CVE-2024-53112: ocfs2: uncache inode which has failed entering the group
First published: Mon Dec 02 2024(Updated: )
In the Linux kernel, the following vulnerability has been resolved: ocfs2: uncache inode which has failed entering the group Syzbot has reported the following BUG: kernel BUG at fs/ocfs2/uptodate.c:509! ... Call Trace: <TASK> ? __die_body+0x5f/0xb0 ? die+0x9e/0xc0 ? do_trap+0x15a/0x3a0 ? ocfs2_set_new_buffer_uptodate+0x145/0x160 ? do_error_trap+0x1dc/0x2c0 ? ocfs2_set_new_buffer_uptodate+0x145/0x160 ? __pfx_do_error_trap+0x10/0x10 ? handle_invalid_op+0x34/0x40 ? ocfs2_set_new_buffer_uptodate+0x145/0x160 ? exc_invalid_op+0x38/0x50 ? asm_exc_invalid_op+0x1a/0x20 ? ocfs2_set_new_buffer_uptodate+0x2e/0x160 ? ocfs2_set_new_buffer_uptodate+0x144/0x160 ? ocfs2_set_new_buffer_uptodate+0x145/0x160 ocfs2_group_add+0x39f/0x15a0 ? __pfx_ocfs2_group_add+0x10/0x10 ? __pfx_lock_acquire+0x10/0x10 ? mnt_get_write_access+0x68/0x2b0 ? __pfx_lock_release+0x10/0x10 ? rcu_read_lock_any_held+0xb7/0x160 ? __pfx_rcu_read_lock_any_held+0x10/0x10 ? smack_log+0x123/0x540 ? mnt_get_write_access+0x68/0x2b0 ? mnt_get_write_access+0x68/0x2b0 ? mnt_get_write_access+0x226/0x2b0 ocfs2_ioctl+0x65e/0x7d0 ? __pfx_ocfs2_ioctl+0x10/0x10 ? smack_file_ioctl+0x29e/0x3a0 ? __pfx_smack_file_ioctl+0x10/0x10 ? lockdep_hardirqs_on_prepare+0x43d/0x780 ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 ? __pfx_ocfs2_ioctl+0x10/0x10 __se_sys_ioctl+0xfb/0x170 do_syscall_64+0xf3/0x230 entry_SYSCALL_64_after_hwframe+0x77/0x7f ... </TASK> When 'ioctl(OCFS2_IOC_GROUP_ADD, ...)' has failed for the particular inode in 'ocfs2_verify_group_and_input()', corresponding buffer head remains cached and subsequent call to the same 'ioctl()' for the same inode issues the BUG() in 'ocfs2_set_new_buffer_uptodate()' (trying to cache the same buffer head of that inode). Fix this by uncaching the buffer head with 'ocfs2_remove_from_cache()' on error path in 'ocfs2_group_add()'.
Credit: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Linux Kernel | >=2.6.25<4.19.325 | |
| Linux Kernel | >=4.20<6.1.119 | |
| Linux Kernel | >=6.2<6.6.63 | |
| Linux Kernel | >=6.7<6.11.10 | |
| Linux Kernel | =6.12-rc1 | |
| Linux Kernel | =6.12-rc2 | |
| Linux Kernel | =6.12-rc3 | |
| Linux Kernel | =6.12-rc4 | |
| Linux Kernel | =6.12-rc5 | |
| Linux Kernel | =6.12-rc6 | |
| Linux Kernel | =6.12-rc7 | |
| debian/linux | <=5.10.223-1 | 5.10.234-1 6.1.129-1 6.1.128-1 6.12.21-1 |
| debian/linux-6.1 | 6.1.129-1~deb11u1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://git.kernel.org/stable/c/ac0cfe8ac35cf1be54131b90d114087b558777ca
- https://git.kernel.org/stable/c/5ae8cc0b0c027e9cab22596049bc4dd1cbc37ee4
- https://git.kernel.org/stable/c/28d4ed71ae0b4baedca3e85ee6d8f227ec75ebf6
- https://git.kernel.org/stable/c/0e04746db2ec4aec04cef5763b9d9aa32829ae2f
- https://git.kernel.org/stable/c/620d22598110b0d0cb97a3fcca65fc473ea86e73
- https://git.kernel.org/stable/c/843dfc804af4b338ead42331dd58081b428ecdf8
- https://git.kernel.org/stable/c/b751c50e19d66cfb7360c0b55cf17b0722252d12
- https://git.kernel.org/stable/c/737f34137844d6572ab7d473c998c7f977ff30eb
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-53112
- https://nvd.nist.gov/vuln/detail/CVE-2024-53112
- https://launchpad.net/bugs/cve/CVE-2024-53112
- https://security-tracker.debian.org/tracker/CVE-2024-53112
- https://ubuntu.com/security/CVE-2024-53112
- https://git.kernel.org/linus/737f34137844d6572ab7d473c998c7f977ff30eb
Frequently Asked Questions
What is the severity of CVE-2024-53112?
CVE-2024-53112 is classified with high severity due to its potential impact on system stability and security.
How do I fix CVE-2024-53112?
To fix CVE-2024-53112, update your Linux kernel to a version that has addressed the vulnerability.
Which versions of the Linux kernel are affected by CVE-2024-53112?
CVE-2024-53112 affects Linux kernel versions from 2.6.25 to 4.19.325, 4.20 to 6.1.119, 6.2 to 6.6.63, and 6.7 to 6.11.10, along with the 6.12 release candidates.
What is the nature of the vulnerability described in CVE-2024-53112?
CVE-2024-53112 involves an issue in the ocfs2 filesystem that causes the kernel to encounter a bug when an inode fails to enter the group.
Is there a workaround for CVE-2024-53112 until I can apply the fix?
A temporary workaround may include disabling the ocfs2 filesystem, but it is recommended to update to patched versions as soon as possible.
- agent/title
- agent/type
- agent/first-publish-date
- agent/author
- agent/remedy
- agent/severity
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/trending
- collector/usn-cve
- source/Ubuntu
- collector/launchpad-cve
- source/Launchpad
- agent/references
- agent/source
- agent/description
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/event
- agent/softwarecombine
- agent/tags
- collector/security-tracker-debian
- source/Debian
- collector/nvd-cve
- vendor/linux
- canonical/linux kernel
- version/linux kernel/2.6.25
- version/linux kernel/4.20
- version/linux kernel/6.2
- version/linux kernel/6.7
- version/linux kernel/6.12-rc1
- version/linux kernel/6.12-rc2
- version/linux kernel/6.12-rc3
- version/linux kernel/6.12-rc4
- version/linux kernel/6.12-rc5
- version/linux kernel/6.12-rc6
- version/linux kernel/6.12-rc7
- package-manager/debian