CVE-2024-26868: nfs: fix panic when nfs4_ff_layout_prepare_ds() fails
In the Linux kernel, the following vulnerability has been resolved:
nfs: fix panic when nfs4fflayoutprepareds() fails
The Linux kernel CVE team has assigned CVE-2024-26868 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024041737-CVE-2024-26868-35ff@gregkh/T
Other sources
In the Linux kernel, the following vulnerability has been resolved:
nfs: fix panic when nfs4fflayoutprepareds() fails
We've been seeing the following panic in production
BUG: kernel NULL pointer dereference, address: 0000000000000065 PGD 2f485f067 P4D 2f485f067 PUD 2cc5d8067 PMD 0 RIP: 0010:fflayoutcancelio+0x3a/0x90 [nfslayoutflexfiles] Call Trace: <TASK> ? die+0x78/0xc0 ? pagefaultoops+0x286/0x380 ? rpcexecute+0x2c3/0x470 [sunrpc] ? rpcnewtask+0x42/0x1c0 [sunrpc] ? excpagefault+0x5d/0x110 ? asmexcpagefault+0x22/0x30 ? fflayoutfreelayoutreturn+0x110/0x110 [nfslayoutflexfiles] ? fflayoutcancelio+0x3a/0x90 [nfslayoutflexfiles] ? fflayoutcancelio+0x6f/0x90 [nfslayoutflexfiles] pnfsmarkmatchinglsegsreturn+0x1b0/0x360 [nfsv4] pnfserrormarklayoutforreturn+0x9e/0x110 [nfsv4] ? fflayoutsendlayouterror+0x50/0x160 [nfslayoutflexfiles] nfs4fflayoutprepareds+0x11f/0x290 [nfslayoutflexfiles] fflayoutpginitwrite+0xf0/0x1f0 [nfslayoutflexfiles] nfspageioaddrequest+0x154/0x6c0 [nfs] nfspageioaddrequest+0x26b/0x380 [nfs] nfsdowritepage+0x111/0x1e0 [nfs] nfswritepagescallback+0xf/0x30 [nfs] writecachepages+0x17f/0x380 ? nfspageioinitwrite+0x50/0x50 [nfs] ? nfswritepages+0x6d/0x210 [nfs] ? nfswritepages+0x6d/0x210 [nfs] nfswritepages+0x125/0x210 [nfs] dowritepages+0x67/0x220 ? genericperformwrite+0x14b/0x210 filemapfdatawritewbc+0x5b/0x80 filewriteandwaitrange+0x6d/0xc0 nfsfilefsync+0x81/0x170 [nfs] ? nfsfilemmap+0x60/0x60 [nfs] x64sysfsync+0x53/0x90 dosyscall64+0x3d/0x90 entrySYSCALL64afterhwframe+0x46/0xb0
Inspecting the core with drgn I was able to pull this
>>> prog.crashedthread().stacktrace()[0] #0 at 0xffffffffa079657a (fflayoutcancelio+0x3a/0x84) in fflayoutcancelio at fs/nfs/flexfilelayout/flexfilelayout.c:2021:27 >>> prog.crashedthread().stacktrace()[0]['idx'] (u32)1 >>> prog.crashedthread().stacktrace()[0]['flseg'].mirrorarray[1].mirrords (struct nfs4fflayoutds )0xffffffffffffffed
This is clear from the stack trace, we call nfs4fflayoutprepareds() which could error out initializing the mirrords, and then we go to clean it all up and our check is only for if (!mirror->mirrords). This is inconsistent with the rest of the users of mirrords, which have
if (ISERRORNULL(mirrords))
to keep from tripping over this exact scenario. Fix this up in fflayoutcancelio() to make sure we don't panic when we get an error. I also spot checked all the other instances of checking mirrords and we appear to be doing the correct checks everywhere, only unconditionally dereferencing mirrords when we know it would be valid.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.1.83 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.6.23 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.7.11 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.8.2 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.9
Event History
Frequently Asked Questions
What is the severity of CVE-2024-26868?
CVE-2024-26868 is considered a medium-level vulnerability that may lead to kernel panic under certain conditions.
How do I fix CVE-2024-26868?
To fix CVE-2024-26868, upgrade your Linux kernel to version 6.1.83 or later, 6.6.23 or later, 6.7.11 or later, 6.8.2 or later, or 6.9.
Which Linux distributions are affected by CVE-2024-26868?
CVE-2024-26868 affects various distributions that utilize the Linux kernel versions prior to those mentioned in the mitigation section.
What problem does CVE-2024-26868 address in the Linux kernel?
CVE-2024-26868 addresses a kernel panic issue that arises when the nfs4_ff_layout_prepare_ds() function fails.
Is CVE-2024-26868 specific to a certain kernel version?
Yes, CVE-2024-26868 affects the Linux kernel versions prior to 6.1.83, 6.6.23, 6.7.11, 6.8.2, and 6.9.