In the Linux kernel, the following vulnerability has been resolved:
ext4: fix mbcacheentry's erefcnt leak in ext4xattrblockcache_find()
Syzbot reports a warning as follows:
============================================ WARNING: CPU: 0 PID: 5075 at fs/mbcache.c:419 mbcachedestroy+0x224/0x290 Modules linked in: CPU: 0 PID: 5075 Comm: syz-executor199 Not tainted 6.9.0-rc6-gb947cc5bf6d7 RIP: 0010:mbcachedestroy+0x224/0x290 fs/mbcache.c:419 Call Trace: <TASK> ext4putsuper+0x6d4/0xcd0 fs/ext4/super.c:1375 genericshutdownsuper+0x136/0x2d0 fs/super.c:641 killblocksuper+0x44/0x90 fs/super.c:1675 ext4killsb+0x68/0xa0 fs/ext4/super.c:7327
This is because when finding an entry in ext4xattrblockcachefind(), if ext4sbbread() returns -ENOMEM, the ce's erefcnt, which has already grown in the _entryfind(), won't be put away, and eventually trigger the above issue in mbcache_destroy() due to reference count leakage.
So call mbcacheentry_put() on the -ENOMEM error branch as a quick fix.
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/39xxx/CVE-2024-39276.json"
}[
{
"digest": {
"length": 760.0,
"function_hash": "123823462633595981077273309892181427817"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@76dc776153a47372719d664e0fc50d6355791abb",
"deprecated": false,
"id": "CVE-2024-39276-15c5a81f",
"signature_type": "Function",
"target": {
"function": "ext4_xattr_block_cache_find",
"file": "fs/ext4/xattr.c"
},
"signature_version": "v1"
},
{
"digest": {
"length": 760.0,
"function_hash": "123823462633595981077273309892181427817"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a95df6f04f2c37291adf26a74205cde0314d4577",
"deprecated": false,
"id": "CVE-2024-39276-17bf9105",
"signature_type": "Function",
"target": {
"function": "ext4_xattr_block_cache_find",
"file": "fs/ext4/xattr.c"
},
"signature_version": "v1"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"135974079615217049934924778098032564920",
"80312300026916712116853565406788247579",
"200250909719551444318232419373852883319",
"161715009020484231029740999642316791319",
"280962254355348438524024993371929520705"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0c0b4a49d3e7f49690a6827a41faeffad5df7e21",
"deprecated": false,
"id": "CVE-2024-39276-1adb4a3c",
"signature_type": "Line",
"target": {
"file": "fs/ext4/xattr.c"
},
"signature_version": "v1"
},
{
"digest": {
"length": 760.0,
"function_hash": "123823462633595981077273309892181427817"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e941b712e758f615d311946bf98216e79145ccd9",
"deprecated": false,
"id": "CVE-2024-39276-42eb8840",
"signature_type": "Function",
"target": {
"function": "ext4_xattr_block_cache_find",
"file": "fs/ext4/xattr.c"
},
"signature_version": "v1"
},
{
"digest": {
"length": 760.0,
"function_hash": "123823462633595981077273309892181427817"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@896a7e7d0d555ad8b2b46af0c2fa7de7467f9483",
"deprecated": false,
"id": "CVE-2024-39276-46cbfb44",
"signature_type": "Function",
"target": {
"function": "ext4_xattr_block_cache_find",
"file": "fs/ext4/xattr.c"
},
"signature_version": "v1"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"135974079615217049934924778098032564920",
"80312300026916712116853565406788247579",
"200250909719551444318232419373852883319",
"161715009020484231029740999642316791319",
"280962254355348438524024993371929520705"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@681ff9a09accd8a4379f8bd30b7a1641ee19bb3e",
"deprecated": false,
"id": "CVE-2024-39276-479fb42d",
"signature_type": "Line",
"target": {
"file": "fs/ext4/xattr.c"
},
"signature_version": "v1"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"135974079615217049934924778098032564920",
"80312300026916712116853565406788247579",
"200250909719551444318232419373852883319",
"161715009020484231029740999642316791319",
"280962254355348438524024993371929520705"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@896a7e7d0d555ad8b2b46af0c2fa7de7467f9483",
"deprecated": false,
"id": "CVE-2024-39276-4dc786fb",
"signature_type": "Line",
"target": {
"file": "fs/ext4/xattr.c"
},
"signature_version": "v1"
},
{
"digest": {
"length": 760.0,
"function_hash": "123823462633595981077273309892181427817"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0c0b4a49d3e7f49690a6827a41faeffad5df7e21",
"deprecated": false,
"id": "CVE-2024-39276-5d4498be",
"signature_type": "Function",
"target": {
"function": "ext4_xattr_block_cache_find",
"file": "fs/ext4/xattr.c"
},
"signature_version": "v1"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"135974079615217049934924778098032564920",
"80312300026916712116853565406788247579",
"200250909719551444318232419373852883319",
"161715009020484231029740999642316791319",
"280962254355348438524024993371929520705"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@76dc776153a47372719d664e0fc50d6355791abb",
"deprecated": false,
"id": "CVE-2024-39276-67d2fd0b",
"signature_type": "Line",
"target": {
"file": "fs/ext4/xattr.c"
},
"signature_version": "v1"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"135974079615217049934924778098032564920",
"80312300026916712116853565406788247579",
"200250909719551444318232419373852883319",
"161715009020484231029740999642316791319",
"280962254355348438524024993371929520705"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b37c0edef4e66fb21a2fbc211471195a383e5ab8",
"deprecated": false,
"id": "CVE-2024-39276-91766c10",
"signature_type": "Line",
"target": {
"file": "fs/ext4/xattr.c"
},
"signature_version": "v1"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"135974079615217049934924778098032564920",
"80312300026916712116853565406788247579",
"200250909719551444318232419373852883319",
"161715009020484231029740999642316791319",
"280962254355348438524024993371929520705"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a95df6f04f2c37291adf26a74205cde0314d4577",
"deprecated": false,
"id": "CVE-2024-39276-9310e2fd",
"signature_type": "Line",
"target": {
"file": "fs/ext4/xattr.c"
},
"signature_version": "v1"
},
{
"digest": {
"length": 760.0,
"function_hash": "123823462633595981077273309892181427817"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b37c0edef4e66fb21a2fbc211471195a383e5ab8",
"deprecated": false,
"id": "CVE-2024-39276-cb5256d5",
"signature_type": "Function",
"target": {
"function": "ext4_xattr_block_cache_find",
"file": "fs/ext4/xattr.c"
},
"signature_version": "v1"
},
{
"digest": {
"length": 760.0,
"function_hash": "123823462633595981077273309892181427817"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@681ff9a09accd8a4379f8bd30b7a1641ee19bb3e",
"deprecated": false,
"id": "CVE-2024-39276-fef9707c",
"signature_type": "Function",
"target": {
"function": "ext4_xattr_block_cache_find",
"file": "fs/ext4/xattr.c"
},
"signature_version": "v1"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"135974079615217049934924778098032564920",
"80312300026916712116853565406788247579",
"200250909719551444318232419373852883319",
"161715009020484231029740999642316791319",
"280962254355348438524024993371929520705"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e941b712e758f615d311946bf98216e79145ccd9",
"deprecated": false,
"id": "CVE-2024-39276-ff74d3af",
"signature_type": "Line",
"target": {
"file": "fs/ext4/xattr.c"
},
"signature_version": "v1"
}
]
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-39276.json"