Vulnerability-Lookup

GHSA-M6QV-4WQW-VJ9P

Vulnerability from github – Published: 2024-08-17 09:30 – Updated: 2025-09-29 15:30

Details

In the Linux kernel, the following vulnerability has been resolved:

erofs: fix race in z_erofs_get_gbuf()

In z_erofs_get_gbuf(), the current task may be migrated to another CPU between z_erofs_gbuf_id() and spin_lock(&gbuf->lock).

Therefore, z_erofs_put_gbuf() will trigger the following issue which was found by stress test:

<2>[772156.434168] kernel BUG at fs/erofs/zutil.c:58! .. <4>[772156.435007] <4>[772156.439237] CPU: 0 PID: 3078 Comm: stress Kdump: loaded Tainted: G E 6.10.0-rc7+ #2 <4>[772156.439239] Hardware name: Alibaba Cloud Alibaba Cloud ECS, BIOS 1.0.0 01/01/2017 <4>[772156.439241] pstate: 83400005 (Nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) <4>[772156.439243] pc : z_erofs_put_gbuf+0x64/0x70 [erofs] <4>[772156.439252] lr : z_erofs_lz4_decompress+0x600/0x6a0 [erofs] .. <6>[772156.445958] stress (3127): drop_caches: 1 <4>[772156.446120] Call trace: <4>[772156.446121] z_erofs_put_gbuf+0x64/0x70 [erofs] <4>[772156.446761] z_erofs_lz4_decompress+0x600/0x6a0 [erofs] <4>[772156.446897] z_erofs_decompress_queue+0x740/0xa10 [erofs] <4>[772156.447036] z_erofs_runqueue+0x428/0x8c0 [erofs] <4>[772156.447160] z_erofs_readahead+0x224/0x390 [erofs] ..

Severity

4.7 (Medium)


                  
                    CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-42300"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-362"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-08-17T09:15:10Z",
    "severity": "MODERATE"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nerofs: fix race in z_erofs_get_gbuf()\n\nIn z_erofs_get_gbuf(), the current task may be migrated to another\nCPU between `z_erofs_gbuf_id()` and `spin_lock(\u0026gbuf-\u003elock)`.\n\nTherefore, z_erofs_put_gbuf() will trigger the following issue\nwhich was found by stress test:\n\n\u003c2\u003e[772156.434168] kernel BUG at fs/erofs/zutil.c:58!\n..\n\u003c4\u003e[772156.435007]\n\u003c4\u003e[772156.439237] CPU: 0 PID: 3078 Comm: stress Kdump: loaded Tainted: G            E      6.10.0-rc7+ #2\n\u003c4\u003e[772156.439239] Hardware name: Alibaba Cloud Alibaba Cloud ECS, BIOS 1.0.0 01/01/2017\n\u003c4\u003e[772156.439241] pstate: 83400005 (Nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)\n\u003c4\u003e[772156.439243] pc : z_erofs_put_gbuf+0x64/0x70 [erofs]\n\u003c4\u003e[772156.439252] lr : z_erofs_lz4_decompress+0x600/0x6a0 [erofs]\n..\n\u003c6\u003e[772156.445958] stress (3127): drop_caches: 1\n\u003c4\u003e[772156.446120] Call trace:\n\u003c4\u003e[772156.446121]  z_erofs_put_gbuf+0x64/0x70 [erofs]\n\u003c4\u003e[772156.446761]  z_erofs_lz4_decompress+0x600/0x6a0 [erofs]\n\u003c4\u003e[772156.446897]  z_erofs_decompress_queue+0x740/0xa10 [erofs]\n\u003c4\u003e[772156.447036]  z_erofs_runqueue+0x428/0x8c0 [erofs]\n\u003c4\u003e[772156.447160]  z_erofs_readahead+0x224/0x390 [erofs]\n..",
  "id": "GHSA-m6qv-4wqw-vj9p",
  "modified": "2025-09-29T15:30:30Z",
  "published": "2024-08-17T09:30:24Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-42300"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/49b22e06a947727a6d1c802d2d9ad92420b90fc5"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/7dc5537c3f8be87e005f0844a7626c987914f8fd"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2024-42300 (GCVE-0-2024-42300)

Vulnerability from cvelistv5 – Published: 2024-08-17 09:09 – Updated: 2026-08-05 11:36

Title

erofs: fix race in z_erofs_get_gbuf()

Summary

In the Linux kernel, the following vulnerability has been resolved: erofs: fix race in z_erofs_get_gbuf() In z_erofs_get_gbuf(), the current task may be migrated to another CPU between `z_erofs_gbuf_id()` and `spin_lock(&gbuf->lock)`. Therefore, z_erofs_put_gbuf() will trigger the following issue which was found by stress test: <2>[772156.434168] kernel BUG at fs/erofs/zutil.c:58! .. <4>[772156.435007] <4>[772156.439237] CPU: 0 PID: 3078 Comm: stress Kdump: loaded Tainted: G E 6.10.0-rc7+ #2 <4>[772156.439239] Hardware name: Alibaba Cloud Alibaba Cloud ECS, BIOS 1.0.0 01/01/2017 <4>[772156.439241] pstate: 83400005 (Nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) <4>[772156.439243] pc : z_erofs_put_gbuf+0x64/0x70 [erofs] <4>[772156.439252] lr : z_erofs_lz4_decompress+0x600/0x6a0 [erofs] .. <6>[772156.445958] stress (3127): drop_caches: 1 <4>[772156.446120] Call trace: <4>[772156.446121] z_erofs_put_gbuf+0x64/0x70 [erofs] <4>[772156.446761] z_erofs_lz4_decompress+0x600/0x6a0 [erofs] <4>[772156.446897] z_erofs_decompress_queue+0x740/0xa10 [erofs] <4>[772156.447036] z_erofs_runqueue+0x428/0x8c0 [erofs] <4>[772156.447160] z_erofs_readahead+0x224/0x390 [erofs] ..

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-09-10 16:10 UTC

Assigner

Linux mitre root Scorecard

References

2 references

URL	Tags
https://git.kernel.org/stable/c/49b22e06a947727a6…
https://git.kernel.org/stable/c/7dc5537c3f8be87e0…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: f36f3010f67611a45d66e773bc91e4c66a9abab5 , < 49b22e06a947727a6d1c802d2d9ad92420b90fc5 (git) Affected: f36f3010f67611a45d66e773bc91e4c66a9abab5 , < 7dc5537c3f8be87e005f0844a7626c987914f8fd (git)
Linux	Linux	Affected: 6.10 Unaffected: 0 , < 6.10 (semver) Unaffected: 6.10.3 , ≤ 6.10.* (semver) Unaffected: 6.11 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-42300",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T16:10:35.332066Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-12T17:33:28.436Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/erofs/zutil.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "49b22e06a947727a6d1c802d2d9ad92420b90fc5",
              "status": "affected",
              "version": "f36f3010f67611a45d66e773bc91e4c66a9abab5",
              "versionType": "git"
            },
            {
              "lessThan": "7dc5537c3f8be87e005f0844a7626c987914f8fd",
              "status": "affected",
              "version": "f36f3010f67611a45d66e773bc91e4c66a9abab5",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/erofs/zutil.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.10"
            },
            {
              "lessThan": "6.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.11",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.3",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nerofs: fix race in z_erofs_get_gbuf()\n\nIn z_erofs_get_gbuf(), the current task may be migrated to another\nCPU between `z_erofs_gbuf_id()` and `spin_lock(\u0026gbuf-\u003elock)`.\n\nTherefore, z_erofs_put_gbuf() will trigger the following issue\nwhich was found by stress test:\n\n\u003c2\u003e[772156.434168] kernel BUG at fs/erofs/zutil.c:58!\n..\n\u003c4\u003e[772156.435007]\n\u003c4\u003e[772156.439237] CPU: 0 PID: 3078 Comm: stress Kdump: loaded Tainted: G            E      6.10.0-rc7+ #2\n\u003c4\u003e[772156.439239] Hardware name: Alibaba Cloud Alibaba Cloud ECS, BIOS 1.0.0 01/01/2017\n\u003c4\u003e[772156.439241] pstate: 83400005 (Nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)\n\u003c4\u003e[772156.439243] pc : z_erofs_put_gbuf+0x64/0x70 [erofs]\n\u003c4\u003e[772156.439252] lr : z_erofs_lz4_decompress+0x600/0x6a0 [erofs]\n..\n\u003c6\u003e[772156.445958] stress (3127): drop_caches: 1\n\u003c4\u003e[772156.446120] Call trace:\n\u003c4\u003e[772156.446121]  z_erofs_put_gbuf+0x64/0x70 [erofs]\n\u003c4\u003e[772156.446761]  z_erofs_lz4_decompress+0x600/0x6a0 [erofs]\n\u003c4\u003e[772156.446897]  z_erofs_decompress_queue+0x740/0xa10 [erofs]\n\u003c4\u003e[772156.447036]  z_erofs_runqueue+0x428/0x8c0 [erofs]\n\u003c4\u003e[772156.447160]  z_erofs_readahead+0x224/0x390 [erofs]\n.."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is reached through ordinary file reads/readahead on a mounted erofs filesystem (read(), mmap, page-fault paths), which requires local access to the system. There is no network-facing consumer of z_erofs_get_gbuf().\nAC:L - The attacker controls both sides of the race: it drives the decompression load (repeated reads plus cache eviction on compressed erofs files) and simultaneously forces the migration via sched_setaffinity() on its own reader threads or CPU oversubscription, and the bug was already shown to reproduce under a plain stress test.\nPR:L - Any unprivileged local user or sandboxed app that can read a file on an already-mounted erofs image reaches z_erofs_readahead \u2192 z_erofs_get_gbuf with no capability, LSM, or ownership check on the path; on Android every app reads compressed erofs system partitions by default.\nUI:N - The attacker triggers the decompression path entirely with its own reads on an already-mounted filesystem; no victim action such as mounting an image or opening a file is required.\nS:U - The corrupted spinlock state, the shared global buffer, and the resulting hang all reside within the kernel\u0027s own security authority, with no crossing into a hypervisor, IOMMU, or other security scope.\nC:H - The unbalanced spin_unlock() destroys mutual exclusion on the shared global decompression buffer, so one task\u0027s LZ4 decompression reads compressed bytes belonging to another task\u0027s file, placing content derived from files the attacker cannot otherwise read into its own page-cache pages; the same window also lets gbuf_growsize() vunmap a buffer still in use.\nI:H - Concurrent use of the same gbuf lets attacker-supplied compressed input be decompressed into the page cache pages of an unrelated inode, corrupting file data that other \u2014 including privileged \u2014 processes mmap and execute, and the vunmap-under-use window gives a write to freed/unmapped vmalloc memory.\nA:H - On CONFIG_EROFS_FS_DEBUG kernels this immediately panics at the DBG_BUGON in z_erofs_put_gbuf(); on production kernels the abandoned gbuf lock is never released, so every subsequent decompression mapping to it spins forever with preemption disabled, producing a hard lockup/RCU stall that requires a reboot."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:36:29.855Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/49b22e06a947727a6d1c802d2d9ad92420b90fc5"
        },
        {
          "url": "https://git.kernel.org/stable/c/7dc5537c3f8be87e005f0844a7626c987914f8fd"
        }
      ],
      "title": "erofs: fix race in z_erofs_get_gbuf()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-42300",
    "datePublished": "2024-08-17T09:09:07.311Z",
    "dateReserved": "2024-07-30T07:40:12.270Z",
    "dateUpdated": "2026-08-05T11:36:29.855Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

GHSA-M6QV-4WQW-VJ9P

CVE-2024-42300 (GCVE-0-2024-42300)

Tags

Sightings

Nomenclature

Related by attack behaviour