CVE-2024-27058: tmpfs: fix race on handling dquot rbtree
In the Linux kernel, the following vulnerability has been resolved:
tmpfs: fix race on handling dquot rbtree
A syzkaller reproducer found a race while attempting to remove dquot information from the rb tree.
Fetching the rbtree root node must also be protected by the dqopt->dqiosem, otherwise, giving the right timing, shmemreleasedquot() will trigger a warning because it couldn't find a node in the tree, when the real reason was the root node changing before the search starts:
Thread 1 Thread 2 - shmemreleasedquot() - shmem{acquire,release}dquot()
- fetch ROOT - Fetch ROOT
- acquire dqiosem - wait dqiosem
- do something, triger a tree rebalance - release dqiosem
- acquire dqiosem - start searching for the node, but from the wrong location, missing the node, and triggering a warning.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.22-1Fixed in 6.12.25-1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-27058?
CVE-2024-27058 is considered a medium severity vulnerability due to a race condition in the Linux kernel's handling of dquot information.
How do I fix CVE-2024-27058?
To fix CVE-2024-27058, update your Linux kernel to one of the following versions: 5.10.223-1, 5.10.226-1, 6.1.123-1, 6.1.119-1, 6.12.10-1, or 6.12.11-1.
Which software is affected by CVE-2024-27058?
CVE-2024-27058 affects the Linux package in Debian versions as specified in the patched updates.
What is a race condition in CVE-2024-27058?
A race condition in CVE-2024-27058 occurs when multiple processes attempt to modify dquot information in the rb tree simultaneously, potentially leading to inconsistent states.
Is CVE-2024-27058 exploitable?
Yes, CVE-2024-27058 can be potentially exploited in scenarios where attackers can trigger the race condition during dquot operations.