cve-2024-42077
Vulnerability from cvelistv5
Published
2024-07-29 15:52
Modified
2024-12-19 09:12
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix DIO failure due to insufficient transaction credits The code in ocfs2_dio_end_io_write() estimates number of necessary transaction credits using ocfs2_calc_extend_credits(). This however does not take into account that the IO could be arbitrarily large and can contain arbitrary number of extents. Extent tree manipulations do often extend the current transaction but not in all of the cases. For example if we have only single block extents in the tree, ocfs2_mark_extent_written() will end up calling ocfs2_replace_extent_rec() all the time and we will never extend the current transaction and eventually exhaust all the transaction credits if the IO contains many single block extents. Once that happens a WARN_ON(jbd2_handle_buffer_credits(handle) <= 0) is triggered in jbd2_journal_dirty_metadata() and subsequently OCFS2 aborts in response to this error. This was actually triggered by one of our customers on a heavily fragmented OCFS2 filesystem. To fix the issue make sure the transaction always has enough credits for one extent insert before each call of ocfs2_mark_extent_written(). Heming Zhao said: ------ PANIC: "Kernel panic - not syncing: OCFS2: (device dm-1): panic forced after error" PID: xxx TASK: xxxx CPU: 5 COMMAND: "SubmitThread-CA" #0 machine_kexec at ffffffff8c069932 #1 __crash_kexec at ffffffff8c1338fa #2 panic at ffffffff8c1d69b9 #3 ocfs2_handle_error at ffffffffc0c86c0c [ocfs2] #4 __ocfs2_abort at ffffffffc0c88387 [ocfs2] #5 ocfs2_journal_dirty at ffffffffc0c51e98 [ocfs2] #6 ocfs2_split_extent at ffffffffc0c27ea3 [ocfs2] #7 ocfs2_change_extent_flag at ffffffffc0c28053 [ocfs2] #8 ocfs2_mark_extent_written at ffffffffc0c28347 [ocfs2] #9 ocfs2_dio_end_io_write at ffffffffc0c2bef9 [ocfs2] #10 ocfs2_dio_end_io at ffffffffc0c2c0f5 [ocfs2] #11 dio_complete at ffffffff8c2b9fa7 #12 do_blockdev_direct_IO at ffffffff8c2bc09f #13 ocfs2_direct_IO at ffffffffc0c2b653 [ocfs2] #14 generic_file_direct_write at ffffffff8c1dcf14 #15 __generic_file_write_iter at ffffffff8c1dd07b #16 ocfs2_file_write_iter at ffffffffc0c49f1f [ocfs2] #17 aio_write at ffffffff8c2cc72e #18 kmem_cache_alloc at ffffffff8c248dde #19 do_io_submit at ffffffff8c2ccada #20 do_syscall_64 at ffffffff8c004984 #21 entry_SYSCALL_64_after_hwframe at ffffffff8c8000ba
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/320273b5649bbcee87f9e65343077189699d2a7aPatch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/331d1079d58206ff7dc5518185f800b412f89bc6Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/9ea2d1c6789722d58ec191f14f9a02518d55b6b4Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/a68b896aa56e435506453ec8835bc991ec3ae687Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/be346c1a6eeb49d8fda827d2a9522124c2f72f36Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/c05ffb693bfb42a48ef3ee88a55b57392984e111Patch
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/320273b5649bbcee87f9e65343077189699d2a7aPatch
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/331d1079d58206ff7dc5518185f800b412f89bc6Patch
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/9ea2d1c6789722d58ec191f14f9a02518d55b6b4Patch
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/a68b896aa56e435506453ec8835bc991ec3ae687Patch
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/be346c1a6eeb49d8fda827d2a9522124c2f72f36Patch
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/c05ffb693bfb42a48ef3ee88a55b57392984e111Patch
Impacted products
Vendor Product Version
Linux Linux Version: c15471f79506830f80eca0e7fe09b8213953ab5f
Version: c15471f79506830f80eca0e7fe09b8213953ab5f
Version: c15471f79506830f80eca0e7fe09b8213953ab5f
Version: c15471f79506830f80eca0e7fe09b8213953ab5f
Version: c15471f79506830f80eca0e7fe09b8213953ab5f
Version: c15471f79506830f80eca0e7fe09b8213953ab5f
 Create a notification for this product.
   Linux Linux Version: 4.6
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T04:54:32.199Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/a68b896aa56e435506453ec8835bc991ec3ae687"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/320273b5649bbcee87f9e65343077189699d2a7a"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/9ea2d1c6789722d58ec191f14f9a02518d55b6b4"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/c05ffb693bfb42a48ef3ee88a55b57392984e111"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/331d1079d58206ff7dc5518185f800b412f89bc6"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/be346c1a6eeb49d8fda827d2a9522124c2f72f36"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-42077",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T16:19:23.681677Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:33:57.349Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/ocfs2/aops.c",
            "fs/ocfs2/journal.c",
            "fs/ocfs2/journal.h",
            "fs/ocfs2/ocfs2_trace.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a68b896aa56e435506453ec8835bc991ec3ae687",
              "status": "affected",
              "version": "c15471f79506830f80eca0e7fe09b8213953ab5f",
              "versionType": "git"
            },
            {
              "lessThan": "320273b5649bbcee87f9e65343077189699d2a7a",
              "status": "affected",
              "version": "c15471f79506830f80eca0e7fe09b8213953ab5f",
              "versionType": "git"
            },
            {
              "lessThan": "9ea2d1c6789722d58ec191f14f9a02518d55b6b4",
              "status": "affected",
              "version": "c15471f79506830f80eca0e7fe09b8213953ab5f",
              "versionType": "git"
            },
            {
              "lessThan": "c05ffb693bfb42a48ef3ee88a55b57392984e111",
              "status": "affected",
              "version": "c15471f79506830f80eca0e7fe09b8213953ab5f",
              "versionType": "git"
            },
            {
              "lessThan": "331d1079d58206ff7dc5518185f800b412f89bc6",
              "status": "affected",
              "version": "c15471f79506830f80eca0e7fe09b8213953ab5f",
              "versionType": "git"
            },
            {
              "lessThan": "be346c1a6eeb49d8fda827d2a9522124c2f72f36",
              "status": "affected",
              "version": "c15471f79506830f80eca0e7fe09b8213953ab5f",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/ocfs2/aops.c",
            "fs/ocfs2/journal.c",
            "fs/ocfs2/journal.h",
            "fs/ocfs2/ocfs2_trace.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.6"
            },
            {
              "lessThan": "4.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.162",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.37",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.9.*",
              "status": "unaffected",
              "version": "6.9.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.10",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: fix DIO failure due to insufficient transaction credits\n\nThe code in ocfs2_dio_end_io_write() estimates number of necessary\ntransaction credits using ocfs2_calc_extend_credits().  This however does\nnot take into account that the IO could be arbitrarily large and can\ncontain arbitrary number of extents.\n\nExtent tree manipulations do often extend the current transaction but not\nin all of the cases.  For example if we have only single block extents in\nthe tree, ocfs2_mark_extent_written() will end up calling\nocfs2_replace_extent_rec() all the time and we will never extend the\ncurrent transaction and eventually exhaust all the transaction credits if\nthe IO contains many single block extents.  Once that happens a\nWARN_ON(jbd2_handle_buffer_credits(handle) \u003c= 0) is triggered in\njbd2_journal_dirty_metadata() and subsequently OCFS2 aborts in response to\nthis error.  This was actually triggered by one of our customers on a\nheavily fragmented OCFS2 filesystem.\n\nTo fix the issue make sure the transaction always has enough credits for\none extent insert before each call of ocfs2_mark_extent_written().\n\nHeming Zhao said:\n\n------\nPANIC: \"Kernel panic - not syncing: OCFS2: (device dm-1): panic forced after error\"\n\nPID: xxx  TASK: xxxx  CPU: 5  COMMAND: \"SubmitThread-CA\"\n  #0 machine_kexec at ffffffff8c069932\n  #1 __crash_kexec at ffffffff8c1338fa\n  #2 panic at ffffffff8c1d69b9\n  #3 ocfs2_handle_error at ffffffffc0c86c0c [ocfs2]\n  #4 __ocfs2_abort at ffffffffc0c88387 [ocfs2]\n  #5 ocfs2_journal_dirty at ffffffffc0c51e98 [ocfs2]\n  #6 ocfs2_split_extent at ffffffffc0c27ea3 [ocfs2]\n  #7 ocfs2_change_extent_flag at ffffffffc0c28053 [ocfs2]\n  #8 ocfs2_mark_extent_written at ffffffffc0c28347 [ocfs2]\n  #9 ocfs2_dio_end_io_write at ffffffffc0c2bef9 [ocfs2]\n#10 ocfs2_dio_end_io at ffffffffc0c2c0f5 [ocfs2]\n#11 dio_complete at ffffffff8c2b9fa7\n#12 do_blockdev_direct_IO at ffffffff8c2bc09f\n#13 ocfs2_direct_IO at ffffffffc0c2b653 [ocfs2]\n#14 generic_file_direct_write at ffffffff8c1dcf14\n#15 __generic_file_write_iter at ffffffff8c1dd07b\n#16 ocfs2_file_write_iter at ffffffffc0c49f1f [ocfs2]\n#17 aio_write at ffffffff8c2cc72e\n#18 kmem_cache_alloc at ffffffff8c248dde\n#19 do_io_submit at ffffffff8c2ccada\n#20 do_syscall_64 at ffffffff8c004984\n#21 entry_SYSCALL_64_after_hwframe at ffffffff8c8000ba"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-19T09:12:17.676Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a68b896aa56e435506453ec8835bc991ec3ae687"
        },
        {
          "url": "https://git.kernel.org/stable/c/320273b5649bbcee87f9e65343077189699d2a7a"
        },
        {
          "url": "https://git.kernel.org/stable/c/9ea2d1c6789722d58ec191f14f9a02518d55b6b4"
        },
        {
          "url": "https://git.kernel.org/stable/c/c05ffb693bfb42a48ef3ee88a55b57392984e111"
        },
        {
          "url": "https://git.kernel.org/stable/c/331d1079d58206ff7dc5518185f800b412f89bc6"
        },
        {
          "url": "https://git.kernel.org/stable/c/be346c1a6eeb49d8fda827d2a9522124c2f72f36"
        }
      ],
      "title": "ocfs2: fix DIO failure due to insufficient transaction credits",
      "x_generator": {
        "engine": "bippy-5f407fcff5a0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-42077",
    "datePublished": "2024-07-29T15:52:39.661Z",
    "dateReserved": "2024-07-29T15:50:41.169Z",
    "dateUpdated": "2024-12-19T09:12:17.676Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-42077\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-07-29T16:15:07.037\",\"lastModified\":\"2024-11-21T09:33:32.807\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nocfs2: fix DIO failure due to insufficient transaction credits\\n\\nThe code in ocfs2_dio_end_io_write() estimates number of necessary\\ntransaction credits using ocfs2_calc_extend_credits().  This however does\\nnot take into account that the IO could be arbitrarily large and can\\ncontain arbitrary number of extents.\\n\\nExtent tree manipulations do often extend the current transaction but not\\nin all of the cases.  For example if we have only single block extents in\\nthe tree, ocfs2_mark_extent_written() will end up calling\\nocfs2_replace_extent_rec() all the time and we will never extend the\\ncurrent transaction and eventually exhaust all the transaction credits if\\nthe IO contains many single block extents.  Once that happens a\\nWARN_ON(jbd2_handle_buffer_credits(handle) \u003c= 0) is triggered in\\njbd2_journal_dirty_metadata() and subsequently OCFS2 aborts in response to\\nthis error.  This was actually triggered by one of our customers on a\\nheavily fragmented OCFS2 filesystem.\\n\\nTo fix the issue make sure the transaction always has enough credits for\\none extent insert before each call of ocfs2_mark_extent_written().\\n\\nHeming Zhao said:\\n\\n------\\nPANIC: \\\"Kernel panic - not syncing: OCFS2: (device dm-1): panic forced after error\\\"\\n\\nPID: xxx  TASK: xxxx  CPU: 5  COMMAND: \\\"SubmitThread-CA\\\"\\n  #0 machine_kexec at ffffffff8c069932\\n  #1 __crash_kexec at ffffffff8c1338fa\\n  #2 panic at ffffffff8c1d69b9\\n  #3 ocfs2_handle_error at ffffffffc0c86c0c [ocfs2]\\n  #4 __ocfs2_abort at ffffffffc0c88387 [ocfs2]\\n  #5 ocfs2_journal_dirty at ffffffffc0c51e98 [ocfs2]\\n  #6 ocfs2_split_extent at ffffffffc0c27ea3 [ocfs2]\\n  #7 ocfs2_change_extent_flag at ffffffffc0c28053 [ocfs2]\\n  #8 ocfs2_mark_extent_written at ffffffffc0c28347 [ocfs2]\\n  #9 ocfs2_dio_end_io_write at ffffffffc0c2bef9 [ocfs2]\\n#10 ocfs2_dio_end_io at ffffffffc0c2c0f5 [ocfs2]\\n#11 dio_complete at ffffffff8c2b9fa7\\n#12 do_blockdev_direct_IO at ffffffff8c2bc09f\\n#13 ocfs2_direct_IO at ffffffffc0c2b653 [ocfs2]\\n#14 generic_file_direct_write at ffffffff8c1dcf14\\n#15 __generic_file_write_iter at ffffffff8c1dd07b\\n#16 ocfs2_file_write_iter at ffffffffc0c49f1f [ocfs2]\\n#17 aio_write at ffffffff8c2cc72e\\n#18 kmem_cache_alloc at ffffffff8c248dde\\n#19 do_io_submit at ffffffff8c2ccada\\n#20 do_syscall_64 at ffffffff8c004984\\n#21 entry_SYSCALL_64_after_hwframe at ffffffff8c8000ba\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: ocfs2: corrige la falla de DIO debido a cr\u00e9ditos de transacci\u00f3n insuficientes. El c\u00f3digo en ocfs2_dio_end_io_write() estima el n\u00famero de cr\u00e9ditos de transacci\u00f3n necesarios usando ocfs2_calc_extend_credits(). Sin embargo, esto no tiene en cuenta que el IO podr\u00eda ser arbitrariamente grande y contener un n\u00famero arbitrario de extensiones. Las manipulaciones del \u00e1rbol de extensi\u00f3n a menudo extienden la transacci\u00f3n actual, pero no en todos los casos. Por ejemplo, si solo tenemos extensiones de un solo bloque en el \u00e1rbol, ocfs2_mark_extent_write() terminar\u00e1 llamando a ocfs2_replace_extent_rec() todo el tiempo y nunca extenderemos la transacci\u00f3n actual y eventualmente agotaremos todos los cr\u00e9ditos de la transacci\u00f3n si el IO contiene muchas extensiones de un solo bloque. Una vez que eso sucede, se activa un WARN_ON(jbd2_handle_buffer_credits(handle) \u0026lt;= 0) en jbd2_journal_dirty_metadata() y posteriormente OCFS2 cancela en respuesta a este error. En realidad, esto fue provocado por uno de nuestros clientes en un sistema de archivos OCFS2 muy fragmentado. Para solucionar el problema, aseg\u00farese de que la transacci\u00f3n siempre tenga suficientes cr\u00e9ditos para una inserci\u00f3n de extensi\u00f3n antes de cada llamada de ocfs2_mark_extent_writing(). Heming Zhao dijo: ------ P\u00c1NICO: \\\"P\u00e1nico del kernel - no se sincroniza: OCFS2: (dispositivo dm-1): p\u00e1nico forzado despu\u00e9s del error\\\" PID: xxx TAREA: xxxx CPU: 5 COMANDO: \\\"SubmitThread-CA\\\" # 0 machine_kexec en ffffffff8c069932 #1 __crash_kexec en ffffffff8c1338fa #2 p\u00e1nico en ffffffff8c1d69b9 #3 ocfs2_handle_error en ffffffffc0c86c0c [ocfs2] #4 __ocfs2_abort en ffffffffc0c88387 #5 ocfs2_journal_dirty en ffffffffc0c51e98 [ocfs2] #6 ocfs2_split_extent en ffffffffc0c27ea3 [ocfs2] #7 ocfs2_change_extent_flag en ffffffffc0c28053 [ocfs2] #8 ocfs2_mark_extent_writing en ffffffffc0c28347 [ocfs2] #9 ocfs2_dio_end_io_write en ffffffffc0c2bef9 [ocfs2] #10 ocfs2_dio_end_io en ffffffffc0c2c0f5 [ocfs2] #11 completo en ffffffff8c2b9fa7 #12 do_blockdev_direct_IO en ffffffff8c2bc09f #13 ocfs2_direct_IO en ffffffffc0c2b653 [ocfs2] #14 generic_file_direct_write en ffffffff8c1dcf14 #15 __generic_file_write_iter en ffffffff8c1dd07b #16 ocfs2_file_write_iter en ffffffffc0c49f1f [ocfs2] #17 aio_write en ffffffff8c2cc72e #18 kmem_cache_alloc en ffffffff8c248dde #19 _enviar en ffffffff8c2ccada #20 do_syscall_64 en ffffffff8c004984 #21 Entry_SYSCALL_64_after_hwframe en ffffffff8c8000ba\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"4.6\",\"matchCriteriaId\":\"BB258587-714D-4846-9C1F-798BB73BF43E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.7\",\"versionEndExcluding\":\"5.10.221\",\"matchCriteriaId\":\"E3CE7A55-F62F-405A-AED4-E9E38AE2F163\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.162\",\"matchCriteriaId\":\"10A39ACC-3005-40E8-875C-98A372D1FFD5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.97\",\"matchCriteriaId\":\"748B6C4B-1F61-47F9-96CC-8899B8412D84\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.37\",\"matchCriteriaId\":\"D72E033B-5323-4C4D-8818-36E1EBC3535F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.9.8\",\"matchCriteriaId\":\"E95105F2-32E3-4C5F-9D18-7AEFD0E6275C\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/320273b5649bbcee87f9e65343077189699d2a7a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/331d1079d58206ff7dc5518185f800b412f89bc6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9ea2d1c6789722d58ec191f14f9a02518d55b6b4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a68b896aa56e435506453ec8835bc991ec3ae687\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/be346c1a6eeb49d8fda827d2a9522124c2f72f36\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c05ffb693bfb42a48ef3ee88a55b57392984e111\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/320273b5649bbcee87f9e65343077189699d2a7a\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/331d1079d58206ff7dc5518185f800b412f89bc6\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9ea2d1c6789722d58ec191f14f9a02518d55b6b4\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a68b896aa56e435506453ec8835bc991ec3ae687\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/be346c1a6eeb49d8fda827d2a9522124c2f72f36\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c05ffb693bfb42a48ef3ee88a55b57392984e111\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/a68b896aa56e435506453ec8835bc991ec3ae687\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/320273b5649bbcee87f9e65343077189699d2a7a\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/9ea2d1c6789722d58ec191f14f9a02518d55b6b4\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/c05ffb693bfb42a48ef3ee88a55b57392984e111\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/331d1079d58206ff7dc5518185f800b412f89bc6\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/be346c1a6eeb49d8fda827d2a9522124c2f72f36\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T04:54:32.199Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-42077\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T16:19:23.681677Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:19.832Z\"}}], \"cna\": {\"title\": \"ocfs2: fix DIO failure due to insufficient transaction credits\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"c15471f79506\", \"lessThan\": \"a68b896aa56e\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"c15471f79506\", \"lessThan\": \"320273b5649b\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"c15471f79506\", \"lessThan\": \"9ea2d1c67897\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"c15471f79506\", \"lessThan\": \"c05ffb693bfb\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"c15471f79506\", \"lessThan\": \"331d1079d582\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"c15471f79506\", \"lessThan\": \"be346c1a6eeb\", \"versionType\": \"git\"}], \"programFiles\": [\"fs/ocfs2/aops.c\", \"fs/ocfs2/journal.c\", \"fs/ocfs2/journal.h\", \"fs/ocfs2/ocfs2_trace.h\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.6\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"4.6\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.10.221\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.162\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.97\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.37\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9.8\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.9.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"fs/ocfs2/aops.c\", \"fs/ocfs2/journal.c\", \"fs/ocfs2/journal.h\", \"fs/ocfs2/ocfs2_trace.h\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/a68b896aa56e435506453ec8835bc991ec3ae687\"}, {\"url\": \"https://git.kernel.org/stable/c/320273b5649bbcee87f9e65343077189699d2a7a\"}, {\"url\": \"https://git.kernel.org/stable/c/9ea2d1c6789722d58ec191f14f9a02518d55b6b4\"}, {\"url\": \"https://git.kernel.org/stable/c/c05ffb693bfb42a48ef3ee88a55b57392984e111\"}, {\"url\": \"https://git.kernel.org/stable/c/331d1079d58206ff7dc5518185f800b412f89bc6\"}, {\"url\": \"https://git.kernel.org/stable/c/be346c1a6eeb49d8fda827d2a9522124c2f72f36\"}], \"x_generator\": {\"engine\": \"bippy-9e1c9544281a\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nocfs2: fix DIO failure due to insufficient transaction credits\\n\\nThe code in ocfs2_dio_end_io_write() estimates number of necessary\\ntransaction credits using ocfs2_calc_extend_credits().  This however does\\nnot take into account that the IO could be arbitrarily large and can\\ncontain arbitrary number of extents.\\n\\nExtent tree manipulations do often extend the current transaction but not\\nin all of the cases.  For example if we have only single block extents in\\nthe tree, ocfs2_mark_extent_written() will end up calling\\nocfs2_replace_extent_rec() all the time and we will never extend the\\ncurrent transaction and eventually exhaust all the transaction credits if\\nthe IO contains many single block extents.  Once that happens a\\nWARN_ON(jbd2_handle_buffer_credits(handle) \u003c= 0) is triggered in\\njbd2_journal_dirty_metadata() and subsequently OCFS2 aborts in response to\\nthis error.  This was actually triggered by one of our customers on a\\nheavily fragmented OCFS2 filesystem.\\n\\nTo fix the issue make sure the transaction always has enough credits for\\none extent insert before each call of ocfs2_mark_extent_written().\\n\\nHeming Zhao said:\\n\\n------\\nPANIC: \\\"Kernel panic - not syncing: OCFS2: (device dm-1): panic forced after error\\\"\\n\\nPID: xxx  TASK: xxxx  CPU: 5  COMMAND: \\\"SubmitThread-CA\\\"\\n  #0 machine_kexec at ffffffff8c069932\\n  #1 __crash_kexec at ffffffff8c1338fa\\n  #2 panic at ffffffff8c1d69b9\\n  #3 ocfs2_handle_error at ffffffffc0c86c0c [ocfs2]\\n  #4 __ocfs2_abort at ffffffffc0c88387 [ocfs2]\\n  #5 ocfs2_journal_dirty at ffffffffc0c51e98 [ocfs2]\\n  #6 ocfs2_split_extent at ffffffffc0c27ea3 [ocfs2]\\n  #7 ocfs2_change_extent_flag at ffffffffc0c28053 [ocfs2]\\n  #8 ocfs2_mark_extent_written at ffffffffc0c28347 [ocfs2]\\n  #9 ocfs2_dio_end_io_write at ffffffffc0c2bef9 [ocfs2]\\n#10 ocfs2_dio_end_io at ffffffffc0c2c0f5 [ocfs2]\\n#11 dio_complete at ffffffff8c2b9fa7\\n#12 do_blockdev_direct_IO at ffffffff8c2bc09f\\n#13 ocfs2_direct_IO at ffffffffc0c2b653 [ocfs2]\\n#14 generic_file_direct_write at ffffffff8c1dcf14\\n#15 __generic_file_write_iter at ffffffff8c1dd07b\\n#16 ocfs2_file_write_iter at ffffffffc0c49f1f [ocfs2]\\n#17 aio_write at ffffffff8c2cc72e\\n#18 kmem_cache_alloc at ffffffff8c248dde\\n#19 do_io_submit at ffffffff8c2ccada\\n#20 do_syscall_64 at ffffffff8c004984\\n#21 entry_SYSCALL_64_after_hwframe at ffffffff8c8000ba\"}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2024-11-05T09:36:57.431Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-42077\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-11-05T09:36:57.431Z\", \"dateReserved\": \"2024-07-29T15:50:41.169Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-07-29T15:52:39.661Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.