CVE-2024-27058

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-27058
In the Linux kernel, the following vulnerability has been resolved: tmpfs: fix race on handling dquot rbtree A syzkaller reproducer found a race while attempting to remove dquot information from the rb tree. Fetching the rb_tree root node must also be protected by the dqopt->dqio_sem, otherwise, giving the right timing, shmem_release_dquot() will trigger a warning because it couldn't find a node in the tree, when the real reason was the root node changing before the search starts: Thread 1 Thread 2 - shmem_release_dquot() - shmem_{acquire,release}_dquot() - fetch ROOT - Fetch ROOT - acquire dqio_sem - wait dqio_sem - do something, triger a tree rebalance - release dqio_sem - acquire dqio_sem - start searching for the node, but from the wrong location, missing the node, and triggering a warning.

4.7 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.2 / Impact : 3.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/0a69b6b3a026543bc215ccc866d0aea5579e6ce2 Patch
https://git.kernel.org/stable/c/617d55b90e73c7b4aa2733ca6cc3f9b72d1124bb Patch
https://git.kernel.org/stable/c/c7077f43f30d817d10a9f8245e51576ac114b2f0 Patch
https://git.kernel.org/stable/c/f82f184874d2761ebaa60dccf577921a0dbb3810 Patch
https://git.kernel.org/stable/c/0a69b6b3a026543bc215ccc866d0aea5579e6ce2 Patch
https://git.kernel.org/stable/c/617d55b90e73c7b4aa2733ca6cc3f9b72d1124bb Patch
https://git.kernel.org/stable/c/c7077f43f30d817d10a9f8245e51576ac114b2f0 Patch
https://git.kernel.org/stable/c/f82f184874d2761ebaa60dccf577921a0dbb3810 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*
History

08 Apr 2025, 19:42

Type Values Removed Values Added
First Time Linux linux Kernel
Linux
CPE cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
CWE CWE-362
References () https://git.kernel.org/stable/c/0a69b6b3a026543bc215ccc866d0aea5579e6ce2 - () https://git.kernel.org/stable/c/0a69b6b3a026543bc215ccc866d0aea5579e6ce2 - Patch
References () https://git.kernel.org/stable/c/617d55b90e73c7b4aa2733ca6cc3f9b72d1124bb - () https://git.kernel.org/stable/c/617d55b90e73c7b4aa2733ca6cc3f9b72d1124bb - Patch
References () https://git.kernel.org/stable/c/c7077f43f30d817d10a9f8245e51576ac114b2f0 - () https://git.kernel.org/stable/c/c7077f43f30d817d10a9f8245e51576ac114b2f0 - Patch
References () https://git.kernel.org/stable/c/f82f184874d2761ebaa60dccf577921a0dbb3810 - () https://git.kernel.org/stable/c/f82f184874d2761ebaa60dccf577921a0dbb3810 - Patch

21 Nov 2024, 09:03

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/0a69b6b3a026543bc215ccc866d0aea5579e6ce2 - () https://git.kernel.org/stable/c/0a69b6b3a026543bc215ccc866d0aea5579e6ce2 -
References () https://git.kernel.org/stable/c/617d55b90e73c7b4aa2733ca6cc3f9b72d1124bb - () https://git.kernel.org/stable/c/617d55b90e73c7b4aa2733ca6cc3f9b72d1124bb -
References () https://git.kernel.org/stable/c/c7077f43f30d817d10a9f8245e51576ac114b2f0 - () https://git.kernel.org/stable/c/c7077f43f30d817d10a9f8245e51576ac114b2f0 -
References () https://git.kernel.org/stable/c/f82f184874d2761ebaa60dccf577921a0dbb3810 - () https://git.kernel.org/stable/c/f82f184874d2761ebaa60dccf577921a0dbb3810 -

01 Nov 2024, 17:35

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 4.7
Summary
  • (es) En el kernel de Linux, se resolvió la siguiente vulnerabilidad: tmpfs: corrige la ejecución al manejar dquot rbtree Un reproductor syzkaller encontró una ejecución al intentar eliminar información de dquot del árbol rb. La recuperación del nodo raíz de rb_tree también debe estar protegida por dqopt->dqio_sem; de lo contrario, si se da el momento adecuado, shmem_release_dquot() activará una advertencia porque no pudo encontrar un nodo en el árbol, cuando la verdadera razón era el nodo raíz. cambiando antes de que comience la búsqueda: Hilo 1 Hilo 2 - shmem_release_dquot() - shmem_{acquire,release}_dquot() - buscar ROOT - Obtener ROOT - adquirir dqio_sem - esperar dqio_sem - hacer algo, activar un reequilibrio de árbol - liberar dqio_sem - adquirir dqio_sem - comienza a buscar el nodo, pero desde la ubicación incorrecta, pierde el nodo y genera una advertencia.

01 May 2024, 13:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-05-01 13:15

Updated : 2025-04-08 19:42

NVD link : CVE-2024-27058

Mitre link : CVE-2024-27058

CVE.ORG link : CVE-2024-27058

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')