cve-2024-47680
Vulnerability from cvelistv5
Published
2024-10-21 11:53
Modified
2024-12-19 09:25
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: f2fs: check discard support for conventional zones As the helper function f2fs_bdev_support_discard() shows, f2fs checks if the target block devices support discard by calling bdev_max_discard_sectors() and bdev_is_zoned(). This check works well for most cases, but it does not work for conventional zones on zoned block devices. F2fs assumes that zoned block devices support discard, and calls __submit_discard_cmd(). When __submit_discard_cmd() is called for sequential write required zones, it works fine since __submit_discard_cmd() issues zone reset commands instead of discard commands. However, when __submit_discard_cmd() is called for conventional zones, __blkdev_issue_discard() is called even when the devices do not support discard. The inappropriate __blkdev_issue_discard() call was not a problem before the commit 30f1e7241422 ("block: move discard checks into the ioctl handler") because __blkdev_issue_discard() checked if the target devices support discard or not. If not, it returned EOPNOTSUPP. After the commit, __blkdev_issue_discard() no longer checks it. It always returns zero and sets NULL to the given bio pointer. This NULL pointer triggers f2fs_bug_on() in __submit_discard_cmd(). The BUG is recreated with the commands below at the umount step, where /dev/nullb0 is a zoned null_blk with 5GB total size, 128MB zone size and 10 conventional zones. $ mkfs.f2fs -f -m /dev/nullb0 $ mount /dev/nullb0 /mnt $ for ((i=0;i<5;i++)); do dd if=/dev/zero of=/mnt/test bs=65536 count=1600 conv=fsync; done $ umount /mnt To fix the BUG, avoid the inappropriate __blkdev_issue_discard() call. When discard is requested for conventional zones, check if the device supports discard or not. If not, return EOPNOTSUPP.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/43aec4d01bd2ce961817a777b3846f8318f398e4Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/7bd7ce68ddad5a28565e42ef21cacaff113773a9Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/d2352b57897f6a3349666fc318dcbec99092c6a5Patch
Impacted products
Vendor Product Version
Linux Linux Version: 30f1e724142242a453f92d90b33e030014900bf0
Version: 30f1e724142242a453f92d90b33e030014900bf0
Version: 30f1e724142242a453f92d90b33e030014900bf0
 Create a notification for this product.
   Linux Linux Version: 6.10
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-47680",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-21T13:07:25.799925Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-21T13:14:16.790Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/f2fs/segment.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7bd7ce68ddad5a28565e42ef21cacaff113773a9",
              "status": "affected",
              "version": "30f1e724142242a453f92d90b33e030014900bf0",
              "versionType": "git"
            },
            {
              "lessThan": "d2352b57897f6a3349666fc318dcbec99092c6a5",
              "status": "affected",
              "version": "30f1e724142242a453f92d90b33e030014900bf0",
              "versionType": "git"
            },
            {
              "lessThan": "43aec4d01bd2ce961817a777b3846f8318f398e4",
              "status": "affected",
              "version": "30f1e724142242a453f92d90b33e030014900bf0",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/f2fs/segment.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.10"
            },
            {
              "lessThan": "6.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: check discard support for conventional zones\n\nAs the helper function f2fs_bdev_support_discard() shows, f2fs checks if\nthe target block devices support discard by calling\nbdev_max_discard_sectors() and bdev_is_zoned(). This check works well\nfor most cases, but it does not work for conventional zones on zoned\nblock devices. F2fs assumes that zoned block devices support discard,\nand calls __submit_discard_cmd(). When __submit_discard_cmd() is called\nfor sequential write required zones, it works fine since\n__submit_discard_cmd() issues zone reset commands instead of discard\ncommands. However, when __submit_discard_cmd() is called for\nconventional zones, __blkdev_issue_discard() is called even when the\ndevices do not support discard.\n\nThe inappropriate __blkdev_issue_discard() call was not a problem before\nthe commit 30f1e7241422 (\"block: move discard checks into the ioctl\nhandler\") because __blkdev_issue_discard() checked if the target devices\nsupport discard or not. If not, it returned EOPNOTSUPP. After the\ncommit, __blkdev_issue_discard() no longer checks it. It always returns\nzero and sets NULL to the given bio pointer. This NULL pointer triggers\nf2fs_bug_on() in __submit_discard_cmd(). The BUG is recreated with the\ncommands below at the umount step, where /dev/nullb0 is a zoned null_blk\nwith 5GB total size, 128MB zone size and 10 conventional zones.\n\n$ mkfs.f2fs -f -m /dev/nullb0\n$ mount /dev/nullb0 /mnt\n$ for ((i=0;i\u003c5;i++)); do dd if=/dev/zero of=/mnt/test bs=65536 count=1600 conv=fsync; done\n$ umount /mnt\n\nTo fix the BUG, avoid the inappropriate __blkdev_issue_discard() call.\nWhen discard is requested for conventional zones, check if the device\nsupports discard or not. If not, return EOPNOTSUPP."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-19T09:25:46.750Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7bd7ce68ddad5a28565e42ef21cacaff113773a9"
        },
        {
          "url": "https://git.kernel.org/stable/c/d2352b57897f6a3349666fc318dcbec99092c6a5"
        },
        {
          "url": "https://git.kernel.org/stable/c/43aec4d01bd2ce961817a777b3846f8318f398e4"
        }
      ],
      "title": "f2fs: check discard support for conventional zones",
      "x_generator": {
        "engine": "bippy-5f407fcff5a0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-47680",
    "datePublished": "2024-10-21T11:53:23.128Z",
    "dateReserved": "2024-09-30T16:00:12.940Z",
    "dateUpdated": "2024-12-19T09:25:46.750Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-47680\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-10-21T12:15:05.003\",\"lastModified\":\"2024-10-24T13:28:28.393\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nf2fs: check discard support for conventional zones\\n\\nAs the helper function f2fs_bdev_support_discard() shows, f2fs checks if\\nthe target block devices support discard by calling\\nbdev_max_discard_sectors() and bdev_is_zoned(). This check works well\\nfor most cases, but it does not work for conventional zones on zoned\\nblock devices. F2fs assumes that zoned block devices support discard,\\nand calls __submit_discard_cmd(). When __submit_discard_cmd() is called\\nfor sequential write required zones, it works fine since\\n__submit_discard_cmd() issues zone reset commands instead of discard\\ncommands. However, when __submit_discard_cmd() is called for\\nconventional zones, __blkdev_issue_discard() is called even when the\\ndevices do not support discard.\\n\\nThe inappropriate __blkdev_issue_discard() call was not a problem before\\nthe commit 30f1e7241422 (\\\"block: move discard checks into the ioctl\\nhandler\\\") because __blkdev_issue_discard() checked if the target devices\\nsupport discard or not. If not, it returned EOPNOTSUPP. After the\\ncommit, __blkdev_issue_discard() no longer checks it. It always returns\\nzero and sets NULL to the given bio pointer. This NULL pointer triggers\\nf2fs_bug_on() in __submit_discard_cmd(). The BUG is recreated with the\\ncommands below at the umount step, where /dev/nullb0 is a zoned null_blk\\nwith 5GB total size, 128MB zone size and 10 conventional zones.\\n\\n$ mkfs.f2fs -f -m /dev/nullb0\\n$ mount /dev/nullb0 /mnt\\n$ for ((i=0;i\u003c5;i++)); do dd if=/dev/zero of=/mnt/test bs=65536 count=1600 conv=fsync; done\\n$ umount /mnt\\n\\nTo fix the BUG, avoid the inappropriate __blkdev_issue_discard() call.\\nWhen discard is requested for conventional zones, check if the device\\nsupports discard or not. If not, return EOPNOTSUPP.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: f2fs: comprobar la compatibilidad con el descarte para zonas convencionales Como muestra la funci\u00f3n auxiliar f2fs_bdev_support_discard(), f2fs comprueba si los dispositivos de bloque de destino admiten el descarte llamando a bdev_max_discard_sectors() y bdev_is_zoned(). Esta comprobaci\u00f3n funciona bien en la mayor\u00eda de los casos, pero no funciona para zonas convencionales en dispositivos de bloque con zonas. F2fs supone que los dispositivos de bloque con zonas admiten el descarte y llama a __submit_discard_cmd(). Cuando se llama a __submit_discard_cmd() para zonas que requieren escritura secuencial, funciona bien ya que __submit_discard_cmd() emite comandos de restablecimiento de zona en lugar de comandos de descarte. Sin embargo, cuando se llama a __submit_discard_cmd() para zonas convencionales, se llama a __blkdev_issue_discard() incluso cuando los dispositivos no admiten el descarte. La llamada inapropiada a __blkdev_issue_discard() no era un problema antes de el commit 30f1e7241422 (\\\"bloqueo: mover las comprobaciones de descarte al controlador ioctl\\\") porque __blkdev_issue_discard() comprobaba si los dispositivos de destino admit\u00edan o no el descarte. Si no, devolv\u00eda EOPNOTSUPP. Despu\u00e9s de el commit, __blkdev_issue_discard() ya no lo comprueba. Siempre devuelve cero y establece NULL en el puntero bio indicado. Este puntero NULL activa f2fs_bug_on() en __submit_discard_cmd(). El ERROR se vuelve a crear con los comandos siguientes en el paso de desmontaje, donde /dev/nullb0 es un null_blk zonificado con un tama\u00f1o total de 5 GB, un tama\u00f1o de zona de 128 MB y 10 zonas convencionales. $ mkfs.f2fs -f -m /dev/nullb0 $ mount /dev/nullb0 /mnt $ for ((i=0;i\u0026lt;5;i++)); do dd if=/dev/zero of=/mnt/test bs=65536 count=1600 conv=fsync; done $ umount /mnt Para corregir el ERROR, evite la llamada __blkdev_issue_discard() inapropiada. Cuando se solicita el descarte para zonas convencionales, verifique si el dispositivo admite el descarte o no. Si no es as\u00ed, devuelva EOPNOTSUPP.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.10\",\"versionEndExcluding\":\"6.10.13\",\"matchCriteriaId\":\"767D4D2D-C6E7-4B7D-9446-CFC8F8FF2FBB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.11\",\"versionEndExcluding\":\"6.11.2\",\"matchCriteriaId\":\"AB755D26-97F4-43B6-8604-CD076811E181\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/43aec4d01bd2ce961817a777b3846f8318f398e4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7bd7ce68ddad5a28565e42ef21cacaff113773a9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d2352b57897f6a3349666fc318dcbec99092c6a5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-47680\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-10-21T13:07:25.799925Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-10-21T13:07:29.437Z\"}}], \"cna\": {\"title\": \"f2fs: check discard support for conventional zones\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"30f1e724142242a453f92d90b33e030014900bf0\", \"lessThan\": \"7bd7ce68ddad5a28565e42ef21cacaff113773a9\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"30f1e724142242a453f92d90b33e030014900bf0\", \"lessThan\": \"d2352b57897f6a3349666fc318dcbec99092c6a5\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"30f1e724142242a453f92d90b33e030014900bf0\", \"lessThan\": \"43aec4d01bd2ce961817a777b3846f8318f398e4\", \"versionType\": \"git\"}], \"programFiles\": [\"fs/f2fs/segment.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.10\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.10\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.10.13\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.10.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11.2\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.11.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"fs/f2fs/segment.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/7bd7ce68ddad5a28565e42ef21cacaff113773a9\"}, {\"url\": \"https://git.kernel.org/stable/c/d2352b57897f6a3349666fc318dcbec99092c6a5\"}, {\"url\": \"https://git.kernel.org/stable/c/43aec4d01bd2ce961817a777b3846f8318f398e4\"}], \"x_generator\": {\"engine\": \"bippy-5f407fcff5a0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nf2fs: check discard support for conventional zones\\n\\nAs the helper function f2fs_bdev_support_discard() shows, f2fs checks if\\nthe target block devices support discard by calling\\nbdev_max_discard_sectors() and bdev_is_zoned(). This check works well\\nfor most cases, but it does not work for conventional zones on zoned\\nblock devices. F2fs assumes that zoned block devices support discard,\\nand calls __submit_discard_cmd(). When __submit_discard_cmd() is called\\nfor sequential write required zones, it works fine since\\n__submit_discard_cmd() issues zone reset commands instead of discard\\ncommands. However, when __submit_discard_cmd() is called for\\nconventional zones, __blkdev_issue_discard() is called even when the\\ndevices do not support discard.\\n\\nThe inappropriate __blkdev_issue_discard() call was not a problem before\\nthe commit 30f1e7241422 (\\\"block: move discard checks into the ioctl\\nhandler\\\") because __blkdev_issue_discard() checked if the target devices\\nsupport discard or not. If not, it returned EOPNOTSUPP. After the\\ncommit, __blkdev_issue_discard() no longer checks it. It always returns\\nzero and sets NULL to the given bio pointer. This NULL pointer triggers\\nf2fs_bug_on() in __submit_discard_cmd(). The BUG is recreated with the\\ncommands below at the umount step, where /dev/nullb0 is a zoned null_blk\\nwith 5GB total size, 128MB zone size and 10 conventional zones.\\n\\n$ mkfs.f2fs -f -m /dev/nullb0\\n$ mount /dev/nullb0 /mnt\\n$ for ((i=0;i\u003c5;i++)); do dd if=/dev/zero of=/mnt/test bs=65536 count=1600 conv=fsync; done\\n$ umount /mnt\\n\\nTo fix the BUG, avoid the inappropriate __blkdev_issue_discard() call.\\nWhen discard is requested for conventional zones, check if the device\\nsupports discard or not. If not, return EOPNOTSUPP.\"}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2024-12-19T09:25:46.750Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-47680\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-12-19T09:25:46.750Z\", \"dateReserved\": \"2024-09-30T16:00:12.940Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-10-21T11:53:23.128Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.