GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-40943 (GCVE-0-2024-40943)

Vulnerability from cvelistv5 – Published: 2024-07-12 12:25 – Updated: 2026-08-05 11:34
VLAI
Title
ocfs2: fix races between hole punching and AIO+DIO
Summary
In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix races between hole punching and AIO+DIO After commit "ocfs2: return real error code in ocfs2_dio_wr_get_block", fstests/generic/300 become from always failed to sometimes failed: ======================================================================== [ 473.293420 ] run fstests generic/300 [ 475.296983 ] JBD2: Ignoring recovery information on journal [ 475.302473 ] ocfs2: Mounting device (253,1) on (node local, slot 0) with ordered data mode. [ 494.290998 ] OCFS2: ERROR (device dm-1): ocfs2_change_extent_flag: Owner 5668 has an extent at cpos 78723 which can no longer be found [ 494.291609 ] On-disk corruption discovered. Please run fsck.ocfs2 once the filesystem is unmounted. [ 494.292018 ] OCFS2: File system is now read-only. [ 494.292224 ] (kworker/19:11,2628,19):ocfs2_mark_extent_written:5272 ERROR: status = -30 [ 494.292602 ] (kworker/19:11,2628,19):ocfs2_dio_end_io_write:2374 ERROR: status = -3 fio: io_u error on file /mnt/scratch/racer: Read-only file system: write offset=460849152, buflen=131072 ========================================================================= In __blockdev_direct_IO, ocfs2_dio_wr_get_block is called to add unwritten extents to a list. extents are also inserted into extent tree in ocfs2_write_begin_nolock. Then another thread call fallocate to puch a hole at one of the unwritten extent. The extent at cpos was removed by ocfs2_remove_extent(). At end io worker thread, ocfs2_search_extent_list found there is no such extent at the cpos. T1 T2 T3 inode lock ... insert extents ... inode unlock ocfs2_fallocate __ocfs2_change_file_space inode lock lock ip_alloc_sem ocfs2_remove_inode_range inode ocfs2_remove_btree_range ocfs2_remove_extent ^---remove the extent at cpos 78723 ... unlock ip_alloc_sem inode unlock ocfs2_dio_end_io ocfs2_dio_end_io_write lock ip_alloc_sem ocfs2_mark_extent_written ocfs2_change_extent_flag ocfs2_search_extent_list ^---failed to find extent ... unlock ip_alloc_sem In most filesystems, fallocate is not compatible with racing with AIO+DIO, so fix it by adding to wait for all dio before fallocate/punch_hole like ext4.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-10 17:04 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: b25801038da5823bba1b5440a57ca68afc51b6bd , < 3c26b5d21b1239e9c7fd31ba7d9b2d7bdbaa68d9 (git)
Affected: b25801038da5823bba1b5440a57ca68afc51b6bd , < e8e2db1adac47970a6a9225f3858e9aa0e86287f (git)
Affected: b25801038da5823bba1b5440a57ca68afc51b6bd , < 050ce8af6838c71e872e982b50d3f1bec21da40e (git)
Affected: b25801038da5823bba1b5440a57ca68afc51b6bd , < 38825ff9da91d2854dcf6d9ac320a7e641e10f25 (git)
Affected: b25801038da5823bba1b5440a57ca68afc51b6bd , < ea042dc2bea19d72e37c298bf65a9c341ef3fff3 (git)
Affected: b25801038da5823bba1b5440a57ca68afc51b6bd , < 3c361f313d696df72f9bccf058510e9ec737b9b1 (git)
Affected: b25801038da5823bba1b5440a57ca68afc51b6bd , < 117b9c009b72a6c2ebfd23484354dfee2d9570d2 (git)
Affected: b25801038da5823bba1b5440a57ca68afc51b6bd , < 952b023f06a24b2ad6ba67304c4c84d45bea2f18 (git)
guessed Create a notification for this product.
Linux Linux Affected: 2.6.23
Unaffected: 0 , < 2.6.23 (semver)
Unaffected: 4.19.317 , ≤ 4.19.* (semver)
Unaffected: 5.4.279 , ≤ 5.4.* (semver)
Unaffected: 5.10.221 , ≤ 5.10.* (semver)
Unaffected: 5.15.162 , ≤ 5.15.* (semver)
Unaffected: 6.1.95 , ≤ 6.1.* (semver)
Unaffected: 6.6.35 , ≤ 6.6.* (semver)
Unaffected: 6.9.6 , ≤ 6.9.* (semver)
Unaffected: 6.10 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T21:58:12.745Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/3c26b5d21b1239e9c7fd31ba7d9b2d7bdbaa68d9"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/e8e2db1adac47970a6a9225f3858e9aa0e86287f"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/050ce8af6838c71e872e982b50d3f1bec21da40e"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/38825ff9da91d2854dcf6d9ac320a7e641e10f25"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/ea042dc2bea19d72e37c298bf65a9c341ef3fff3"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/3c361f313d696df72f9bccf058510e9ec737b9b1"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/117b9c009b72a6c2ebfd23484354dfee2d9570d2"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/952b023f06a24b2ad6ba67304c4c84d45bea2f18"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-40943",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T17:04:20.780555Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:34:25.580Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/ocfs2/file.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3c26b5d21b1239e9c7fd31ba7d9b2d7bdbaa68d9",
              "status": "affected",
              "version": "b25801038da5823bba1b5440a57ca68afc51b6bd",
              "versionType": "git"
            },
            {
              "lessThan": "e8e2db1adac47970a6a9225f3858e9aa0e86287f",
              "status": "affected",
              "version": "b25801038da5823bba1b5440a57ca68afc51b6bd",
              "versionType": "git"
            },
            {
              "lessThan": "050ce8af6838c71e872e982b50d3f1bec21da40e",
              "status": "affected",
              "version": "b25801038da5823bba1b5440a57ca68afc51b6bd",
              "versionType": "git"
            },
            {
              "lessThan": "38825ff9da91d2854dcf6d9ac320a7e641e10f25",
              "status": "affected",
              "version": "b25801038da5823bba1b5440a57ca68afc51b6bd",
              "versionType": "git"
            },
            {
              "lessThan": "ea042dc2bea19d72e37c298bf65a9c341ef3fff3",
              "status": "affected",
              "version": "b25801038da5823bba1b5440a57ca68afc51b6bd",
              "versionType": "git"
            },
            {
              "lessThan": "3c361f313d696df72f9bccf058510e9ec737b9b1",
              "status": "affected",
              "version": "b25801038da5823bba1b5440a57ca68afc51b6bd",
              "versionType": "git"
            },
            {
              "lessThan": "117b9c009b72a6c2ebfd23484354dfee2d9570d2",
              "status": "affected",
              "version": "b25801038da5823bba1b5440a57ca68afc51b6bd",
              "versionType": "git"
            },
            {
              "lessThan": "952b023f06a24b2ad6ba67304c4c84d45bea2f18",
              "status": "affected",
              "version": "b25801038da5823bba1b5440a57ca68afc51b6bd",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/ocfs2/file.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.23"
            },
            {
              "lessThan": "2.6.23",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.317",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.279",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.162",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.95",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.35",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.9.*",
              "status": "unaffected",
              "version": "6.9.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.10",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.317",
                  "versionStartIncluding": "2.6.23",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.279",
                  "versionStartIncluding": "2.6.23",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.221",
                  "versionStartIncluding": "2.6.23",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.162",
                  "versionStartIncluding": "2.6.23",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.95",
                  "versionStartIncluding": "2.6.23",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.35",
                  "versionStartIncluding": "2.6.23",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9.6",
                  "versionStartIncluding": "2.6.23",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10",
                  "versionStartIncluding": "2.6.23",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: fix races between hole punching and AIO+DIO\n\nAfter commit \"ocfs2: return real error code in ocfs2_dio_wr_get_block\",\nfstests/generic/300 become from always failed to sometimes failed:\n\n========================================================================\n[  473.293420 ] run fstests generic/300\n\n[  475.296983 ] JBD2: Ignoring recovery information on journal\n[  475.302473 ] ocfs2: Mounting device (253,1) on (node local, slot 0) with ordered data mode.\n[  494.290998 ] OCFS2: ERROR (device dm-1): ocfs2_change_extent_flag: Owner 5668 has an extent at cpos 78723 which can no longer be found\n[  494.291609 ] On-disk corruption discovered. Please run fsck.ocfs2 once the filesystem is unmounted.\n[  494.292018 ] OCFS2: File system is now read-only.\n[  494.292224 ] (kworker/19:11,2628,19):ocfs2_mark_extent_written:5272 ERROR: status = -30\n[  494.292602 ] (kworker/19:11,2628,19):ocfs2_dio_end_io_write:2374 ERROR: status = -3\nfio: io_u error on file /mnt/scratch/racer: Read-only file system: write offset=460849152, buflen=131072\n=========================================================================\n\nIn __blockdev_direct_IO, ocfs2_dio_wr_get_block is called to add unwritten\nextents to a list.  extents are also inserted into extent tree in\nocfs2_write_begin_nolock.  Then another thread call fallocate to puch a\nhole at one of the unwritten extent.  The extent at cpos was removed by\nocfs2_remove_extent().  At end io worker thread, ocfs2_search_extent_list\nfound there is no such extent at the cpos.\n\n    T1                        T2                T3\n                              inode lock\n                                ...\n                                insert extents\n                                ...\n                              inode unlock\nocfs2_fallocate\n __ocfs2_change_file_space\n  inode lock\n  lock ip_alloc_sem\n  ocfs2_remove_inode_range inode\n   ocfs2_remove_btree_range\n    ocfs2_remove_extent\n    ^---remove the extent at cpos 78723\n  ...\n  unlock ip_alloc_sem\n  inode unlock\n                                       ocfs2_dio_end_io\n                                        ocfs2_dio_end_io_write\n                                         lock ip_alloc_sem\n                                         ocfs2_mark_extent_written\n                                          ocfs2_change_extent_flag\n                                           ocfs2_search_extent_list\n                                           ^---failed to find extent\n                                          ...\n                                          unlock ip_alloc_sem\n\nIn most filesystems, fallocate is not compatible with racing with AIO+DIO,\nso fix it by adding to wait for all dio before fallocate/punch_hole like\next4."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The race is driven entirely by local syscalls \u2014 `io_submit()`/`io_uring` O_DIRECT writes reaching `ocfs2_dio_wr_get_block()` and `fallocate(FALLOC_FL_PUNCH_HOLE)`/`OCFS2_IOC_UNRESVSP` reaching `__ocfs2_change_file_space()` on an already-mounted ocfs2 volume. No remote peer or packet data reaches the vulnerable path; ocfs2 is a shared-disk cluster filesystem, not a network server.\nAC:L - The attacker owns both sides of the race: one thread issues async O_DIRECT writes that return `-EIOCBQUEUED` and defer `ocfs2_dio_end_io_write()`, while another calls `fallocate(PUNCH_HOLE)` over the same range, and the sequence can be looped indefinitely at no cost until it lands. Nothing depends on state outside the attacker\u0027s influence \u2014 the `unwritten` feature bit required by `ocfs2_fallocate()` is the mkfs.ocfs2 default, and the upstream reproducer (fstests generic/300) hits it with an ordinary fio racer workload.\nPR:L - Only an unprivileged local account with write access to a file on the ocfs2 volume is needed \u2014 `ocfs2_fallocate()` has no capability check and `ocfs2_change_file_space()` gates solely on `S_ISREG` plus `FMODE_WRITE` on the caller\u0027s own fd. No CAP_SYS_ADMIN, no user-namespace trick, and no root is required, since the attacker races only on a file it already owns.\nUI:N - The attacker performs the whole sequence from its own processes with no action by any other user. The ocfs2 volume is already mounted in the normal deployment (a cluster shared-storage node), so no victim mount or file open is involved.\nS:U - The corrupted extent tree, the freed-then-rewritten clusters, and the forced-read-only superblock all live within the kernel\u0027s own security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - `ocfs2_change_extent_flag()` builds `split_rec.e_blkno` from the stale `ue_phys` captured before the punch and never validates it against the record it found (`fs/ocfs2/alloc.c:5232`), so once a re-write repopulates an unwritten extent at that `cpos` the split installs a mapping to clusters that `ocfs2_truncate_log_append()` already released to the global bitmap and handed to another inode. The attacker\u0027s file then aliases another user\u0027s data blocks \u2014 an arbitrary read of other users\u0027 file contents across every node of the cluster \u2014 and with `errors=continue` the volume keeps serving that inconsistent metadata.\nI:H - The punch frees the clusters into the truncate log and flushes them for reuse while the DIO\u0027s data BIOs are still in flight to those exact physical blocks, so attacker-controlled bytes overwrite whatever inode was subsequently allocated them, and the stale-`e_blkno` split additionally grants a persistent write alias into another user\u0027s file. The result is on-disk corruption that the kernel itself reports as requiring offline `fsck.ocfs2` to repair.\nA:H - `ocfs2_change_extent_flag()` calls `ocfs2_error()`, and `ocfs2_handle_error()` (`fs/ocfs2/super.c:2482`) either calls `panic()` under the cluster-typical `errors=panic` or, by default, sets `SB_RDONLY` and prints \"File system is now read-only\" \u2014 an unprivileged user can thus take the entire shared volume offline for every process on the node. Recovery requires unmounting cluster-wide and running fsck, and the trigger can be repeated at will."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:34:09.554Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3c26b5d21b1239e9c7fd31ba7d9b2d7bdbaa68d9"
        },
        {
          "url": "https://git.kernel.org/stable/c/e8e2db1adac47970a6a9225f3858e9aa0e86287f"
        },
        {
          "url": "https://git.kernel.org/stable/c/050ce8af6838c71e872e982b50d3f1bec21da40e"
        },
        {
          "url": "https://git.kernel.org/stable/c/38825ff9da91d2854dcf6d9ac320a7e641e10f25"
        },
        {
          "url": "https://git.kernel.org/stable/c/ea042dc2bea19d72e37c298bf65a9c341ef3fff3"
        },
        {
          "url": "https://git.kernel.org/stable/c/3c361f313d696df72f9bccf058510e9ec737b9b1"
        },
        {
          "url": "https://git.kernel.org/stable/c/117b9c009b72a6c2ebfd23484354dfee2d9570d2"
        },
        {
          "url": "https://git.kernel.org/stable/c/952b023f06a24b2ad6ba67304c4c84d45bea2f18"
        }
      ],
      "title": "ocfs2: fix races between hole punching and AIO+DIO",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-40943",
    "datePublished": "2024-07-12T12:25:17.813Z",
    "dateReserved": "2024-07-12T12:17:45.588Z",
    "dateUpdated": "2026-08-05T11:34:09.554Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-40943",
      "date": "2026-09-18",
      "epss": "0.00197",
      "percentile": "0.0983"
    },
    "fkie_nvd": {
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: fix races between hole punching and AIO+DIO\n\nAfter commit \"ocfs2: return real error code in ocfs2_dio_wr_get_block\",\nfstests/generic/300 become from always failed to sometimes failed:\n\n========================================================================\n[  473.293420 ] run fstests generic/300\n\n[  475.296983 ] JBD2: Ignoring recovery information on journal\n[  475.302473 ] ocfs2: Mounting device (253,1) on (node local, slot 0) with ordered data mode.\n[  494.290998 ] OCFS2: ERROR (device dm-1): ocfs2_change_extent_flag: Owner 5668 has an extent at cpos 78723 which can no longer be found\n[  494.291609 ] On-disk corruption discovered. Please run fsck.ocfs2 once the filesystem is unmounted.\n[  494.292018 ] OCFS2: File system is now read-only.\n[  494.292224 ] (kworker/19:11,2628,19):ocfs2_mark_extent_written:5272 ERROR: status = -30\n[  494.292602 ] (kworker/19:11,2628,19):ocfs2_dio_end_io_write:2374 ERROR: status = -3\nfio: io_u error on file /mnt/scratch/racer: Read-only file system: write offset=460849152, buflen=131072\n=========================================================================\n\nIn __blockdev_direct_IO, ocfs2_dio_wr_get_block is called to add unwritten\nextents to a list.  extents are also inserted into extent tree in\nocfs2_write_begin_nolock.  Then another thread call fallocate to puch a\nhole at one of the unwritten extent.  The extent at cpos was removed by\nocfs2_remove_extent().  At end io worker thread, ocfs2_search_extent_list\nfound there is no such extent at the cpos.\n\n    T1                        T2                T3\n                              inode lock\n                                ...\n                                insert extents\n                                ...\n                              inode unlock\nocfs2_fallocate\n __ocfs2_change_file_space\n  inode lock\n  lock ip_alloc_sem\n  ocfs2_remove_inode_range inode\n   ocfs2_remove_btree_range\n    ocfs2_remove_extent\n    ^---remove the extent at cpos 78723\n  ...\n  unlock ip_alloc_sem\n  inode unlock\n                                       ocfs2_dio_end_io\n                                        ocfs2_dio_end_io_write\n                                         lock ip_alloc_sem\n                                         ocfs2_mark_extent_written\n                                          ocfs2_change_extent_flag\n                                           ocfs2_search_extent_list\n                                           ^---failed to find extent\n                                          ...\n                                          unlock ip_alloc_sem\n\nIn most filesystems, fallocate is not compatible with racing with AIO+DIO,\nso fix it by adding to wait for all dio before fallocate/punch_hole like\next4."
        },
        {
          "lang": "es",
          "value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: ocfs2: corrige ejecuciones entre perforaci\u00f3n y AIO+DIO Despu\u00e9s de confirmar \"ocfs2: devuelve c\u00f3digo de error real en ocfs2_dio_wr_get_block\", fstests/generic/300 pasa de siempre fall\u00f3 a a veces fall\u00f3: = ==================================================== ===================== [ 473.293420 ] ejecute fstests generic/300 [ 475.296983 ] JBD2: ignorando la informaci\u00f3n de recuperaci\u00f3n en el diario [ 475.302473 ] ocfs2: Dispositivo de montaje (253,1 ) en (nodo local, ranura 0) con modo de datos ordenados. [ 494.290998 ] OCFS2: ERROR (dispositivo dm-1): ocfs2_change_extent_flag: El propietario 5668 tiene una extensi\u00f3n en cpos 78723 que ya no se puede encontrar [ 494.291609 ] Se descubri\u00f3 corrupci\u00f3n en el disco. Ejecute fsck.ocfs2 una vez que el sistema de archivos est\u00e9 desmontado. [ 494.292018 ] OCFS2: el sistema de archivos ahora es de solo lectura. [ 494.292224 ] (kworker/19:11,2628,19):ocfs2_mark_extent_write:5272 ERROR: estado = -30 [ 494.292602 ] (kworker/19:11,2628,19):ocfs2_dio_end_io_write:2374 ERROR: estado = -3 fio: Error io_u en el archivo /mnt/scratch/racer: sistema de archivos de solo lectura: escritura offset=460849152, buflen=131072 ========================== ================================================= En __blockdev_direct_IO , se llama a ocfs2_dio_wr_get_block para agregar extensiones no escritas a una lista. Las extensiones tambi\u00e9n se insertan en el \u00e1rbol de extensiones en ocfs2_write_begin_nolock. Luego, otro hilo llama a fallocate para hacer un agujero en una de las extensiones no escritas. La extensi\u00f3n en cpos fue eliminada por ocfs2_remove_extent(). Al final del hilo de trabajo de io, ocfs2_search_extent_list descubri\u00f3 que no existe tal extensi\u00f3n en los cpos. T1 T2 T3 bloqueo de inodo... insertar extensiones... desbloqueo de inodo ocfs2_fallocate __ocfs2_change_file_space bloqueo de inodo bloqueo ip_alloc_sem ocfs2_remove_inode_range inodo ocfs2_remove_btree_range ocfs2_remove_extent ^---eliminar la extensi\u00f3n en cpos 78723... desbloquear inodo ip_alloc_sem desbloquear ocfs2_dio_end_io ocfs2_dio_end_io_write bloquear ip_alloc_sem ocfs2_mark_extent_writing ocfs2_change_extent_flag ocfs2_search_extent_list ^ ---no se pudo encontrar la extensi\u00f3n... desbloquear ip_alloc_sem En la mayor\u00eda de los sistemas de archivos, fallocate no es compatible con ejecuciones con AIO+DIO, as\u00ed que solucionelo agregando esperar a que todos los dio antes de fallocate/punch_hole como ext4."
        }
      ],
      "id": "CVE-2024-40943",
      "lastModified": "2024-11-21T09:31:55.223",
      "published": "2024-07-12T13:15:16.670",
      "references": [
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/050ce8af6838c71e872e982b50d3f1bec21da40e"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/117b9c009b72a6c2ebfd23484354dfee2d9570d2"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/38825ff9da91d2854dcf6d9ac320a7e641e10f25"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/3c26b5d21b1239e9c7fd31ba7d9b2d7bdbaa68d9"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/3c361f313d696df72f9bccf058510e9ec737b9b1"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/952b023f06a24b2ad6ba67304c4c84d45bea2f18"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/e8e2db1adac47970a6a9225f3858e9aa0e86287f"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/ea042dc2bea19d72e37c298bf65a9c341ef3fff3"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://git.kernel.org/stable/c/050ce8af6838c71e872e982b50d3f1bec21da40e"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://git.kernel.org/stable/c/117b9c009b72a6c2ebfd23484354dfee2d9570d2"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://git.kernel.org/stable/c/38825ff9da91d2854dcf6d9ac320a7e641e10f25"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://git.kernel.org/stable/c/3c26b5d21b1239e9c7fd31ba7d9b2d7bdbaa68d9"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://git.kernel.org/stable/c/3c361f313d696df72f9bccf058510e9ec737b9b1"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://git.kernel.org/stable/c/952b023f06a24b2ad6ba67304c4c84d45bea2f18"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://git.kernel.org/stable/c/e8e2db1adac47970a6a9225f3858e9aa0e86287f"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://git.kernel.org/stable/c/ea042dc2bea19d72e37c298bf65a9c341ef3fff3"
        }
      ],
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/ocfs2/file.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "3c26b5d21b1239e9c7fd31ba7d9b2d7bdbaa68d9",
                    "status": "affected",
                    "version": "b25801038da5823bba1b5440a57ca68afc51b6bd",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "e8e2db1adac47970a6a9225f3858e9aa0e86287f",
                    "status": "affected",
                    "version": "b25801038da5823bba1b5440a57ca68afc51b6bd",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "050ce8af6838c71e872e982b50d3f1bec21da40e",
                    "status": "affected",
                    "version": "b25801038da5823bba1b5440a57ca68afc51b6bd",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "38825ff9da91d2854dcf6d9ac320a7e641e10f25",
                    "status": "affected",
                    "version": "b25801038da5823bba1b5440a57ca68afc51b6bd",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "ea042dc2bea19d72e37c298bf65a9c341ef3fff3",
                    "status": "affected",
                    "version": "b25801038da5823bba1b5440a57ca68afc51b6bd",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "3c361f313d696df72f9bccf058510e9ec737b9b1",
                    "status": "affected",
                    "version": "b25801038da5823bba1b5440a57ca68afc51b6bd",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "117b9c009b72a6c2ebfd23484354dfee2d9570d2",
                    "status": "affected",
                    "version": "b25801038da5823bba1b5440a57ca68afc51b6bd",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "952b023f06a24b2ad6ba67304c4c84d45bea2f18",
                    "status": "affected",
                    "version": "b25801038da5823bba1b5440a57ca68afc51b6bd",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "fs/ocfs2/file.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "2.6.23"
                  },
                  {
                    "lessThan": "2.6.23",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "4.19.*",
                    "status": "unaffected",
                    "version": "4.19.317",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.4.*",
                    "status": "unaffected",
                    "version": "5.4.279",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.221",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.162",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.95",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.35",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.9.*",
                    "status": "unaffected",
                    "version": "6.9.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.10",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "36C38963-647B-4244-A22C-EC571CE1ACEF",
                    "versionEndExcluding": "4.19.317",
                    "versionStartIncluding": "2.6.23",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "F4E38E58-1B9F-4DF2-AD3D-A8BEAA2959D8",
                    "versionEndExcluding": "5.4.279",
                    "versionStartIncluding": "4.20",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "659E1520-6345-41AF-B893-A7C0647585A0",
                    "versionEndExcluding": "5.10.221",
                    "versionStartIncluding": "5.5",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "10A39ACC-3005-40E8-875C-98A372D1FFD5",
                    "versionEndExcluding": "5.15.162",
                    "versionStartIncluding": "5.11",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "D435765D-2766-44F5-B319-F713A13E35CE",
                    "versionEndExcluding": "6.1.95",
                    "versionStartIncluding": "5.16",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "6F019D15-84C0-416B-8C57-7F51B68992F0",
                    "versionEndExcluding": "6.6.35",
                    "versionStartIncluding": "6.2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "0ABBBA1D-F79D-4BDB-AA41-D1EDCC4A6975",
                    "versionEndExcluding": "6.9.6",
                    "versionStartIncluding": "6.7",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: fix races between hole punching and AIO+DIO\n\nAfter commit \"ocfs2: return real error code in ocfs2_dio_wr_get_block\",\nfstests/generic/300 become from always failed to sometimes failed:\n\n========================================================================\n[  473.293420 ] run fstests generic/300\n\n[  475.296983 ] JBD2: Ignoring recovery information on journal\n[  475.302473 ] ocfs2: Mounting device (253,1) on (node local, slot 0) with ordered data mode.\n[  494.290998 ] OCFS2: ERROR (device dm-1): ocfs2_change_extent_flag: Owner 5668 has an extent at cpos 78723 which can no longer be found\n[  494.291609 ] On-disk corruption discovered. Please run fsck.ocfs2 once the filesystem is unmounted.\n[  494.292018 ] OCFS2: File system is now read-only.\n[  494.292224 ] (kworker/19:11,2628,19):ocfs2_mark_extent_written:5272 ERROR: status = -30\n[  494.292602 ] (kworker/19:11,2628,19):ocfs2_dio_end_io_write:2374 ERROR: status = -3\nfio: io_u error on file /mnt/scratch/racer: Read-only file system: write offset=460849152, buflen=131072\n=========================================================================\n\nIn __blockdev_direct_IO, ocfs2_dio_wr_get_block is called to add unwritten\nextents to a list.  extents are also inserted into extent tree in\nocfs2_write_begin_nolock.  Then another thread call fallocate to puch a\nhole at one of the unwritten extent.  The extent at cpos was removed by\nocfs2_remove_extent().  At end io worker thread, ocfs2_search_extent_list\nfound there is no such extent at the cpos.\n\n    T1                        T2                T3\n                              inode lock\n                                ...\n                                insert extents\n                                ...\n                              inode unlock\nocfs2_fallocate\n __ocfs2_change_file_space\n  inode lock\n  lock ip_alloc_sem\n  ocfs2_remove_inode_range inode\n   ocfs2_remove_btree_range\n    ocfs2_remove_extent\n    ^---remove the extent at cpos 78723\n  ...\n  unlock ip_alloc_sem\n  inode unlock\n                                       ocfs2_dio_end_io\n                                        ocfs2_dio_end_io_write\n                                         lock ip_alloc_sem\n                                         ocfs2_mark_extent_written\n                                          ocfs2_change_extent_flag\n                                           ocfs2_search_extent_list\n                                           ^---failed to find extent\n                                          ...\n                                          unlock ip_alloc_sem\n\nIn most filesystems, fallocate is not compatible with racing with AIO+DIO,\nso fix it by adding to wait for all dio before fallocate/punch_hole like\next4."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: ocfs2: corrige ejecuciones entre perforaci\u00f3n y AIO+DIO Despu\u00e9s de confirmar \"ocfs2: devuelve c\u00f3digo de error real en ocfs2_dio_wr_get_block\", fstests/generic/300 pasa de siempre fall\u00f3 a a veces fall\u00f3: = ==================================================== ===================== [ 473.293420 ] ejecute fstests generic/300 [ 475.296983 ] JBD2: ignorando la informaci\u00f3n de recuperaci\u00f3n en el diario [ 475.302473 ] ocfs2: Dispositivo de montaje (253,1 ) en (nodo local, ranura 0) con modo de datos ordenados. [ 494.290998 ] OCFS2: ERROR (dispositivo dm-1): ocfs2_change_extent_flag: El propietario 5668 tiene una extensi\u00f3n en cpos 78723 que ya no se puede encontrar [ 494.291609 ] Se descubri\u00f3 corrupci\u00f3n en el disco. Ejecute fsck.ocfs2 una vez que el sistema de archivos est\u00e9 desmontado. [ 494.292018 ] OCFS2: el sistema de archivos ahora es de solo lectura. [ 494.292224 ] (kworker/19:11,2628,19):ocfs2_mark_extent_write:5272 ERROR: estado = -30 [ 494.292602 ] (kworker/19:11,2628,19):ocfs2_dio_end_io_write:2374 ERROR: estado = -3 fio: Error io_u en el archivo /mnt/scratch/racer: sistema de archivos de solo lectura: escritura offset=460849152, buflen=131072 ========================== ================================================= En __blockdev_direct_IO , se llama a ocfs2_dio_wr_get_block para agregar extensiones no escritas a una lista. Las extensiones tambi\u00e9n se insertan en el \u00e1rbol de extensiones en ocfs2_write_begin_nolock. Luego, otro hilo llama a fallocate para hacer un agujero en una de las extensiones no escritas. La extensi\u00f3n en cpos fue eliminada por ocfs2_remove_extent(). Al final del hilo de trabajo de io, ocfs2_search_extent_list descubri\u00f3 que no existe tal extensi\u00f3n en los cpos. T1 T2 T3 bloqueo de inodo... insertar extensiones... desbloqueo de inodo ocfs2_fallocate __ocfs2_change_file_space bloqueo de inodo bloqueo ip_alloc_sem ocfs2_remove_inode_range inodo ocfs2_remove_btree_range ocfs2_remove_extent ^---eliminar la extensi\u00f3n en cpos 78723... desbloquear inodo ip_alloc_sem desbloquear ocfs2_dio_end_io ocfs2_dio_end_io_write bloquear ip_alloc_sem ocfs2_mark_extent_writing ocfs2_change_extent_flag ocfs2_search_extent_list ^ ---no se pudo encontrar la extensi\u00f3n... desbloquear ip_alloc_sem En la mayor\u00eda de los sistemas de archivos, fallocate no es compatible con ejecuciones con AIO+DIO, as\u00ed que solucionelo agregando esperar a que todos los dio antes de fallocate/punch_hole como ext4."
          }
        ],
        "id": "CVE-2024-40943",
        "lastModified": "2026-08-04T11:19:07.817",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 4.7,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.0,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2024-40943",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T17:04:20.780555Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-07-12T13:15:16.670",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/050ce8af6838c71e872e982b50d3f1bec21da40e"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/117b9c009b72a6c2ebfd23484354dfee2d9570d2"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/38825ff9da91d2854dcf6d9ac320a7e641e10f25"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/3c26b5d21b1239e9c7fd31ba7d9b2d7bdbaa68d9"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/3c361f313d696df72f9bccf058510e9ec737b9b1"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/952b023f06a24b2ad6ba67304c4c84d45bea2f18"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/e8e2db1adac47970a6a9225f3858e9aa0e86287f"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/ea042dc2bea19d72e37c298bf65a9c341ef3fff3"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/050ce8af6838c71e872e982b50d3f1bec21da40e"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/117b9c009b72a6c2ebfd23484354dfee2d9570d2"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/38825ff9da91d2854dcf6d9ac320a7e641e10f25"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/3c26b5d21b1239e9c7fd31ba7d9b2d7bdbaa68d9"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/3c361f313d696df72f9bccf058510e9ec737b9b1"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/952b023f06a24b2ad6ba67304c4c84d45bea2f18"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/e8e2db1adac47970a6a9225f3858e9aa0e86287f"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/ea042dc2bea19d72e37c298bf65a9c341ef3fff3"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-362"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-04T22:43:46+00:00",
      "cve": "CVE-2024-40943",
      "id": "CVE-2024-40943",
      "initial_release_date": "2024-07-12T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ocfs2: fix races between hole punching and AIO+DIO",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-40943.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-01T14:01:55Z",
      "cve": "CVE-2024-40943",
      "id": "CVE-2024-40943",
      "initial_release_date": "2024-07-16T02:34:31Z",
      "product_status:known_affected": "506",
      "product_status:known_not_affected": "6",
      "product_status:recommended": "737",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-40943",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-40943.json",
      "version": "117"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2025-11-03T21:58:12.745Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/3c26b5d21b1239e9c7fd31ba7d9b2d7bdbaa68d9"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/e8e2db1adac47970a6a9225f3858e9aa0e86287f"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/050ce8af6838c71e872e982b50d3f1bec21da40e"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/38825ff9da91d2854dcf6d9ac320a7e641e10f25"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/ea042dc2bea19d72e37c298bf65a9c341ef3fff3"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/3c361f313d696df72f9bccf058510e9ec737b9b1"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/117b9c009b72a6c2ebfd23484354dfee2d9570d2"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/952b023f06a24b2ad6ba67304c4c84d45bea2f18"
              },
              {
                "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2024-40943",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-09-10T17:04:20.780555Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-09-11T12:42:22.561Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "fs/ocfs2/file.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "3c26b5d21b1239e9c7fd31ba7d9b2d7bdbaa68d9",
                  "status": "affected",
                  "version": "b25801038da5823bba1b5440a57ca68afc51b6bd",
                  "versionType": "git"
                },
                {
                  "lessThan": "e8e2db1adac47970a6a9225f3858e9aa0e86287f",
                  "status": "affected",
                  "version": "b25801038da5823bba1b5440a57ca68afc51b6bd",
                  "versionType": "git"
                },
                {
                  "lessThan": "050ce8af6838c71e872e982b50d3f1bec21da40e",
                  "status": "affected",
                  "version": "b25801038da5823bba1b5440a57ca68afc51b6bd",
                  "versionType": "git"
                },
                {
                  "lessThan": "38825ff9da91d2854dcf6d9ac320a7e641e10f25",
                  "status": "affected",
                  "version": "b25801038da5823bba1b5440a57ca68afc51b6bd",
                  "versionType": "git"
                },
                {
                  "lessThan": "ea042dc2bea19d72e37c298bf65a9c341ef3fff3",
                  "status": "affected",
                  "version": "b25801038da5823bba1b5440a57ca68afc51b6bd",
                  "versionType": "git"
                },
                {
                  "lessThan": "3c361f313d696df72f9bccf058510e9ec737b9b1",
                  "status": "affected",
                  "version": "b25801038da5823bba1b5440a57ca68afc51b6bd",
                  "versionType": "git"
                },
                {
                  "lessThan": "117b9c009b72a6c2ebfd23484354dfee2d9570d2",
                  "status": "affected",
                  "version": "b25801038da5823bba1b5440a57ca68afc51b6bd",
                  "versionType": "git"
                },
                {
                  "lessThan": "952b023f06a24b2ad6ba67304c4c84d45bea2f18",
                  "status": "affected",
                  "version": "b25801038da5823bba1b5440a57ca68afc51b6bd",
                  "versionType": "git"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "fs/ocfs2/file.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "2.6.23"
                },
                {
                  "lessThan": "2.6.23",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "4.19.*",
                  "status": "unaffected",
                  "version": "4.19.317",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.4.*",
                  "status": "unaffected",
                  "version": "5.4.279",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.10.*",
                  "status": "unaffected",
                  "version": "5.10.221",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.15.*",
                  "status": "unaffected",
                  "version": "5.15.162",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.1.*",
                  "status": "unaffected",
                  "version": "6.1.95",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.6.*",
                  "status": "unaffected",
                  "version": "6.6.35",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.9.*",
                  "status": "unaffected",
                  "version": "6.9.6",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "6.10",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "4.19.317",
                      "versionStartIncluding": "2.6.23",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.4.279",
                      "versionStartIncluding": "2.6.23",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.10.221",
                      "versionStartIncluding": "2.6.23",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.15.162",
                      "versionStartIncluding": "2.6.23",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.1.95",
                      "versionStartIncluding": "2.6.23",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.6.35",
                      "versionStartIncluding": "2.6.23",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.9.6",
                      "versionStartIncluding": "2.6.23",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.10",
                      "versionStartIncluding": "2.6.23",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: fix races between hole punching and AIO+DIO\n\nAfter commit \"ocfs2: return real error code in ocfs2_dio_wr_get_block\",\nfstests/generic/300 become from always failed to sometimes failed:\n\n========================================================================\n[  473.293420 ] run fstests generic/300\n\n[  475.296983 ] JBD2: Ignoring recovery information on journal\n[  475.302473 ] ocfs2: Mounting device (253,1) on (node local, slot 0) with ordered data mode.\n[  494.290998 ] OCFS2: ERROR (device dm-1): ocfs2_change_extent_flag: Owner 5668 has an extent at cpos 78723 which can no longer be found\n[  494.291609 ] On-disk corruption discovered. Please run fsck.ocfs2 once the filesystem is unmounted.\n[  494.292018 ] OCFS2: File system is now read-only.\n[  494.292224 ] (kworker/19:11,2628,19):ocfs2_mark_extent_written:5272 ERROR: status = -30\n[  494.292602 ] (kworker/19:11,2628,19):ocfs2_dio_end_io_write:2374 ERROR: status = -3\nfio: io_u error on file /mnt/scratch/racer: Read-only file system: write offset=460849152, buflen=131072\n=========================================================================\n\nIn __blockdev_direct_IO, ocfs2_dio_wr_get_block is called to add unwritten\nextents to a list.  extents are also inserted into extent tree in\nocfs2_write_begin_nolock.  Then another thread call fallocate to puch a\nhole at one of the unwritten extent.  The extent at cpos was removed by\nocfs2_remove_extent().  At end io worker thread, ocfs2_search_extent_list\nfound there is no such extent at the cpos.\n\n    T1                        T2                T3\n                              inode lock\n                                ...\n                                insert extents\n                                ...\n                              inode unlock\nocfs2_fallocate\n __ocfs2_change_file_space\n  inode lock\n  lock ip_alloc_sem\n  ocfs2_remove_inode_range inode\n   ocfs2_remove_btree_range\n    ocfs2_remove_extent\n    ^---remove the extent at cpos 78723\n  ...\n  unlock ip_alloc_sem\n  inode unlock\n                                       ocfs2_dio_end_io\n                                        ocfs2_dio_end_io_write\n                                         lock ip_alloc_sem\n                                         ocfs2_mark_extent_written\n                                          ocfs2_change_extent_flag\n                                           ocfs2_search_extent_list\n                                           ^---failed to find extent\n                                          ...\n                                          unlock ip_alloc_sem\n\nIn most filesystems, fallocate is not compatible with racing with AIO+DIO,\nso fix it by adding to wait for all dio before fallocate/punch_hole like\next4."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "scenarios": [
                {
                  "lang": "en",
                  "value": "AV:L - The race is driven entirely by local syscalls \u2014 `io_submit()`/`io_uring` O_DIRECT writes reaching `ocfs2_dio_wr_get_block()` and `fallocate(FALLOC_FL_PUNCH_HOLE)`/`OCFS2_IOC_UNRESVSP` reaching `__ocfs2_change_file_space()` on an already-mounted ocfs2 volume. No remote peer or packet data reaches the vulnerable path; ocfs2 is a shared-disk cluster filesystem, not a network server.\nAC:L - The attacker owns both sides of the race: one thread issues async O_DIRECT writes that return `-EIOCBQUEUED` and defer `ocfs2_dio_end_io_write()`, while another calls `fallocate(PUNCH_HOLE)` over the same range, and the sequence can be looped indefinitely at no cost until it lands. Nothing depends on state outside the attacker\u0027s influence \u2014 the `unwritten` feature bit required by `ocfs2_fallocate()` is the mkfs.ocfs2 default, and the upstream reproducer (fstests generic/300) hits it with an ordinary fio racer workload.\nPR:L - Only an unprivileged local account with write access to a file on the ocfs2 volume is needed \u2014 `ocfs2_fallocate()` has no capability check and `ocfs2_change_file_space()` gates solely on `S_ISREG` plus `FMODE_WRITE` on the caller\u0027s own fd. No CAP_SYS_ADMIN, no user-namespace trick, and no root is required, since the attacker races only on a file it already owns.\nUI:N - The attacker performs the whole sequence from its own processes with no action by any other user. The ocfs2 volume is already mounted in the normal deployment (a cluster shared-storage node), so no victim mount or file open is involved.\nS:U - The corrupted extent tree, the freed-then-rewritten clusters, and the forced-read-only superblock all live within the kernel\u0027s own security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - `ocfs2_change_extent_flag()` builds `split_rec.e_blkno` from the stale `ue_phys` captured before the punch and never validates it against the record it found (`fs/ocfs2/alloc.c:5232`), so once a re-write repopulates an unwritten extent at that `cpos` the split installs a mapping to clusters that `ocfs2_truncate_log_append()` already released to the global bitmap and handed to another inode. The attacker\u0027s file then aliases another user\u0027s data blocks \u2014 an arbitrary read of other users\u0027 file contents across every node of the cluster \u2014 and with `errors=continue` the volume keeps serving that inconsistent metadata.\nI:H - The punch frees the clusters into the truncate log and flushes them for reuse while the DIO\u0027s data BIOs are still in flight to those exact physical blocks, so attacker-controlled bytes overwrite whatever inode was subsequently allocated them, and the stale-`e_blkno` split additionally grants a persistent write alias into another user\u0027s file. The result is on-disk corruption that the kernel itself reports as requiring offline `fsck.ocfs2` to repair.\nA:H - `ocfs2_change_extent_flag()` calls `ocfs2_error()`, and `ocfs2_handle_error()` (`fs/ocfs2/super.c:2482`) either calls `panic()` under the cluster-typical `errors=panic` or, by default, sets `SB_RDONLY` and prints \"File system is now read-only\" \u2014 an unprivileged user can thus take the entire shared volume offline for every process on the node. Recovery requires unmounting cluster-wide and running fsck, and the trigger can be repeated at will."
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-05T11:34:09.554Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/3c26b5d21b1239e9c7fd31ba7d9b2d7bdbaa68d9"
            },
            {
              "url": "https://git.kernel.org/stable/c/e8e2db1adac47970a6a9225f3858e9aa0e86287f"
            },
            {
              "url": "https://git.kernel.org/stable/c/050ce8af6838c71e872e982b50d3f1bec21da40e"
            },
            {
              "url": "https://git.kernel.org/stable/c/38825ff9da91d2854dcf6d9ac320a7e641e10f25"
            },
            {
              "url": "https://git.kernel.org/stable/c/ea042dc2bea19d72e37c298bf65a9c341ef3fff3"
            },
            {
              "url": "https://git.kernel.org/stable/c/3c361f313d696df72f9bccf058510e9ec737b9b1"
            },
            {
              "url": "https://git.kernel.org/stable/c/117b9c009b72a6c2ebfd23484354dfee2d9570d2"
            },
            {
              "url": "https://git.kernel.org/stable/c/952b023f06a24b2ad6ba67304c4c84d45bea2f18"
            }
          ],
          "title": "ocfs2: fix races between hole punching and AIO+DIO",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2024-40943",
        "datePublished": "2024-07-12T12:25:17.813Z",
        "dateReserved": "2024-07-12T12:17:45.588Z",
        "dateUpdated": "2026-08-05T11:34:09.554Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.