CVE-2024-46687

See a problem?
Please try reporting it to the source first.

Source

https://nvd.nist.gov/vuln/detail/CVE-2024-46687

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-46687.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2024-46687

Related

Published

2024-09-13T06:15:13Z

Modified

2024-09-18T03:26:39.205969Z

Severity

7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

[none]

Details

In the Linux kernel, the following vulnerability has been resolved:

btrfs: fix a use-after-free when hitting errors inside btrfssubmitchunk()

[BUG] There is an internal report that KASAN is reporting use-after-free, with the following backtrace:

BUG: KASAN: slab-use-after-free in btrfscheckreadbio+0xa68/0xb70 [btrfs] Read of size 4 at addr ffff8881117cec28 by task kworker/u16:2/45 CPU: 1 UID: 0 PID: 45 Comm: kworker/u16:2 Not tainted 6.11.0-rc2-next-20240805-default+ #76 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-3-gd478f380-rebuilt.opensuse.org 04/01/2014 Workqueue: btrfs-endio btrfsendbiowork [btrfs] Call Trace: dumpstacklvl+0x61/0x80 printaddressdescription.constprop.0+0x5e/0x2f0 printreport+0x118/0x216 kasanreport+0x11d/0x1f0 btrfscheckreadbio+0xa68/0xb70 [btrfs] processonework+0xce0/0x12a0 workerthread+0x717/0x1250 kthread+0x2e3/0x3c0 retfromfork+0x2d/0x70 retfromfork_asm+0x11/0x20

Allocated by task 20917: kasansavestack+0x37/0x60 kasansavetrack+0x10/0x30 _kasanslaballoc+0x7d/0x80 kmemcacheallocnoprof+0x16e/0x3e0 mempoolallocnoprof+0x12e/0x310 bioallocbioset+0x3f0/0x7a0 btrfsbioalloc+0x2e/0x50 [btrfs] submitextentpage+0x4d1/0xdb0 [btrfs] btrfsdoreadpage+0x8b4/0x12a0 [btrfs] btrfsreadahead+0x29a/0x430 [btrfs] readpages+0x1a7/0xc60 pagecacheraunbounded+0x2ad/0x560 filemapgetpages+0x629/0xa20 filemapread+0x335/0xbf0 vfsread+0x790/0xcb0 ksysread+0xfd/0x1d0 dosyscall64+0x6d/0x140 entrySYSCALL64afterhwframe+0x4b/0x53

Freed by task 20917: kasansavestack+0x37/0x60 kasansavetrack+0x10/0x30 kasansavefreeinfo+0x37/0x50 _kasanslabfree+0x4b/0x60 kmemcachefree+0x214/0x5d0 biofree+0xed/0x180 endbbiodataread+0x1cc/0x580 [btrfs] btrfssubmitchunk+0x98d/0x1880 [btrfs] btrfssubmitbio+0x33/0x70 [btrfs] submitonebio+0xd4/0x130 [btrfs] submitextentpage+0x3ea/0xdb0 [btrfs] btrfsdoreadpage+0x8b4/0x12a0 [btrfs] btrfsreadahead+0x29a/0x430 [btrfs] readpages+0x1a7/0xc60 pagecacheraunbounded+0x2ad/0x560 filemapgetpages+0x629/0xa20 filemapread+0x335/0xbf0 vfsread+0x790/0xcb0 ksysread+0xfd/0x1d0 dosyscall64+0x6d/0x140 entrySYSCALL64afterhwframe+0x4b/0x53

[CAUSE] Although I cannot reproduce the error, the report itself is good enough to pin down the cause.

The call trace is the regular endio workqueue context, but the free-by-task trace is showing that during btrfssubmitchunk() we already hit a critical error, and is calling btrfsbioendio() to error out. And the original endio function called bioput() to free the whole bio.

This means a double freeing thus causing use-after-free, e.g.:

Enter btrfssubmitbio() with a read bio The read bio length is 128K, crossing two 64K stripes.
The first run of btrfssubmitchunk()

2.1 Call btrfsmapblock(), which returns 64K 2.2 Call btrfssplitbio() Now there are two bios, one referring to the first 64K, the other referring to the second 64K. 2.3 The first half is submitted.

The second run of btrfssubmitchunk()

3.1 Call btrfsmapblock(), which by somehow failed Now we call btrfsbioend_io() to handle the error

3.2 btrfsbioendio() calls the original endio function Which is endbbiodataread(), and it calls bio_put() for the original bio.

Now the original bio is freed.

The submitted first 64K bio finished Now we call into btrfscheckread_bio() and tries to advance the bio iter. But since the original bio (thus its iter) is already freed, we trigger the above use-after free.

And even if the memory is not poisoned/corrupted, we will later call the original endio function, causing a double freeing.

[FIX] Instead of calling btrfsbioendio(), call btrfsorigbbioend_io(), which has the extra check on split bios and do the pr ---truncated---

References

Affected packages

Debian:13 / linux

Package

Name: linux
Purl: pkg:deb/debian/linux?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

6.10.9-1

Affected versions

6.*

6.1.27-1

6.1.37-1

6.1.38-1

6.1.38-2~bpo11+1

6.1.38-2

6.1.38-3

6.1.38-4~bpo11+1

6.1.38-4

6.1.52-1

6.1.55-1~bpo11+1

6.1.55-1

6.1.64-1

6.1.66-1

6.1.67-1

6.1.69-1~bpo11+1

6.1.69-1

6.1.76-1~bpo11+1

6.1.76-1

6.1.82-1

6.1.85-1

6.1.90-1~bpo11+1

6.1.90-1

6.1.94-1~bpo11+1

6.1.94-1

6.1.98-1

6.1.99-1

6.1.106-1

6.1.106-2

6.1.106-3

6.3.1-1~exp1

6.3.2-1~exp1

6.3.4-1~exp1

6.3.5-1~exp1

6.3.7-1~bpo12+1

6.3.7-1

6.3.11-1

6.4~rc6-1~exp1

6.4~rc7-1~exp1

6.4.1-1~exp1

6.4.4-1~bpo12+1

6.4.4-1

6.4.4-2

6.4.4-3~bpo12+1

6.4.4-3

6.4.11-1

6.4.13-1

6.5~rc4-1~exp1

6.5~rc6-1~exp1

6.5~rc7-1~exp1

6.5.1-1~exp1

6.5.3-1~bpo12+1

6.5.3-1

6.5.6-1

6.5.8-1

6.5.10-1~bpo12+1

6.5.10-1

6.5.13-1

6.6.3-1~exp1

6.6.4-1~exp1

6.6.7-1~exp1

6.6.8-1

6.6.9-1

6.6.11-1

6.6.13-1~bpo12+1

6.6.13-1

6.6.15-1

6.6.15-2

6.7-1~exp1

6.7.1-1~exp1

6.7.4-1~exp1

6.7.7-1

6.7.9-1

6.7.9-2

6.7.12-1~bpo12+1

6.7.12-1

6.8.9-1

6.8.11-1

6.8.12-1~bpo12+1

6.8.12-1

6.9.2-1~exp1

6.9.7-1~bpo12+1

6.9.7-1

6.9.8-1

6.9.9-1

6.9.10-1~bpo12+1

6.9.10-1

6.9.11-1

6.9.12-1

6.10-1~exp1

6.10.1-1~exp1

6.10.3-1

6.10.4-1

6.10.6-1~bpo12+1

6.10.6-1

6.10.7-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}