Skip to content

In the Linux kernel, the following vulnerability has been...

Moderate severity Unreviewed Published Sep 4, 2024 to the GitHub Advisory Database • Updated Oct 9, 2024

Package

No package listedSuggest a package

Affected versions

Unknown

Patched versions

Unknown

Description

In the Linux kernel, the following vulnerability has been resolved:

vfs: Don't evict inode under the inode lru traversing context

The inode reclaiming process(See function prune_icache_sb) collects all
reclaimable inodes and mark them with I_FREEING flag at first, at that
time, other processes will be stuck if they try getting these inodes
(See function find_inode_fast), then the reclaiming process destroy the
inodes by function dispose_list(). Some filesystems(eg. ext4 with
ea_inode feature, ubifs with xattr) may do inode lookup in the inode
evicting callback function, if the inode lookup is operated under the
inode lru traversing context, deadlock problems may happen.

Case 1: In function ext4_evict_inode(), the ea inode lookup could happen
if ea_inode feature is enabled, the lookup process will be stuck
under the evicting context like this:

  1. File A has inode i_reg and an ea inode i_ea

  2. getfattr(A, xattr_buf) // i_ea is added into lru // lru->i_ea

  3. Then, following three processes running like this:

    PA PB
    echo 2 > /proc/sys/vm/drop_caches
    shrink_slab
    prune_dcache_sb
    // i_reg is added into lru, lru->i_ea->i_reg
    prune_icache_sb
    list_lru_walk_one
    inode_lru_isolate
    i_ea->i_state |= I_FREEING // set inode state
    inode_lru_isolate
    __iget(i_reg)
    spin_unlock(&i_reg->i_lock)
    spin_unlock(lru_lock)
    rm file A
    i_reg->nlink = 0
    iput(i_reg) // i_reg->nlink is 0, do evict
    ext4_evict_inode
    ext4_xattr_delete_inode
    ext4_xattr_inode_dec_ref_all
    ext4_xattr_inode_iget
    ext4_iget(i_ea->i_ino)
    iget_locked
    find_inode_fast
    __wait_on_freeing_inode(i_ea) ----→ AA deadlock
    dispose_list // cannot be executed by prune_icache_sb
    wake_up_bit(&i_ea->i_state)

Case 2: In deleted inode writing function ubifs_jnl_write_inode(), file
deleting process holds BASEHD's wbuf->io_mutex while getting the
xattr inode, which could race with inode reclaiming process(The
reclaiming process could try locking BASEHD's wbuf->io_mutex in
inode evicting function), then an ABBA deadlock problem would
happen as following:

  1. File A has inode ia and a xattr(with inode ixa), regular file B has
    inode ib and a xattr.

  2. getfattr(A, xattr_buf) // ixa is added into lru // lru->ixa

  3. Then, following three processes running like this:

    PA                PB                        PC
            echo 2 > /proc/sys/vm/drop_caches
             shrink_slab
              prune_dcache_sb
              // ib and ia are added into lru, lru->ixa->ib->ia
              prune_icache_sb
               list_lru_walk_one
                inode_lru_isolate
                 ixa->i_state |= I_FREEING // set inode state
                inode_lru_isolate
                 __iget(ib)
                 spin_unlock(&ib->i_lock)
                 spin_unlock(lru_lock)
                                               rm file B
                                                ib->nlink = 0
    

rm file A
iput(ia)
ubifs_evict_inode(ia)
ubifs_jnl_delete_inode(ia)
ubifs_jnl_write_inode(ia)
make_reservation(BASEHD) // Lock wbuf->io_mutex
ubifs_iget(ixa->i_ino)
iget_locked
find_inode_fast
__wait_on_freeing_inode(ixa)
| iput(ib) // ib->nlink is 0, do evict
| ubifs_evict_inode
| ubifs_jnl_delete_inode(ib)
↓ ubifs_jnl_write_inode
ABBA deadlock ←-----make_reservation(BASEHD)
dispose_list // cannot be executed by prune_icache_sb
wake_up_bit(&ixa->i_state)

Fix the possible deadlock by using new inode state flag I_LRU_ISOLATING
to pin the inode in memory while inode_lru_isolate(
---truncated---

References

Published by the National Vulnerability Database Sep 4, 2024
Published to the GitHub Advisory Database Sep 4, 2024
Last updated Oct 9, 2024

Severity

Moderate

CVSS overall score

This score calculates overall vulnerability severity from 0 to 10 and is based on the Common Vulnerability Scoring System (CVSS).
/ 10

CVSS v3 base metrics

Attack vector
Local
Attack complexity
High
Privileges required
Low
User interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

CVSS v3 base metrics

Attack vector: More severe the more the remote (logically and physically) an attacker can be in order to exploit the vulnerability.
Attack complexity: More severe for the least complex attacks.
Privileges required: More severe if no privileges are required.
User interaction: More severe when no user interaction is required.
Scope: More severe when a scope change occurs, e.g. one vulnerable component impacts resources in components beyond its security scope.
Confidentiality: More severe when loss of data confidentiality is highest, measuring the level of data access available to an unauthorized user.
Integrity: More severe when loss of data integrity is the highest, measuring the consequence of data modification possible by an unauthorized user.
Availability: More severe when the loss of impacted component availability is highest.
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS score

0.042%
(5th percentile)

Weaknesses

CVE ID

CVE-2024-45003

GHSA ID

GHSA-qv39-hg6q-9r5r

Source code

No known source code

Dependabot alerts are not supported on this advisory because it does not have a package from a supported ecosystem with an affected and fixed version.

Learn more about GitHub language support

Loading Checking history
See something to contribute? Suggest improvements for this vulnerability.