In the Linux kernel, the following vulnerability has been resolved: dm array: fix releasing a faulty array block twice in dm_array_cursor_end When dm_bm_read_lock() fails due to locking or checksum errors, it releases the faulty block implicitly while leaving an invalid output pointer behind. The caller of dm_bm_read_lock() should not operate on this invalid dm_block pointer, or it will lead to undefined result. For example, the dm_array_cursor incorrectly caches the invalid pointer on reading a faulty array block, causing a double release in dm_array_cursor_end(), then hitting the BUG_ON in dm-bufio cache_put(). Reproduce steps: 1. initialize a cache device dmsetup create cmeta --table "0 8192 linear /dev/sdc 0" dmsetup create cdata --table "0 65536 linear /dev/sdc 8192" dmsetup create corig --table "0 524288 linear /dev/sdc $262144" dd if=/dev/zero of=/dev/mapper/cmeta bs=4k count=1 dmsetup create cache --table "0 524288 cache /dev/mapper/cmeta \ /dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 writethrough smq 0" 2. wipe the second array block offline dmsteup remove cache cmeta cdata corig mapping_root=$(dd if=/dev/sdc bs=1c count=8 skip=192 \ 2>/dev/null | hexdump -e '1/8 "%u\n"') ablock=$(dd if=/dev/sdc bs=1c count=8 skip=$((4096*mapping_root+2056)) \ 2>/dev/null | hexdump -e '1/8 "%u\n"') dd if=/dev/zero of=/dev/sdc bs=4k count=1 seek=$ablock 3. try reopen the cache device dmsetup create cmeta --table "0 8192 linear /dev/sdc 0" dmsetup create cdata --table "0 65536 linear /dev/sdc 8192" dmsetup create corig --table "0 524288 linear /dev/sdc $262144" dmsetup create cache --table "0 524288 cache /dev/mapper/cmeta \ /dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 writethrough smq 0" Kernel logs: (snip) device-mapper: array: array_block_check failed: blocknr 0 != wanted 10 device-mapper: block manager: array validator check failed for block 10 device-mapper: array: get_ablock failed device-mapper: cache metadata: dm_array_cursor_next for mapping failed ------------[ cut here ]------------ kernel BUG at drivers/md/dm-bufio.c:638! Fix by setting the cached block pointer to NULL on errors. In addition to the reproducer described above, this fix can be verified using the "array_cursor/damaged" test in dm-unit: dm-unit run /pdata/array_cursor/damaged --kernel-dir <KERNEL_DIR>
En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: dm array: se corrige la liberación de un bloque de matriz defectuoso dos veces en dm_array_cursor_end Cuando dm_bm_read_lock() falla debido a errores de bloqueo o suma de comprobación, libera el bloque defectuoso implícitamente mientras deja atrás un puntero de salida no válido. El llamador de dm_bm_read_lock() no debe operar en este puntero dm_block no válido, o conducirá a un resultado indefinido. Por ejemplo, dm_array_cursor almacena en caché incorrectamente el puntero no válido al leer un bloque de matriz defectuoso, lo que causa una doble liberación en dm_array_cursor_end(), y luego alcanza el BUG_ON en dm-bufio cache_put(). Reproducir los pasos: 1. inicializar un dispositivo de caché dmsetup create cmeta --table "0 8192 linear /dev/sdc 0" dmsetup create cdata --table "0 65536 linear /dev/sdc 8192" dmsetup create corig --table "0 524288 linear /dev/sdc $262144" dd if=/dev/zero of=/dev/mapper/cmeta bs=4k count=1 dmsetup create cache --table "0 524288 cache /dev/mapper/cmeta \ /dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 writethrough smq 0" 2. borrar el segundo bloque de matriz sin conexión dmsteup remove cache cmeta cdata corig mapping_root=$(dd if=/dev/sdc bs=1c count=8 skip=192 \ 2>/dev/null | hexdump -e '1/8 "%u\n"') ablock=$(dd if=/dev/sdc bs=1c count=8 skip=$((4096*mapping_root+2056)) \ 2>/dev/null | hexdump -e '1/8 "%u\n"') dd if=/dev/zero of=/dev/sdc bs=4k count=1 seek=$ablock 3. Intente volver a abrir el dispositivo de caché dmsetup create cmeta --table "0 8192 lineal /dev/sdc 0" dmsetup create cdata --table "0 65536 lineal /dev/sdc 8192" dmsetup create corig --table "0 524288 lineal /dev/sdc $262144" dmsetup create cache --table "0 524288 caché /dev/mapper/cmeta \ /dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 writethrough smq 0" Registros del kernel: (snip) device-mapper: array: array_block_check failed: blocknr 0 != wanted 10 device-mapper: block manager: array validator check failed for block 10 device-mapper: array: get_ablock failed device-mapper: cache metadata: dm_array_cursor_next for mapping failed ------------[ corte aquí ]------------ ¡ERROR del kernel en drivers/md/dm-bufio.c:638! Se corrige configurando el puntero de bloque en caché en NULL en caso de errores. Además del reproductor descrito anteriormente, esta corrección se puede verificar utilizando la prueba "array_cursor/damaged" en dm-unit: dm-unit run /pdata/array_cursor/damaged --kernel-dir
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
| Attack Vector | LOCAL |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | LOW |
| User Interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality Impact | HIGH |
| Integrity Impact | NONE |
| Availability Impact | HIGH |
| Source | Type | Description |
|---|---|---|
| [email protected] | Primary |
en
CWE-672
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd36ad58a00> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd2d83cc280> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd36a71b6c0> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd3606e3380> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd369486e40> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd5116cc9c0> | Operating System |
| linux | linux_kernel | 6.13 | <built-in method update of dict object at 0x7fd3686c8e40> | Operating System |
| linux | linux_kernel | 6.13 | <built-in method update of dict object at 0x7fd3412f4140> | Operating System |
| linux | linux_kernel | 6.13 | <built-in method update of dict object at 0x7fd36b806bc0> | Operating System |
| linux | linux_kernel | 6.13 | <built-in method update of dict object at 0x7fd3854f4ec0> | Operating System |
| linux | linux_kernel | 6.13 | <built-in method update of dict object at 0x7fd3408fd480> | Operating System |
| linux | linux_kernel | 6.13 | <built-in method update of dict object at 0x7fd36ad5a780> | Operating System |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:6.13:rc2:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:6.13:rc3:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:6.13:rc4:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:6.13:rc5:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:6.13:rc6:*:*:*:*:*:* |