cve-2024-38626
Vulnerability from cvelistv5
Published
2024-06-21 10:18
Modified
2024-12-19 09:05
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: fuse: clear FR_SENT when re-adding requests into pending list The following warning was reported by lee bruce: ------------[ cut here ]------------ WARNING: CPU: 0 PID: 8264 at fs/fuse/dev.c:300 fuse_request_end+0x685/0x7e0 fs/fuse/dev.c:300 Modules linked in: CPU: 0 PID: 8264 Comm: ab2 Not tainted 6.9.0-rc7 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) RIP: 0010:fuse_request_end+0x685/0x7e0 fs/fuse/dev.c:300 ...... Call Trace: <TASK> fuse_dev_do_read.constprop.0+0xd36/0x1dd0 fs/fuse/dev.c:1334 fuse_dev_read+0x166/0x200 fs/fuse/dev.c:1367 call_read_iter include/linux/fs.h:2104 [inline] new_sync_read fs/read_write.c:395 [inline] vfs_read+0x85b/0xba0 fs/read_write.c:476 ksys_read+0x12f/0x260 fs/read_write.c:619 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xce/0x260 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f ...... </TASK> The warning is due to the FUSE_NOTIFY_RESEND notify sent by the write() syscall in the reproducer program and it happens as follows: (1) calls fuse_dev_read() to read the INIT request The read succeeds. During the read, bit FR_SENT will be set on the request. (2) calls fuse_dev_write() to send an USE_NOTIFY_RESEND notify The resend notify will resend all processing requests, so the INIT request is moved from processing list to pending list again. (3) calls fuse_dev_read() with an invalid output address fuse_dev_read() will try to copy the same INIT request to the output address, but it will fail due to the invalid address, so the INIT request is ended and triggers the warning in fuse_request_end(). Fix it by clearing FR_SENT when re-adding requests into pending list.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/246014876d782bbf2e652267482cd2e799fb5fcd
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/533070db659a9589310a743e9de14cf9d651ffaf
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/246014876d782bbf2e652267482cd2e799fb5fcd
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/533070db659a9589310a743e9de14cf9d651ffaf
Impacted products
Vendor Product Version
Linux Linux Version: 6.9
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T04:12:26.061Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/533070db659a9589310a743e9de14cf9d651ffaf"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/246014876d782bbf2e652267482cd2e799fb5fcd"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-38626",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T17:09:09.210005Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:34:44.692Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/fuse/dev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "533070db659a9589310a743e9de14cf9d651ffaf",
              "status": "affected",
              "version": "760eac73f9f69aa28fcb3050b4946c2dcc656d12",
              "versionType": "git"
            },
            {
              "lessThan": "246014876d782bbf2e652267482cd2e799fb5fcd",
              "status": "affected",
              "version": "760eac73f9f69aa28fcb3050b4946c2dcc656d12",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/fuse/dev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.9"
            },
            {
              "lessThan": "6.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.9.*",
              "status": "unaffected",
              "version": "6.9.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.10",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfuse: clear FR_SENT when re-adding requests into pending list\n\nThe following warning was reported by lee bruce:\n\n  ------------[ cut here ]------------\n  WARNING: CPU: 0 PID: 8264 at fs/fuse/dev.c:300\n  fuse_request_end+0x685/0x7e0 fs/fuse/dev.c:300\n  Modules linked in:\n  CPU: 0 PID: 8264 Comm: ab2 Not tainted 6.9.0-rc7\n  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996)\n  RIP: 0010:fuse_request_end+0x685/0x7e0 fs/fuse/dev.c:300\n  ......\n  Call Trace:\n  \u003cTASK\u003e\n  fuse_dev_do_read.constprop.0+0xd36/0x1dd0 fs/fuse/dev.c:1334\n  fuse_dev_read+0x166/0x200 fs/fuse/dev.c:1367\n  call_read_iter include/linux/fs.h:2104 [inline]\n  new_sync_read fs/read_write.c:395 [inline]\n  vfs_read+0x85b/0xba0 fs/read_write.c:476\n  ksys_read+0x12f/0x260 fs/read_write.c:619\n  do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n  do_syscall_64+0xce/0x260 arch/x86/entry/common.c:83\n  entry_SYSCALL_64_after_hwframe+0x77/0x7f\n  ......\n  \u003c/TASK\u003e\n\nThe warning is due to the FUSE_NOTIFY_RESEND notify sent by the write()\nsyscall in the reproducer program and it happens as follows:\n\n(1) calls fuse_dev_read() to read the INIT request\nThe read succeeds. During the read, bit FR_SENT will be set on the\nrequest.\n(2) calls fuse_dev_write() to send an USE_NOTIFY_RESEND notify\nThe resend notify will resend all processing requests, so the INIT\nrequest is moved from processing list to pending list again.\n(3) calls fuse_dev_read() with an invalid output address\nfuse_dev_read() will try to copy the same INIT request to the output\naddress, but it will fail due to the invalid address, so the INIT\nrequest is ended and triggers the warning in fuse_request_end().\n\nFix it by clearing FR_SENT when re-adding requests into pending list."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-19T09:05:55.923Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/533070db659a9589310a743e9de14cf9d651ffaf"
        },
        {
          "url": "https://git.kernel.org/stable/c/246014876d782bbf2e652267482cd2e799fb5fcd"
        }
      ],
      "title": "fuse: clear FR_SENT when re-adding requests into pending list",
      "x_generator": {
        "engine": "bippy-5f407fcff5a0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-38626",
    "datePublished": "2024-06-21T10:18:18.255Z",
    "dateReserved": "2024-06-18T19:36:34.945Z",
    "dateUpdated": "2024-12-19T09:05:55.923Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-38626\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-06-21T11:15:11.517\",\"lastModified\":\"2024-11-21T09:26:31.267\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nfuse: clear FR_SENT when re-adding requests into pending list\\n\\nThe following warning was reported by lee bruce:\\n\\n  ------------[ cut here ]------------\\n  WARNING: CPU: 0 PID: 8264 at fs/fuse/dev.c:300\\n  fuse_request_end+0x685/0x7e0 fs/fuse/dev.c:300\\n  Modules linked in:\\n  CPU: 0 PID: 8264 Comm: ab2 Not tainted 6.9.0-rc7\\n  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996)\\n  RIP: 0010:fuse_request_end+0x685/0x7e0 fs/fuse/dev.c:300\\n  ......\\n  Call Trace:\\n  \u003cTASK\u003e\\n  fuse_dev_do_read.constprop.0+0xd36/0x1dd0 fs/fuse/dev.c:1334\\n  fuse_dev_read+0x166/0x200 fs/fuse/dev.c:1367\\n  call_read_iter include/linux/fs.h:2104 [inline]\\n  new_sync_read fs/read_write.c:395 [inline]\\n  vfs_read+0x85b/0xba0 fs/read_write.c:476\\n  ksys_read+0x12f/0x260 fs/read_write.c:619\\n  do_syscall_x64 arch/x86/entry/common.c:52 [inline]\\n  do_syscall_64+0xce/0x260 arch/x86/entry/common.c:83\\n  entry_SYSCALL_64_after_hwframe+0x77/0x7f\\n  ......\\n  \u003c/TASK\u003e\\n\\nThe warning is due to the FUSE_NOTIFY_RESEND notify sent by the write()\\nsyscall in the reproducer program and it happens as follows:\\n\\n(1) calls fuse_dev_read() to read the INIT request\\nThe read succeeds. During the read, bit FR_SENT will be set on the\\nrequest.\\n(2) calls fuse_dev_write() to send an USE_NOTIFY_RESEND notify\\nThe resend notify will resend all processing requests, so the INIT\\nrequest is moved from processing list to pending list again.\\n(3) calls fuse_dev_read() with an invalid output address\\nfuse_dev_read() will try to copy the same INIT request to the output\\naddress, but it will fail due to the invalid address, so the INIT\\nrequest is ended and triggers the warning in fuse_request_end().\\n\\nFix it by clearing FR_SENT when re-adding requests into pending list.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: fusible: borre FR_SENT al volver a agregar solicitudes a la lista pendiente Lee bruce inform\u00f3 la siguiente advertencia: ------------[ cortar aqu\u00ed ]- ----------- ADVERTENCIA: CPU: 0 PID: 8264 en fs/fuse/dev.c:300 fuse_request_end+0x685/0x7e0 fs/fuse/dev.c:300 M\u00f3dulos vinculados en: CPU: 0 PID: 8264 Comm: ab2 No contaminado 6.9.0-rc7 Nombre del hardware: PC est\u00e1ndar QEMU (i440FX + PIIX, 1996) RIP: 0010:fuse_request_end+0x685/0x7e0 fs/fuse/dev.c:300 ...... Seguimiento de llamadas:  fuse_dev_do_read.constprop.0+0xd36/0x1dd0 fs/fuse/dev.c:1334 fuse_dev_read+0x166/0x200 fs/fuse/dev.c:1367 call_read_iter include/linux/fs.h:2104 [en l\u00ednea ] new_sync_read fs/read_write.c:395 [en l\u00ednea] vfs_read+0x85b/0xba0 fs/read_write.c:476 ksys_read+0x12f/0x260 fs/read_write.c:619 do_syscall_x64 arch/x86/entry/common.c:52 [en l\u00ednea ] do_syscall_64+0xce/0x260 arch/x86/entry/common.c:83 Entry_SYSCALL_64_after_hwframe+0x77/0x7f ......  La advertencia se debe a la notificaci\u00f3n FUSE_NOTIFY_RESEND enviada por la llamada al sistema write() en el reproductor programa y sucede de la siguiente manera: (1) llama a fuse_dev_read() para leer la solicitud INIT La lectura se realiza correctamente. Durante la lectura, se establecer\u00e1 el bit FR_SENT en la solicitud. (2) llama a fuse_dev_write() para enviar una notificaci\u00f3n USE_NOTIFY_RESEND. La notificaci\u00f3n de reenv\u00edo reenviar\u00e1 todas las solicitudes de procesamiento, por lo que la solicitud INIT se mueve nuevamente de la lista de procesamiento a la lista pendiente. (3) llama a fuse_dev_read() con una direcci\u00f3n de salida no v\u00e1lida. fuse_dev_read() intentar\u00e1 copiar la misma solicitud INIT a la direcci\u00f3n de salida, pero fallar\u00e1 debido a la direcci\u00f3n no v\u00e1lida, por lo que la solicitud INIT finaliza y activa la advertencia en fuse_request_end (). Solucionelo borrando FR_SENT al volver a agregar solicitudes a la lista pendiente.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/246014876d782bbf2e652267482cd2e799fb5fcd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/533070db659a9589310a743e9de14cf9d651ffaf\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/246014876d782bbf2e652267482cd2e799fb5fcd\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://git.kernel.org/stable/c/533070db659a9589310a743e9de14cf9d651ffaf\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.