CVE-2024-26899

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-26899
In the Linux kernel, the following vulnerability has been resolved: block: fix deadlock between bd_link_disk_holder and partition scan 'open_mutex' of gendisk is used to protect open/close block devices. But in bd_link_disk_holder(), it is used to protect the creation of symlink between holding disk and slave bdev, which introduces some issues. When bd_link_disk_holder() is called, the driver is usually in the process of initialization/modification and may suspend submitting io. At this time, any io hold 'open_mutex', such as scanning partitions, can cause deadlocks. For example, in raid: T1 T2 bdev_open_by_dev lock open_mutex [1] ... efi_partition ... md_submit_bio md_ioctl mddev_syspend -> suspend all io md_add_new_disk bind_rdev_to_array bd_link_disk_holder try lock open_mutex [2] md_handle_request -> wait mddev_resume T1 scan partition, T2 add a new device to raid. T1 waits for T2 to resume mddev, but T2 waits for open_mutex held by T1. Deadlock occurs. Fix it by introducing a local mutex 'blk_holder_mutex' to replace 'open_mutex'.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/03f12122b20b6e6028e9ed69030a49f9cffcbb75 Patch
https://git.kernel.org/stable/c/1e5c5b0abaee7b62a10b9707a62083b71ad21f62 Patch
https://git.kernel.org/stable/c/5a87c1f7993bc8ac358a3766bac5dc7126e01e98 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

29 Apr 2024, 19:34

Type Values Removed Values Added
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
CWE CWE-667
First Time Linux linux Kernel
Linux
References () https://git.kernel.org/stable/c/03f12122b20b6e6028e9ed69030a49f9cffcbb75 - () https://git.kernel.org/stable/c/03f12122b20b6e6028e9ed69030a49f9cffcbb75 - Patch
References () https://git.kernel.org/stable/c/1e5c5b0abaee7b62a10b9707a62083b71ad21f62 - () https://git.kernel.org/stable/c/1e5c5b0abaee7b62a10b9707a62083b71ad21f62 - Patch
References () https://git.kernel.org/stable/c/5a87c1f7993bc8ac358a3766bac5dc7126e01e98 - () https://git.kernel.org/stable/c/5a87c1f7993bc8ac358a3766bac5dc7126e01e98 - Patch
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: bloque: soluciona el punto muerto entre bd_link_disk_holder y el análisis de partición. 'open_mutex' de gendisk se utiliza para proteger dispositivos de bloqueo de apertura/cierre. Pero en bd_link_disk_holder(), se utiliza para proteger la creación de un enlace simbólico entre el disco de retención y el bdev esclavo, lo que introduce algunos problemas. Cuando se llama a bd_link_disk_holder(), el controlador generalmente está en el proceso de inicialización/modificación y puede suspender el envío de io. En este momento, cualquier retención de io 'open_mutex', como escanear particiones, puede causar interbloqueos. Por ejemplo, en raid: T1 T2 bdev_open_by_dev lock open_mutex [1] ... efi_partition ... md_submit_bio md_ioctl mddev_syspend -> suspender todo io md_add_new_disk bind_rdev_to_array bd_link_disk_holder try lock open_mutex [2] md_handle_request -> esperar mddev_resume T1 escanear partición, agregar un Nuevo dispositivo para atacar. T1 espera a que T2 reanude mddev, pero T2 espera a open_mutex retenido por T1. Se produce un punto muerto. Solucionarlo introduciendo un mutex local 'blk_holder_mutex' para reemplazar 'open_mutex'.

17 Apr 2024, 11:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-04-17 11:15

Updated : 2024-04-29 19:34

NVD link : CVE-2024-26899

Mitre link : CVE-2024-26899

CVE.ORG link : CVE-2024-26899

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-667

Improper Locking