cve-2024-35807
Vulnerability from cvelistv5
Published
2024-05-17 13:23
Modified
2024-08-02 03:21
Severity
Summary
ext4: fix corruption during on-line resize
References
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-35807",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-12T15:25:51.499528Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-12T15:26:07.895Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T03:21:47.537Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/75cc31c2e7193b69f5d25650bda5bb42ed92f8a1"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/ee4e9c1976147a850f6085a13fca95bcaa00d84c"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/e8e8b197317228b5089ed9e7802dadf3ccaa027a"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/239c669edb2bffa1aa2612519b1d438ab35d6be6"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/fb1088d51bbaa0faec5a55d4f5818a9ab79e24df"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/37b6a3ba793bbbae057f5b991970ebcc52cb3db5"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/b461910af8ba3bed80f48c2bf852686d05c6fc5c"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/722d2c01b8b108f8283d1b7222209d5b2a5aa7bd"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/a6b3bfe176e8a5b05ec4447404e412c2a3fc92cc"
},
{
"tags": [
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html"
},
{
"tags": [
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/ext4/resize.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "75cc31c2e719",
"status": "affected",
"version": "01f795f9e0d6",
"versionType": "git"
},
{
"lessThan": "ee4e9c197614",
"status": "affected",
"version": "01f795f9e0d6",
"versionType": "git"
},
{
"lessThan": "e8e8b1973172",
"status": "affected",
"version": "01f795f9e0d6",
"versionType": "git"
},
{
"lessThan": "239c669edb2b",
"status": "affected",
"version": "01f795f9e0d6",
"versionType": "git"
},
{
"lessThan": "fb1088d51bba",
"status": "affected",
"version": "01f795f9e0d6",
"versionType": "git"
},
{
"lessThan": "37b6a3ba793b",
"status": "affected",
"version": "01f795f9e0d6",
"versionType": "git"
},
{
"lessThan": "b461910af8ba",
"status": "affected",
"version": "01f795f9e0d6",
"versionType": "git"
},
{
"lessThan": "722d2c01b8b1",
"status": "affected",
"version": "01f795f9e0d6",
"versionType": "git"
},
{
"lessThan": "a6b3bfe176e8",
"status": "affected",
"version": "01f795f9e0d6",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/ext4/resize.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.7"
},
{
"lessThan": "3.7",
"status": "unaffected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.19.*",
"status": "unaffected",
"version": "4.19.312",
"versionType": "custom"
},
{
"lessThanOrEqual": "5.4.*",
"status": "unaffected",
"version": "5.4.274",
"versionType": "custom"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.215",
"versionType": "custom"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.154",
"versionType": "custom"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.84",
"versionType": "custom"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.24",
"versionType": "custom"
},
{
"lessThanOrEqual": "6.7.*",
"status": "unaffected",
"version": "6.7.12",
"versionType": "custom"
},
{
"lessThanOrEqual": "6.8.*",
"status": "unaffected",
"version": "6.8.3",
"versionType": "custom"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.9",
"versionType": "original_commit_for_fix"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix corruption during on-line resize\n\nWe observed a corruption during on-line resize of a file system that is\nlarger than 16 TiB with 4k block size. With having more then 2^32 blocks\nresize_inode is turned off by default by mke2fs. The issue can be\nreproduced on a smaller file system for convenience by explicitly\nturning off resize_inode. An on-line resize across an 8 GiB boundary (the\nsize of a meta block group in this setup) then leads to a corruption:\n\n dev=/dev/\u003csome_dev\u003e # should be \u003e= 16 GiB\n mkdir -p /corruption\n /sbin/mke2fs -t ext4 -b 4096 -O ^resize_inode $dev $((2 * 2**21 - 2**15))\n mount -t ext4 $dev /corruption\n\n dd if=/dev/zero bs=4096 of=/corruption/test count=$((2*2**21 - 4*2**15))\n sha1sum /corruption/test\n # 79d2658b39dcfd77274e435b0934028adafaab11 /corruption/test\n\n /sbin/resize2fs $dev $((2*2**21))\n # drop page cache to force reload the block from disk\n echo 1 \u003e /proc/sys/vm/drop_caches\n\n sha1sum /corruption/test\n # 3c2abc63cbf1a94c9e6977e0fbd72cd832c4d5c3 /corruption/test\n\n2^21 = 2^15*2^6 equals 8 GiB whereof 2^15 is the number of blocks per\nblock group and 2^6 are the number of block groups that make a meta\nblock group.\n\nThe last checksum might be different depending on how the file is laid\nout across the physical blocks. The actual corruption occurs at physical\nblock 63*2^15 = 2064384 which would be the location of the backup of the\nmeta block group\u0027s block descriptor. During the on-line resize the file\nsystem will be converted to meta_bg starting at s_first_meta_bg which is\n2 in the example - meaning all block groups after 16 GiB. However, in\next4_flex_group_add we might add block groups that are not part of the\nfirst meta block group yet. In the reproducer we achieved this by\nsubstracting the size of a whole block group from the point where the\nmeta block group would start. This must be considered when updating the\nbackup block group descriptors to follow the non-meta_bg layout. The fix\nis to add a test whether the group to add is already part of the meta\nblock group or not."
}
],
"providerMetadata": {
"dateUpdated": "2024-05-29T05:29:20.409Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/75cc31c2e7193b69f5d25650bda5bb42ed92f8a1"
},
{
"url": "https://git.kernel.org/stable/c/ee4e9c1976147a850f6085a13fca95bcaa00d84c"
},
{
"url": "https://git.kernel.org/stable/c/e8e8b197317228b5089ed9e7802dadf3ccaa027a"
},
{
"url": "https://git.kernel.org/stable/c/239c669edb2bffa1aa2612519b1d438ab35d6be6"
},
{
"url": "https://git.kernel.org/stable/c/fb1088d51bbaa0faec5a55d4f5818a9ab79e24df"
},
{
"url": "https://git.kernel.org/stable/c/37b6a3ba793bbbae057f5b991970ebcc52cb3db5"
},
{
"url": "https://git.kernel.org/stable/c/b461910af8ba3bed80f48c2bf852686d05c6fc5c"
},
{
"url": "https://git.kernel.org/stable/c/722d2c01b8b108f8283d1b7222209d5b2a5aa7bd"
},
{
"url": "https://git.kernel.org/stable/c/a6b3bfe176e8a5b05ec4447404e412c2a3fc92cc"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html"
}
],
"title": "ext4: fix corruption during on-line resize",
"x_generator": {
"engine": "bippy-a5840b7849dd"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2024-35807",
"datePublished": "2024-05-17T13:23:14.869Z",
"dateReserved": "2024-05-17T12:19:12.342Z",
"dateUpdated": "2024-08-02T03:21:47.537Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2024-35807\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-17T14:15:14.213\",\"lastModified\":\"2024-06-27T13:15:58.810\",\"vulnStatus\":\"Awaiting Analysis\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\next4: fix corruption during on-line resize\\n\\nWe observed a corruption during on-line resize of a file system that is\\nlarger than 16 TiB with 4k block size. With having more then 2^32 blocks\\nresize_inode is turned off by default by mke2fs. The issue can be\\nreproduced on a smaller file system for convenience by explicitly\\nturning off resize_inode. An on-line resize across an 8 GiB boundary (the\\nsize of a meta block group in this setup) then leads to a corruption:\\n\\n dev=/dev/\u003csome_dev\u003e # should be \u003e= 16 GiB\\n mkdir -p /corruption\\n /sbin/mke2fs -t ext4 -b 4096 -O ^resize_inode $dev $((2 * 2**21 - 2**15))\\n mount -t ext4 $dev /corruption\\n\\n dd if=/dev/zero bs=4096 of=/corruption/test count=$((2*2**21 - 4*2**15))\\n sha1sum /corruption/test\\n # 79d2658b39dcfd77274e435b0934028adafaab11 /corruption/test\\n\\n /sbin/resize2fs $dev $((2*2**21))\\n # drop page cache to force reload the block from disk\\n echo 1 \u003e /proc/sys/vm/drop_caches\\n\\n sha1sum /corruption/test\\n # 3c2abc63cbf1a94c9e6977e0fbd72cd832c4d5c3 /corruption/test\\n\\n2^21 = 2^15*2^6 equals 8 GiB whereof 2^15 is the number of blocks per\\nblock group and 2^6 are the number of block groups that make a meta\\nblock group.\\n\\nThe last checksum might be different depending on how the file is laid\\nout across the physical blocks. The actual corruption occurs at physical\\nblock 63*2^15 = 2064384 which would be the location of the backup of the\\nmeta block group\u0027s block descriptor. During the on-line resize the file\\nsystem will be converted to meta_bg starting at s_first_meta_bg which is\\n2 in the example - meaning all block groups after 16 GiB. However, in\\next4_flex_group_add we might add block groups that are not part of the\\nfirst meta block group yet. In the reproducer we achieved this by\\nsubstracting the size of a whole block group from the point where the\\nmeta block group would start. This must be considered when updating the\\nbackup block group descriptors to follow the non-meta_bg layout. The fix\\nis to add a test whether the group to add is already part of the meta\\nblock group or not.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: ext4: corregida la corrupci\u00f3n durante el cambio de tama\u00f1o en l\u00ednea Observamos una corrupci\u00f3n durante el cambio de tama\u00f1o en l\u00ednea de un sistema de archivos de m\u00e1s de 16 TiB con un tama\u00f1o de bloque de 4k. Al tener m\u00e1s de 2 ^ 32 bloques, mke2fs desactiva resize_inode de forma predeterminada. El problema se puede reproducir en un sistema de archivos m\u00e1s peque\u00f1o por conveniencia desactivando expl\u00edcitamente resize_inode. Un cambio de tama\u00f1o en l\u00ednea a trav\u00e9s de un l\u00edmite de 8 GiB (el tama\u00f1o de un grupo de metabloques en esta configuraci\u00f3n) conduce a una corrupci\u00f3n: dev=/dev/ # deber\u00eda ser \u0026gt;= 16 GiB mkdir -p /corruption /sbin/mke2fs -t ext4 -b 4096 -O ^resize_inode $dev $((2 * 2**21 - 2**15)) mount -t ext4 $dev /corruption dd if=/dev/zero bs=4096 of=/corruption/test count=$((2*2**21 - 4*2**15)) sha1sum /corruption/test # 79d2658b39dcfd77274e435b0934028adafaab11 /corruption/test /sbin/resize2fs $dev $((2*2**21)) # soltar cach\u00e9 de p\u00e1gina para forzar la recarga del bloque desde el disco echo 1 \u0026gt; /proc/sys/vm/drop_caches sha1sum /corruption/test # 3c2abc63cbf1a94c9e6977e0fbd72cd832c4d5c3 /corruption/test 2^21 = 2^15*2^6 equivale a 8 GiB de los cuales 2^15 es el n\u00famero de bloques por grupo de bloques y 2^6 es el n\u00famero de grupos de bloques que forman un metagrupo de bloques. La \u00faltima suma de comprobaci\u00f3n puede ser diferente dependiendo de c\u00f3mo est\u00e9 distribuido el archivo en los bloques f\u00edsicos. La corrupci\u00f3n real ocurre en el bloque f\u00edsico 63*2^15 = 2064384, que ser\u00eda la ubicaci\u00f3n de la copia de seguridad del descriptor de bloque del grupo de metabloques. Durante el cambio de tama\u00f1o en l\u00ednea, el sistema de archivos se convertir\u00e1 a meta_bg comenzando en s_first_meta_bg, que en el ejemplo es 2, es decir, todos los grupos de bloques despu\u00e9s de 16 GiB. Sin embargo, en ext4_flex_group_add podr\u00edamos agregar grupos de bloques que a\u00fan no forman parte del primer metagrupo de bloques. En el reproductor logramos esto restando el tama\u00f1o de un grupo de bloques completo desde el punto donde comenzar\u00eda el grupo de metabloques. Esto debe tenerse en cuenta al actualizar los descriptores del grupo de bloques de respaldo para que sigan el dise\u00f1o que no es meta_bg. La soluci\u00f3n es agregar una prueba de si el grupo a agregar ya forma parte del grupo de metabloques o no.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/239c669edb2bffa1aa2612519b1d438ab35d6be6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/37b6a3ba793bbbae057f5b991970ebcc52cb3db5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/722d2c01b8b108f8283d1b7222209d5b2a5aa7bd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/75cc31c2e7193b69f5d25650bda5bb42ed92f8a1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a6b3bfe176e8a5b05ec4447404e412c2a3fc92cc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b461910af8ba3bed80f48c2bf852686d05c6fc5c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/e8e8b197317228b5089ed9e7802dadf3ccaa027a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ee4e9c1976147a850f6085a13fca95bcaa00d84c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/fb1088d51bbaa0faec5a55d4f5818a9ab79e24df\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
}
}