cve-2024-36001
Vulnerability from cvelistv5
Published
2024-05-20 09:48
Modified
2024-08-02 03:30
Severity
Summary
netfs: Fix the pre-flush when appending to a file in writethrough mode
References
SourceURLTags
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/5eaf23b2e81349f6614f88396dc468fda89fc0b9
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/c97f59e276d4e93480f29a70accbd0d7273cf3f5
Impacted products
VendorProduct
LinuxLinux
LinuxLinux
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-36001",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-20T14:21:51.289020Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:48:03.177Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T03:30:11.620Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/5eaf23b2e81349f6614f88396dc468fda89fc0b9"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/c97f59e276d4e93480f29a70accbd0d7273cf3f5"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/netfs/buffered_write.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5eaf23b2e813",
              "status": "affected",
              "version": "41d8e7673a77",
              "versionType": "git"
            },
            {
              "lessThan": "c97f59e276d4",
              "status": "affected",
              "version": "41d8e7673a77",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/netfs/buffered_write.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.9",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfs: Fix the pre-flush when appending to a file in writethrough mode\n\nIn netfs_perform_write(), when the file is marked NETFS_ICTX_WRITETHROUGH\nor O_*SYNC or RWF_*SYNC was specified, write-through caching is performed\non a buffered file.  When setting up for write-through, we flush any\nconflicting writes in the region and wait for the write to complete,\nfailing if there\u0027s a write error to return.\n\nThe issue arises if we\u0027re writing at or above the EOF position because we\nskip the flush and - more importantly - the wait.  This becomes a problem\nif there\u0027s a partial folio at the end of the file that is being written out\nand we want to make a write to it too.  Both the already-running write and\nthe write we start both want to clear the writeback mark, but whoever is\nsecond causes a warning looking something like:\n\n    ------------[ cut here ]------------\n    R=00000012: folio 11 is not under writeback\n    WARNING: CPU: 34 PID: 654 at fs/netfs/write_collect.c:105\n    ...\n    CPU: 34 PID: 654 Comm: kworker/u386:27 Tainted: G S ...\n    ...\n    Workqueue: events_unbound netfs_write_collection_worker\n    ...\n    RIP: 0010:netfs_writeback_lookup_folio\n\nFix this by making the flush-and-wait unconditional.  It will do nothing if\nthere are no folios in the pagecache and will return quickly if there are\nno folios in the region specified.\n\nFurther, move the WBC attachment above the flush call as the flush is going\nto attach a WBC and detach it again if it is not present - and since we\nneed one anyway we might as well share it."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-05-29T05:32:45.491Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5eaf23b2e81349f6614f88396dc468fda89fc0b9"
        },
        {
          "url": "https://git.kernel.org/stable/c/c97f59e276d4e93480f29a70accbd0d7273cf3f5"
        }
      ],
      "title": "netfs: Fix the pre-flush when appending to a file in writethrough mode",
      "x_generator": {
        "engine": "bippy-a5840b7849dd"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-36001",
    "datePublished": "2024-05-20T09:48:02.966Z",
    "dateReserved": "2024-05-17T13:50:33.149Z",
    "dateUpdated": "2024-08-02T03:30:11.620Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-36001\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-20T10:15:14.230\",\"lastModified\":\"2024-05-20T13:00:04.957\",\"vulnStatus\":\"Awaiting Analysis\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnetfs: Fix the pre-flush when appending to a file in writethrough mode\\n\\nIn netfs_perform_write(), when the file is marked NETFS_ICTX_WRITETHROUGH\\nor O_*SYNC or RWF_*SYNC was specified, write-through caching is performed\\non a buffered file.  When setting up for write-through, we flush any\\nconflicting writes in the region and wait for the write to complete,\\nfailing if there\u0027s a write error to return.\\n\\nThe issue arises if we\u0027re writing at or above the EOF position because we\\nskip the flush and - more importantly - the wait.  This becomes a problem\\nif there\u0027s a partial folio at the end of the file that is being written out\\nand we want to make a write to it too.  Both the already-running write and\\nthe write we start both want to clear the writeback mark, but whoever is\\nsecond causes a warning looking something like:\\n\\n    ------------[ cut here ]------------\\n    R=00000012: folio 11 is not under writeback\\n    WARNING: CPU: 34 PID: 654 at fs/netfs/write_collect.c:105\\n    ...\\n    CPU: 34 PID: 654 Comm: kworker/u386:27 Tainted: G S ...\\n    ...\\n    Workqueue: events_unbound netfs_write_collection_worker\\n    ...\\n    RIP: 0010:netfs_writeback_lookup_folio\\n\\nFix this by making the flush-and-wait unconditional.  It will do nothing if\\nthere are no folios in the pagecache and will return quickly if there are\\nno folios in the region specified.\\n\\nFurther, move the WBC attachment above the flush call as the flush is going\\nto attach a WBC and detach it again if it is not present - and since we\\nneed one anyway we might as well share it.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: netfs: soluciona el lavado previo al agregar un archivo en modo de escritura directa. En netfs_perform_write(), cuando se especifica el archivo marcado como NETFS_ICTX_WRITETHROUGH o O_*SYNC o RWF_*SYNC, escriba -El almacenamiento en cach\u00e9 se realiza en un archivo almacenado en b\u00fafer. Al configurar la escritura directa, eliminamos cualquier escritura conflictiva en la regi\u00f3n y esperamos a que se complete la escritura, fallando si hay un error de escritura que devolver. El problema surge si escribimos en la posici\u00f3n EOF o por encima de ella porque nos saltamos el color y, lo que es m\u00e1s importante, la espera. Esto se convierte en un problema si hay un folio parcial al final del archivo que se est\u00e1 escribiendo y queremos escribir en \u00e9l tambi\u00e9n. Tanto la escritura que ya se est\u00e1 ejecutando como la escritura que comenzamos quieren borrar la marca de reescritura, pero quienquiera que est\u00e9 en segundo lugar genera una advertencia similar a: ------------[cortar aqu\u00ed]---- -------- R=00000012: el folio 11 no est\u00e1 bajo reescritura ADVERTENCIA: CPU: 34 PID: 654 en fs/netfs/write_collect.c:105 ... CPU: 34 PID: 654 Comm: kworker/u386 :27 Contaminado: GS... ... Cola de trabajo: events_unbound netfs_write_collection_worker... RIP: 0010:netfs_writeback_lookup_folio Solucione este problema haciendo que el lavado y la espera sean incondicionales. No har\u00e1 nada si no hay publicaciones en el cach\u00e9 de p\u00e1ginas y regresar\u00e1 r\u00e1pidamente si no hay publicaciones en la regi\u00f3n especificada. Adem\u00e1s, mueva el archivo adjunto de WBC por encima de la llamada de descarga, ya que la descarga conectar\u00e1 un WBC y lo separar\u00e1 nuevamente si no est\u00e1 presente, y dado que necesitamos uno de todos modos, tambi\u00e9n podr\u00edamos compartirlo.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/5eaf23b2e81349f6614f88396dc468fda89fc0b9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c97f59e276d4e93480f29a70accbd0d7273cf3f5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.