CVE-2024-44959: tracefs: Use generic inode RCU for synchronizing freeing
In the Linux kernel, the following vulnerability has been resolved:
tracefs: Use generic inode RCU for synchronizing freeing
With structure layout randomization enabled for 'struct inode' we need to avoid overlapping any of the RCU-used / initialized-only-once members, e.g. ilru or isblist to not corrupt related list traversals when making use of the rcuhead.
For an unlucky structure layout of 'struct inode' we may end up with the following splat when running the ftrace selftests:
[<...>] listdel corruption, ffff888103ee2cb0->next (tracefsinodecache+0x0/0x4e0 [slab object]) is NULL (prev is tracefsinodecache+0x78/0x4e0 [slab object]) [<...>] ------------[ cut here ]------------ [<...>] kernel BUG at lib/listdebug.c:54! [<...>] invalid opcode: 0000 [#1] PREEMPT SMP KASAN [<...>] CPU: 3 PID: 2550 Comm: mount Tainted: G N 6.8.12-grsec+ #122 ed2f536ca62f28b087b90e3cc906a8d25b3ddc65 [<...>] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014 [<...>] RIP: 0010:[<ffffffff84656018>] listdelentryvalidorreport+0x138/0x3e0 [<...>] Code: 48 b8 99 fb 65 f2 ff ff ff ff e9 03 5c d9 fc cc 48 b8 99 fb 65 f2 ff ff ff ff e9 33 5a d9 fc cc 48 b8 99 fb 65 f2 ff ff ff ff <0f> 0b 4c 89 e9 48 89 ea 48 89 ee 48 c7 c7 60 8f dd 89 31 c0 e8 2f [<...>] RSP: 0018:fffffe80416afaf0 EFLAGS: 00010283 [<...>] RAX: 0000000000000098 RBX: ffff888103ee2cb0 RCX: 0000000000000000 [<...>] RDX: ffffffff84655fe8 RSI: ffffffff89dd8b60 RDI: 0000000000000001 [<...>] RBP: ffff888103ee2cb0 R08: 0000000000000001 R09: fffffbd0082d5f25 [<...>] R10: fffffe80416af92f R11: 0000000000000001 R12: fdf99c16731d9b6d [<...>] R13: 0000000000000000 R14: ffff88819ad4b8b8 R15: 0000000000000000 [<...>] RBX: tracefsinodecache+0x0/0x4e0 [slab object] [<...>] RDX: listdelentryvalidorreport+0x108/0x3e0 [<...>] RSI: func.47+0x4340/0x4400 [<...>] RBP: tracefsinodecache+0x0/0x4e0 [slab object] [<...>] RSP: process kstack fffffe80416afaf0+0x7af0/0x8000 [mount 2550 2550] [<...>] R09: kasan shadow of process kstack fffffe80416af928+0x7928/0x8000 [mount 2550 2550] [<...>] R10: process kstack fffffe80416af92f+0x792f/0x8000 [mount 2550 2550] [<...>] R14: tracefsinodecache+0x78/0x4e0 [slab object] [<...>] FS: 00006dcb380c1840(0000) GS:ffff8881e0600000(0000) knlGS:0000000000000000 [<...>] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [<...>] CR2: 000076ab72b30e84 CR3: 000000000b088004 CR4: 0000000000360ef0 shadow CR4: 0000000000360ef0 [<...>] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [<...>] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [<...>] ASID: 0003 [<...>] Stack: [<...>] ffffffff818a2315 00000000f5c856ee ffffffff896f1840 ffff888103ee2cb0 [<...>] ffff88812b6b9750 0000000079d714b6 fffffbfff1e9280b ffffffff8f49405f [<...>] 0000000000000001 0000000000000000 ffff888104457280 ffffffff8248b392 [<...>] Call Trace: [<...>] <TASK> [<...>] [<ffffffff818a2315>] ? lockrelease+0x175/0x380 fffffe80416afaf0 [<...>] [<ffffffff8248b392>] listlrudel+0x152/0x740 fffffe80416afb48 [<...>] [<ffffffff8248ba93>] listlrudelobj+0x113/0x280 fffffe80416afb88 [<...>] [<ffffffff8940fd19>] ? atomicdecandlock+0x119/0x200 fffffe80416afb90 [<...>] [<ffffffff8295b244>] iputfinal+0x1c4/0x9a0 fffffe80416afbb8 [<...>] [<ffffffff8293a52b>] dentryunlinkinode+0x44b/0xaa0 fffffe80416afbf8 [<...>] [<ffffffff8293fefc>] dentrykill+0x23c/0xf00 fffffe80416afc40 [<...>] [<ffffffff8953a85f>] ? thiscpupreemptcheck+0x1f/0xa0 fffffe80416afc48 [<...>] [<ffffffff82949ce5>] ? shrinkdentrylist+0x1c5/0x760 fffffe80416afc70 [<...>] [<ffffffff82949b71>] ? shrinkdentrylist+0x51/0x760 fffffe80416afc78 [<...>] [<ffffffff82949da8>] shrinkdentrylist+0x288/0x760 fffffe80416afc80 [<...>] [<ffffffff8294ae75>] shrinkdcachesb+0x155/0x420 fffffe80416afcc8 [<...>] [<ffffffff8953a7c3>] ? debugsmpprocessorid+0x23/0xa0 fffffe80416afce0 [<...>] [<ffffffff8294ad20>] ? doonetre ---truncated---
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.22-1Fixed in 6.12.25-1 - Compensating control
If structure layout randomization is enabled for 'struct inode', ensure RCU-used / initialized-only-once members do not overlap (per the described requirement: "With structure layout randomization enabled for 'struct inode' we need to avoid overlapping any of the RCU-used / initialized-only-once members").
Event History
Frequently Asked Questions
What is the severity of CVE-2024-44959?
CVE-2024-44959 has been classified as a high severity vulnerability in the Linux kernel.
How do I fix CVE-2024-44959?
To fix CVE-2024-44959, upgrade your Linux kernel to a version that is not affected by this vulnerability, such as the recommended patch versions provided by your distribution.
Which versions of the Linux kernel are affected by CVE-2024-44959?
CVE-2024-44959 affects multiple versions of the Linux kernel, specifically between versions 6.9 and 6.11-rc2.
Can CVE-2024-44959 be exploited remotely?
CVE-2024-44959 may allow local attackers to exploit the vulnerability, potentially leading to privilege escalation.
What components of the Linux kernel are impacted by CVE-2024-44959?
CVE-2024-44959 specifically impacts the tracefs subsystem and the handling of generic inode synchronization.