linux-cve-announce - CVE-2024-26773: ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2024040308-CVE-2024-26773-a314@gregkh>
Date: Wed,  3 Apr 2024 19:31:40 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: CVE-2024-26773: ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found()

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found()

Determine if the group block bitmap is corrupted before using ac_b_ex in
ext4_mb_try_best_found() to avoid allocating blocks from a group with a
corrupted block bitmap in the following concurrency and making the
situation worse.

ext4_mb_regular_allocator
  ext4_lock_group(sb, group)
  ext4_mb_good_group
   // check if the group bbitmap is corrupted
  ext4_mb_complex_scan_group
   // Scan group gets ac_b_ex but doesn't use it
  ext4_unlock_group(sb, group)
                           ext4_mark_group_bitmap_corrupted(group)
                           // The block bitmap was corrupted during
                           // the group unlock gap.
  ext4_mb_try_best_found
    ext4_lock_group(ac->ac_sb, group)
    ext4_mb_use_best_found
      mb_mark_used
      // Allocating blocks in block bitmap corrupted group

The Linux kernel CVE team has assigned CVE-2024-26773 to this issue.


Affected and fixed versions
===========================

	Fixed in 4.19.308 with commit 21f8cfe79f77
	Fixed in 5.4.270 with commit 260fc96283c0
	Fixed in 5.10.211 with commit 927794a02169
	Fixed in 5.15.150 with commit 4c21fa60a6f4
	Fixed in 6.1.80 with commit f97e75fa4e12
	Fixed in 6.6.19 with commit 0184747b552d
	Fixed in 6.7.7 with commit a2576ae9a35c
	Fixed in 6.8 with commit 4530b3660d39

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2024-26773
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	fs/ext4/mballoc.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/21f8cfe79f776287459343e9cfa6055af61328ea
	https://git.kernel.org/stable/c/260fc96283c0f594de18a1b045faf6d8fb42874d
	https://git.kernel.org/stable/c/927794a02169778c9c2e7b25c768ab3ea8c1dc03
	https://git.kernel.org/stable/c/4c21fa60a6f4606f6214a38f50612b17b2f738f5
	https://git.kernel.org/stable/c/f97e75fa4e12b0aa0224e83fcbda8853ac2adf36
	https://git.kernel.org/stable/c/0184747b552d6b5a14db3b7fcc3b792ce64dedd1
	https://git.kernel.org/stable/c/a2576ae9a35c078e488f2c573e9e6821d651fbbe
	https://git.kernel.org/stable/c/4530b3660d396a646aad91a787b6ab37cf604b53