un bloque existente como inexistente, lo que provoca que tanto la b\u00fasqueda como la inserci\u00f3n del bloque de datos fallen de manera inconsistente. El segundo defecto es que nilfs_get_block() devuelve un estado exitoso en este estado inconsistente. Esto hace que la persona que llama __block_write_begin_int() u otros soliciten una lectura aunque el b\u00fafer no est\u00e9 asignado, lo que resulta en una verificaci\u00f3n BUG_ON para el indicador BH_Mapped en submit_bh_wbc() que falla. Esto soluciona el primer problema cambiando el valor de retorno al c\u00f3digo -EINVAL cuando falla una conversi\u00f3n usando DAT con el c\u00f3digo -ENOENT, evitando la condici\u00f3n conflictiva que conduce al error del kernel descrito anteriormente. Aqu\u00ed, el c\u00f3digo -EINVAL indica que se detect\u00f3 corrupci\u00f3n de metadatos durante la b\u00fasqueda del bloque, lo que se manejar\u00e1 adecuadamente como un error del sistema de archivos y se convertir\u00e1 a -EIO al pasar a trav\u00e9s de la capa bmap nilfs2.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/2e2619ff5d0def4bb6c2037a32a6eaa28dd95c84\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/46b832e09d43b394ac0f6d9485d2b1a06593f0b7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/82827ca21e7c8a91384c5baa656f78a5adfa4ab4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/9cbe1ad5f4354f4df1445e5f4883983328cd6d8e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a8e4d098de1c0f4c5c1f2ed4633a860f0da6d713\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b67189690eb4b7ecc84ae16fa1e880e0123eaa35\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c3b5c5c31e723b568f83d8cafab8629d9d830ffb\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f2f26b4a84a0ef41791bd2d70861c8eac748f4ba\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f69e81396aea66304d214f175aa371f1b5578862\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.