CVE-2024-44941: f2fs: fix to cover read extent cache access with lock
In the Linux kernel, the following vulnerability has been resolved:
f2fs: fix to cover read extent cache access with lock
syzbot reports a f2fs bug as below:
BUG: KASAN: slab-use-after-free in sanitycheckextentcache+0x370/0x410 fs/f2fs/extentcache.c:46 Read of size 4 at addr ffff8880739ab220 by task syz-executor200/5097
CPU: 0 PID: 5097 Comm: syz-executor200 Not tainted 6.9.0-rc6-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 Call Trace: <TASK> dumpstack lib/dumpstack.c:88 [inline] dumpstacklvl+0x241/0x360 lib/dumpstack.c:114 printaddressdescription mm/kasan/report.c:377 [inline] printreport+0x169/0x550 mm/kasan/report.c:488 kasanreport+0x143/0x180 mm/kasan/report.c:601 sanitycheckextentcache+0x370/0x410 fs/f2fs/extentcache.c:46 doreadinode fs/f2fs/inode.c:509 [inline] f2fsiget+0x33e1/0x46e0 fs/f2fs/inode.c:560 f2fsnfsgetinode+0x74/0x100 fs/f2fs/super.c:3237 genericfhtodentry+0x9f/0xf0 fs/libfs.c:1413 exportfsdecodefhraw+0x152/0x5f0 fs/exportfs/expfs.c:444 exportfsdecodefh+0x3c/0x80 fs/exportfs/expfs.c:584 dohandletopath fs/fhandle.c:155 [inline] handletopath fs/fhandle.c:210 [inline] dohandleopen+0x495/0x650 fs/fhandle.c:226 dosyscallx64 arch/x86/entry/common.c:52 [inline] dosyscall64+0xf5/0x240 arch/x86/entry/common.c:83 entrySYSCALL64afterhwframe+0x77/0x7f
We missed to cover sanitycheckextentcache() w/ extent cache lock, so, below race case may happen, result in use after free issue.
- f2fsiget - doreadinode - f2fsinitreadextenttree : add largest extent entry in to cache - shrink - f2fsshrinkreadextenttree - shrinkextenttree - detachextentnode : drop largest extent entry - sanitycheckextentcache : access et->largest w/o lock
let's refactor sanitycheckextentcache() to avoid extent cache access and call it before f2fsinitreadextenttree() to fix this issue.
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.22-1 - Configuration
Refactor f2fs code so sanity_check_extent_cache() no longer accesses extent cache (et->largest) without holding the extent cache lock; ensure sanity_check_extent_cache() is called before f2fs_init_read_extent_tree(). This prevents the reported slab-use-after-free race in sanity_check_extent_cache+0x370/0x410.
Linux kernel (f2fs) fs/f2fs/extent_cache.c extent cache locking around sanity_check_extent_cache() = wrap/cover sanity_check_extent_cache() extent cache access with the extent cache lock (not unlocked access) and call sanity_check_extent_cache() before f2fs_init_read_extent_tree()
Event History
Frequently Asked Questions
What is the severity of CVE-2024-44941?
CVE-2024-44941 is classified as a high-severity vulnerability due to the potential for exploitation related to memory safety issues.
How do I fix CVE-2024-44941?
To fix CVE-2024-44941, upgrade your Linux kernel to version 6.12.11-1 or later, or ensure that you're using versions of Debian that are above the specified vulnerable versions.
What software is affected by CVE-2024-44941?
CVE-2024-44941 affects various versions of the Linux kernel, specifically versions earlier than 6.6.47 and certain versions between 6.7 and 6.10.6.
What impact does CVE-2024-44941 have on system security?
CVE-2024-44941 can lead to exploitation opportunities such as arbitrary code execution or data corruption due to a slab-use-after-free condition.
Is there a workaround for CVE-2024-44941?
There are no specific workarounds for CVE-2024-44941; the recommended action is to apply the appropriate kernel updates.