cve-2024-38626
Vulnerability from cvelistv5
Published
2024-06-21 10:18
Modified
2024-09-11 17:34
Severity ?
Summary
fuse: clear FR_SENT when re-adding requests into pending list
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/246014876d782bbf2e652267482cd2e799fb5fcd
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/533070db659a9589310a743e9de14cf9d651ffaf
Impacted products
LinuxLinux
LinuxLinux
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T04:12:26.061Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/533070db659a9589310a743e9de14cf9d651ffaf"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/246014876d782bbf2e652267482cd2e799fb5fcd"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-38626",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T17:09:09.210005Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:34:44.692Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/fuse/dev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "533070db659a",
              "status": "affected",
              "version": "760eac73f9f6",
              "versionType": "git"
            },
            {
              "lessThan": "246014876d78",
              "status": "affected",
              "version": "760eac73f9f6",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/fuse/dev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.9"
            },
            {
              "lessThan": "6.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "6.9.*",
              "status": "unaffected",
              "version": "6.9.4",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.10",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfuse: clear FR_SENT when re-adding requests into pending list\n\nThe following warning was reported by lee bruce:\n\n  ------------[ cut here ]------------\n  WARNING: CPU: 0 PID: 8264 at fs/fuse/dev.c:300\n  fuse_request_end+0x685/0x7e0 fs/fuse/dev.c:300\n  Modules linked in:\n  CPU: 0 PID: 8264 Comm: ab2 Not tainted 6.9.0-rc7\n  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996)\n  RIP: 0010:fuse_request_end+0x685/0x7e0 fs/fuse/dev.c:300\n  ......\n  Call Trace:\n  \u003cTASK\u003e\n  fuse_dev_do_read.constprop.0+0xd36/0x1dd0 fs/fuse/dev.c:1334\n  fuse_dev_read+0x166/0x200 fs/fuse/dev.c:1367\n  call_read_iter include/linux/fs.h:2104 [inline]\n  new_sync_read fs/read_write.c:395 [inline]\n  vfs_read+0x85b/0xba0 fs/read_write.c:476\n  ksys_read+0x12f/0x260 fs/read_write.c:619\n  do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n  do_syscall_64+0xce/0x260 arch/x86/entry/common.c:83\n  entry_SYSCALL_64_after_hwframe+0x77/0x7f\n  ......\n  \u003c/TASK\u003e\n\nThe warning is due to the FUSE_NOTIFY_RESEND notify sent by the write()\nsyscall in the reproducer program and it happens as follows:\n\n(1) calls fuse_dev_read() to read the INIT request\nThe read succeeds. During the read, bit FR_SENT will be set on the\nrequest.\n(2) calls fuse_dev_write() to send an USE_NOTIFY_RESEND notify\nThe resend notify will resend all processing requests, so the INIT\nrequest is moved from processing list to pending list again.\n(3) calls fuse_dev_read() with an invalid output address\nfuse_dev_read() will try to copy the same INIT request to the output\naddress, but it will fail due to the invalid address, so the INIT\nrequest is ended and triggers the warning in fuse_request_end().\n\nFix it by clearing FR_SENT when re-adding requests into pending list."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-07-15T06:49:20.577Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/533070db659a9589310a743e9de14cf9d651ffaf"
        },
        {
          "url": "https://git.kernel.org/stable/c/246014876d782bbf2e652267482cd2e799fb5fcd"
        }
      ],
      "title": "fuse: clear FR_SENT when re-adding requests into pending list",
      "x_generator": {
        "engine": "bippy-c9c4e1df01b2"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-38626",
    "datePublished": "2024-06-21T10:18:18.255Z",
    "dateReserved": "2024-06-18T19:36:34.945Z",
    "dateUpdated": "2024-09-11T17:34:44.692Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-38626\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-06-21T11:15:11.517\",\"lastModified\":\"2024-06-21T11:22:01.687\",\"vulnStatus\":\"Awaiting Analysis\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nfuse: clear FR_SENT when re-adding requests into pending list\\n\\nThe following warning was reported by lee bruce:\\n\\n  ------------[ cut here ]------------\\n  WARNING: CPU: 0 PID: 8264 at fs/fuse/dev.c:300\\n  fuse_request_end+0x685/0x7e0 fs/fuse/dev.c:300\\n  Modules linked in:\\n  CPU: 0 PID: 8264 Comm: ab2 Not tainted 6.9.0-rc7\\n  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996)\\n  RIP: 0010:fuse_request_end+0x685/0x7e0 fs/fuse/dev.c:300\\n  ......\\n  Call Trace:\\n  \u003cTASK\u003e\\n  fuse_dev_do_read.constprop.0+0xd36/0x1dd0 fs/fuse/dev.c:1334\\n  fuse_dev_read+0x166/0x200 fs/fuse/dev.c:1367\\n  call_read_iter include/linux/fs.h:2104 [inline]\\n  new_sync_read fs/read_write.c:395 [inline]\\n  vfs_read+0x85b/0xba0 fs/read_write.c:476\\n  ksys_read+0x12f/0x260 fs/read_write.c:619\\n  do_syscall_x64 arch/x86/entry/common.c:52 [inline]\\n  do_syscall_64+0xce/0x260 arch/x86/entry/common.c:83\\n  entry_SYSCALL_64_after_hwframe+0x77/0x7f\\n  ......\\n  \u003c/TASK\u003e\\n\\nThe warning is due to the FUSE_NOTIFY_RESEND notify sent by the write()\\nsyscall in the reproducer program and it happens as follows:\\n\\n(1) calls fuse_dev_read() to read the INIT request\\nThe read succeeds. During the read, bit FR_SENT will be set on the\\nrequest.\\n(2) calls fuse_dev_write() to send an USE_NOTIFY_RESEND notify\\nThe resend notify will resend all processing requests, so the INIT\\nrequest is moved from processing list to pending list again.\\n(3) calls fuse_dev_read() with an invalid output address\\nfuse_dev_read() will try to copy the same INIT request to the output\\naddress, but it will fail due to the invalid address, so the INIT\\nrequest is ended and triggers the warning in fuse_request_end().\\n\\nFix it by clearing FR_SENT when re-adding requests into pending list.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/246014876d782bbf2e652267482cd2e799fb5fcd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/533070db659a9589310a743e9de14cf9d651ffaf\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.