cve-2024-50229
Vulnerability from cvelistv5
Published
2024-11-09 10:14
Modified
2024-12-19 09:35
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix potential deadlock with newly created symlinks Syzbot reported that page_symlink(), called by nilfs_symlink(), triggers memory reclamation involving the filesystem layer, which can result in circular lock dependencies among the reader/writer semaphore nilfs->ns_segctor_sem, s_writers percpu_rwsem (intwrite) and the fs_reclaim pseudo lock. This is because after commit 21fc61c73c39 ("don't put symlink bodies in pagecache into highmem"), the gfp flags of the page cache for symbolic links are overwritten to GFP_KERNEL via inode_nohighmem(). This is not a problem for symlinks read from the backing device, because the __GFP_FS flag is dropped after inode_nohighmem() is called. However, when a new symlink is created with nilfs_symlink(), the gfp flags remain overwritten to GFP_KERNEL. Then, memory allocation called from page_symlink() etc. triggers memory reclamation including the FS layer, which may call nilfs_evict_inode() or nilfs_dirty_inode(). And these can cause a deadlock if they are called while nilfs->ns_segctor_sem is held: Fix this issue by dropping the __GFP_FS flag from the page cache GFP flags of newly created symlinks in the same way that nilfs_new_inode() and __nilfs_read_inode() do, as a workaround until we adopt nofs allocation scope consistently or improve the locking constraints.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/1246d86e7bbde265761932c6e2dce28c69cdcb91Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/58c7f44c7b9e5ac7e3b1e5da2572ed7767a12f38Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/69548bb663fcb63f9ee0301be808a36b9d78dac3Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/9aa5d43ac4cace8fb9bd964ff6c23f599dc3cd24Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/a1686db1e59f8fc016c4c9361e2119dd206f479aPatch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/b3a033e3ecd3471248d474ef263aadc0059e516aPatch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/c72e0df0b56c1166736dc8eb62070ebb12591447Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/cc38c596e648575ce58bfc31623a6506eda4b94aPatch
Impacted products
Vendor Product Version
Linux Linux Version: 21fc61c73c3903c4c312d0802da01ec2b323d174
Version: 21fc61c73c3903c4c312d0802da01ec2b323d174
Version: 21fc61c73c3903c4c312d0802da01ec2b323d174
Version: 21fc61c73c3903c4c312d0802da01ec2b323d174
Version: 21fc61c73c3903c4c312d0802da01ec2b323d174
Version: 21fc61c73c3903c4c312d0802da01ec2b323d174
Version: 21fc61c73c3903c4c312d0802da01ec2b323d174
Version: 21fc61c73c3903c4c312d0802da01ec2b323d174
 Create a notification for this product.
   Linux Linux Version: 4.5
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/nilfs2/namei.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "cc38c596e648575ce58bfc31623a6506eda4b94a",
              "status": "affected",
              "version": "21fc61c73c3903c4c312d0802da01ec2b323d174",
              "versionType": "git"
            },
            {
              "lessThan": "a1686db1e59f8fc016c4c9361e2119dd206f479a",
              "status": "affected",
              "version": "21fc61c73c3903c4c312d0802da01ec2b323d174",
              "versionType": "git"
            },
            {
              "lessThan": "c72e0df0b56c1166736dc8eb62070ebb12591447",
              "status": "affected",
              "version": "21fc61c73c3903c4c312d0802da01ec2b323d174",
              "versionType": "git"
            },
            {
              "lessThan": "69548bb663fcb63f9ee0301be808a36b9d78dac3",
              "status": "affected",
              "version": "21fc61c73c3903c4c312d0802da01ec2b323d174",
              "versionType": "git"
            },
            {
              "lessThan": "58c7f44c7b9e5ac7e3b1e5da2572ed7767a12f38",
              "status": "affected",
              "version": "21fc61c73c3903c4c312d0802da01ec2b323d174",
              "versionType": "git"
            },
            {
              "lessThan": "1246d86e7bbde265761932c6e2dce28c69cdcb91",
              "status": "affected",
              "version": "21fc61c73c3903c4c312d0802da01ec2b323d174",
              "versionType": "git"
            },
            {
              "lessThan": "9aa5d43ac4cace8fb9bd964ff6c23f599dc3cd24",
              "status": "affected",
              "version": "21fc61c73c3903c4c312d0802da01ec2b323d174",
              "versionType": "git"
            },
            {
              "lessThan": "b3a033e3ecd3471248d474ef263aadc0059e516a",
              "status": "affected",
              "version": "21fc61c73c3903c4c312d0802da01ec2b323d174",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/nilfs2/namei.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.5"
            },
            {
              "lessThan": "4.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.323",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.285",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.229",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.171",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.116",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.60",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: fix potential deadlock with newly created symlinks\n\nSyzbot reported that page_symlink(), called by nilfs_symlink(), triggers\nmemory reclamation involving the filesystem layer, which can result in\ncircular lock dependencies among the reader/writer semaphore\nnilfs-\u003ens_segctor_sem, s_writers percpu_rwsem (intwrite) and the\nfs_reclaim pseudo lock.\n\nThis is because after commit 21fc61c73c39 (\"don\u0027t put symlink bodies in\npagecache into highmem\"), the gfp flags of the page cache for symbolic\nlinks are overwritten to GFP_KERNEL via inode_nohighmem().\n\nThis is not a problem for symlinks read from the backing device, because\nthe __GFP_FS flag is dropped after inode_nohighmem() is called.  However,\nwhen a new symlink is created with nilfs_symlink(), the gfp flags remain\noverwritten to GFP_KERNEL.  Then, memory allocation called from\npage_symlink() etc.  triggers memory reclamation including the FS layer,\nwhich may call nilfs_evict_inode() or nilfs_dirty_inode().  And these can\ncause a deadlock if they are called while nilfs-\u003ens_segctor_sem is held:\n\nFix this issue by dropping the __GFP_FS flag from the page cache GFP flags\nof newly created symlinks in the same way that nilfs_new_inode() and\n__nilfs_read_inode() do, as a workaround until we adopt nofs allocation\nscope consistently or improve the locking constraints."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-19T09:35:56.724Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/cc38c596e648575ce58bfc31623a6506eda4b94a"
        },
        {
          "url": "https://git.kernel.org/stable/c/a1686db1e59f8fc016c4c9361e2119dd206f479a"
        },
        {
          "url": "https://git.kernel.org/stable/c/c72e0df0b56c1166736dc8eb62070ebb12591447"
        },
        {
          "url": "https://git.kernel.org/stable/c/69548bb663fcb63f9ee0301be808a36b9d78dac3"
        },
        {
          "url": "https://git.kernel.org/stable/c/58c7f44c7b9e5ac7e3b1e5da2572ed7767a12f38"
        },
        {
          "url": "https://git.kernel.org/stable/c/1246d86e7bbde265761932c6e2dce28c69cdcb91"
        },
        {
          "url": "https://git.kernel.org/stable/c/9aa5d43ac4cace8fb9bd964ff6c23f599dc3cd24"
        },
        {
          "url": "https://git.kernel.org/stable/c/b3a033e3ecd3471248d474ef263aadc0059e516a"
        }
      ],
      "title": "nilfs2: fix potential deadlock with newly created symlinks",
      "x_generator": {
        "engine": "bippy-5f407fcff5a0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-50229",
    "datePublished": "2024-11-09T10:14:39.756Z",
    "dateReserved": "2024-10-21T19:36:19.973Z",
    "dateUpdated": "2024-12-19T09:35:56.724Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-50229\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-11-09T11:15:08.890\",\"lastModified\":\"2024-11-13T18:35:06.723\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnilfs2: fix potential deadlock with newly created symlinks\\n\\nSyzbot reported that page_symlink(), called by nilfs_symlink(), triggers\\nmemory reclamation involving the filesystem layer, which can result in\\ncircular lock dependencies among the reader/writer semaphore\\nnilfs-\u003ens_segctor_sem, s_writers percpu_rwsem (intwrite) and the\\nfs_reclaim pseudo lock.\\n\\nThis is because after commit 21fc61c73c39 (\\\"don\u0027t put symlink bodies in\\npagecache into highmem\\\"), the gfp flags of the page cache for symbolic\\nlinks are overwritten to GFP_KERNEL via inode_nohighmem().\\n\\nThis is not a problem for symlinks read from the backing device, because\\nthe __GFP_FS flag is dropped after inode_nohighmem() is called.  However,\\nwhen a new symlink is created with nilfs_symlink(), the gfp flags remain\\noverwritten to GFP_KERNEL.  Then, memory allocation called from\\npage_symlink() etc.  triggers memory reclamation including the FS layer,\\nwhich may call nilfs_evict_inode() or nilfs_dirty_inode().  And these can\\ncause a deadlock if they are called while nilfs-\u003ens_segctor_sem is held:\\n\\nFix this issue by dropping the __GFP_FS flag from the page cache GFP flags\\nof newly created symlinks in the same way that nilfs_new_inode() and\\n__nilfs_read_inode() do, as a workaround until we adopt nofs allocation\\nscope consistently or improve the locking constraints.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: nilfs2: arregla un potencial bloqueo con enlaces simb\u00f3licos reci\u00e9n creados Syzbot inform\u00f3 que page_symlink(), llamado por nilfs_symlink(), activa la recuperaci\u00f3n de memoria que involucra la capa del sistema de archivos, lo que puede resultar en dependencias de bloqueo circular entre el sem\u00e1foro de lectura/escritura nilfs-\u0026gt;ns_segctor_sem, s_writers percpu_rwsem (intwrite) y el pseudobloqueo fs_reclaim. Esto se debe a que despu\u00e9s de el commit 21fc61c73c39 (\\\"no poner cuerpos de enlaces simb\u00f3licos en pagecache en highmem\\\"), las banderas gfp de la cach\u00e9 de p\u00e1ginas para enlaces simb\u00f3licos se sobrescriben a GFP_KERNEL a trav\u00e9s de inode_nohighmem(). Esto no es un problema para los enlaces simb\u00f3licos le\u00eddos desde el dispositivo de respaldo, porque la bandera __GFP_FS se descarta despu\u00e9s de que se llama a inode_nohighmem(). Sin embargo, cuando se crea un nuevo enlace simb\u00f3lico con nilfs_symlink(), los indicadores gfp permanecen sobrescritos en GFP_KERNEL. Luego, la asignaci\u00f3n de memoria llamada desde page_symlink(), etc., activa la recuperaci\u00f3n de memoria, incluida la capa FS, que puede llamar a nilfs_evict_inode() o nilfs_dirty_inode(). Y estos pueden causar un bloqueo si se los llama mientras se mantiene nilfs-\u0026gt;ns_segctor_sem: solucione este problema eliminando el indicador __GFP_FS de los indicadores GFP de la cach\u00e9 de p\u00e1ginas de los enlaces simb\u00f3licos reci\u00e9n creados de la misma manera que lo hacen nilfs_new_inode() y __nilfs_read_inode(), como workaround hasta que adoptemos el alcance de asignaci\u00f3n de nofs de manera consistente o mejoremos las restricciones de bloqueo.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-667\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.5\",\"versionEndExcluding\":\"4.19.323\",\"matchCriteriaId\":\"99F0DDA4-B17B-486B-8A02-6CBF8ECB814D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.20\",\"versionEndExcluding\":\"5.4.285\",\"matchCriteriaId\":\"B5A89369-320F-47FC-8695-56F61F87E4C0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.229\",\"matchCriteriaId\":\"1A03CABE-9B43-4E7F-951F-10DEEADAA426\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.171\",\"matchCriteriaId\":\"2BE18665-48ED-417A-90AA-41F3AC0B4E9A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.116\",\"matchCriteriaId\":\"43EFDC15-E4D4-4F1E-B70D-62F0854BFDF3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.60\",\"matchCriteriaId\":\"75088E5E-2400-4D20-915F-7A65C55D9CCD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.11.7\",\"matchCriteriaId\":\"E96F53A4-5E87-4A70-BD9A-BC327828D57F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:4.4.116:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DA23F59F-9D65-4747-B0B9-E859924DEA6D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"7F361E1D-580F-4A2D-A509-7615F73167A1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"925478D0-3E3D-4E6F-ACD5-09F28D5DF82C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"3C95E234-D335-4B6C-96BF-E2CEBD8654ED\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"E0F717D8-3014-4F84-8086-0124B2111379\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"24DBE6C7-2AAE-4818-AED2-E131F153D2FA\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1246d86e7bbde265761932c6e2dce28c69cdcb91\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/58c7f44c7b9e5ac7e3b1e5da2572ed7767a12f38\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/69548bb663fcb63f9ee0301be808a36b9d78dac3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9aa5d43ac4cace8fb9bd964ff6c23f599dc3cd24\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a1686db1e59f8fc016c4c9361e2119dd206f479a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b3a033e3ecd3471248d474ef263aadc0059e516a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c72e0df0b56c1166736dc8eb62070ebb12591447\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/cc38c596e648575ce58bfc31623a6506eda4b94a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.