CVE-2024-26958
Description
In the Linux kernel, the following vulnerability has been resolved: nfs: fix UAF in direct writes In production we have been hitting the following warning consistently ------------[ cut here ]------------ refcount_t: underflow; use-after-free. WARNING: CPU: 17 PID: 1800359 at lib/refcount.c:28 refcount_warn_saturate+0x9c/0xe0 Workqueue: nfsiod nfs_direct_write_schedule_work [nfs] RIP: 0010:refcount_warn_saturate+0x9c/0xe0 PKRU: 55555554 Call Trace: <TASK> ? __warn+0x9f/0x130 ? refcount_warn_saturate+0x9c/0xe0 ? report_bug+0xcc/0x150 ? handle_bug+0x3d/0x70 ? exc_invalid_op+0x16/0x40 ? asm_exc_invalid_op+0x16/0x20 ? refcount_warn_saturate+0x9c/0xe0 nfs_direct_write_schedule_work+0x237/0x250 [nfs] process_one_work+0x12f/0x4a0 worker_thread+0x14e/0x3b0 ? ZSTD_getCParams_internal+0x220/0x220 kthread+0xdc/0x120 ? __btf_name_valid+0xa0/0xa0 ret_from_fork+0x1f/0x30 This is because we're completing the nfs_direct_request twice in a row. The source of this is when we have our commit requests to submit, we process them and send them off, and then in the completion path for the commit requests we have if (nfs_commit_end(cinfo.mds)) nfs_direct_write_complete(dreq); However since we're submitting asynchronous requests we sometimes have one that completes before we submit the next one, so we end up calling complete on the nfs_direct_request twice. The only other place we use nfs_generic_commit_list() is in __nfs_commit_inode, which wraps this call in a nfs_commit_begin(); nfs_commit_end(); Which is a common pattern for this style of completion handling, one that is also repeated in the direct code with get_dreq()/put_dreq() calls around where we process events as well as in the completion paths. Fix this by using the same pattern for the commit requests. Before with my 200 node rocksdb stress running this warning would pop every 10ish minutes. With my patch the stress test has been running for several hours without popping.
Predictions
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Vendor advisory: alma — https://errata.almalinux.org/8/ALSA-2024-5102.html
Vendor advisory: alma — https://access.redhat.com/errata/RHSA-2024:5102
Vendor advisory: alma — https://errata.almalinux.org/8/ALSA-2024-5101.html
Vendor advisory: alma — https://bugzilla.redhat.com/2298108
Vendor advisory: alma — https://bugzilla.redhat.com/2297558
Vendor advisory: alma — https://bugzilla.redhat.com/2297511
Vendor advisory: alma — https://bugzilla.redhat.com/2297474
Vendor advisory: alma — https://bugzilla.redhat.com/2297056
Vendor advisory: alma — https://bugzilla.redhat.com/2296067
Vendor advisory: alma — https://bugzilla.redhat.com/2295914
Vendor advisory: alma — https://bugzilla.redhat.com/2294274
Vendor advisory: alma — https://bugzilla.redhat.com/2293711
Vendor advisory: alma — https://bugzilla.redhat.com/2293700
Vendor advisory: alma — https://bugzilla.redhat.com/2293687
Vendor advisory: alma — https://bugzilla.redhat.com/2293684
Vendor advisory: alma — https://bugzilla.redhat.com/2293657
Vendor advisory: alma — https://bugzilla.redhat.com/2293653
Vendor advisory: alma — https://bugzilla.redhat.com/2293461
Vendor advisory: alma — https://bugzilla.redhat.com/2293444
Vendor advisory: alma — https://bugzilla.redhat.com/2293420
Vendor advisory: alma — https://bugzilla.redhat.com/2293418
Vendor advisory: alma — https://bugzilla.redhat.com/2293383
Vendor advisory: alma — https://bugzilla.redhat.com/2293371
Vendor advisory: alma — https://bugzilla.redhat.com/2293367
Vendor advisory: alma — https://bugzilla.redhat.com/2293348
Vendor advisory: alma — https://bugzilla.redhat.com/2293316
Vendor advisory: alma — https://bugzilla.redhat.com/2293312
Vendor advisory: alma — https://bugzilla.redhat.com/2293276
Vendor advisory: alma — https://bugzilla.redhat.com/2293250
Vendor advisory: alma — https://bugzilla.redhat.com/2293078
Vendor advisory: alma — https://bugzilla.redhat.com/2292331
Vendor advisory: alma — https://bugzilla.redhat.com/2290408
Vendor advisory: alma — https://bugzilla.redhat.com/2284625
Vendor advisory: alma — https://bugzilla.redhat.com/2284590
Vendor advisory: alma — https://bugzilla.redhat.com/2284571
Vendor advisory: alma — https://bugzilla.redhat.com/2284556
Vendor advisory: alma — https://bugzilla.redhat.com/2284541
Vendor advisory: alma — https://bugzilla.redhat.com/2284539
Vendor advisory: alma — https://bugzilla.redhat.com/2284519
Vendor advisory: alma — https://bugzilla.redhat.com/2284513
Vendor advisory: alma — https://bugzilla.redhat.com/2284500
Vendor advisory: alma — https://bugzilla.redhat.com/2284496
Vendor advisory: alma — https://bugzilla.redhat.com/2284488
Vendor advisory: alma — https://bugzilla.redhat.com/2284477
Vendor advisory: alma — https://bugzilla.redhat.com/2284474
Vendor advisory: alma — https://bugzilla.redhat.com/2284465
Vendor advisory: alma — https://bugzilla.redhat.com/2284421
Vendor advisory: alma — https://bugzilla.redhat.com/2284417
Vendor advisory: alma — https://bugzilla.redhat.com/2284400
Vendor advisory: alma — https://bugzilla.redhat.com/2283894
Vendor advisory: alma — https://bugzilla.redhat.com/2283401
Vendor advisory: alma — https://bugzilla.redhat.com/2282950
Vendor advisory: alma — https://bugzilla.redhat.com/2282925
Vendor advisory: alma — https://bugzilla.redhat.com/2282923
Vendor advisory: alma — https://bugzilla.redhat.com/2282896
Vendor advisory: alma — https://bugzilla.redhat.com/2282887
Vendor advisory: alma — https://bugzilla.redhat.com/2282780
Vendor advisory: alma — https://bugzilla.redhat.com/2282772
Vendor advisory: alma — https://bugzilla.redhat.com/2282766
Vendor advisory: alma — https://bugzilla.redhat.com/2282763
Vendor advisory: alma — https://bugzilla.redhat.com/2282759
Vendor advisory: alma — https://bugzilla.redhat.com/2282744
Vendor advisory: alma — https://bugzilla.redhat.com/2282743
Vendor advisory: alma — https://bugzilla.redhat.com/2282742
Vendor advisory: alma — https://bugzilla.redhat.com/2282727
Vendor advisory: alma — https://bugzilla.redhat.com/2282719
Vendor advisory: alma — https://bugzilla.redhat.com/2282717
Vendor advisory: alma — https://bugzilla.redhat.com/2282690
Vendor advisory: alma — https://bugzilla.redhat.com/2282645
Vendor advisory: alma — https://bugzilla.redhat.com/2282642
Vendor advisory: alma — https://bugzilla.redhat.com/2282640
Vendor advisory: alma — https://bugzilla.redhat.com/2282623
Vendor advisory: alma — https://bugzilla.redhat.com/2282615
Vendor advisory: alma — https://bugzilla.redhat.com/2282553
Vendor advisory: alma — https://bugzilla.redhat.com/2282479
Vendor advisory: alma — https://bugzilla.redhat.com/2282373
Vendor advisory: alma — https://bugzilla.redhat.com/2282328
Vendor advisory: alma — https://bugzilla.redhat.com/2281989
Vendor advisory: alma — https://bugzilla.redhat.com/2281968
Vendor advisory: alma — https://bugzilla.redhat.com/2281949
Vendor advisory: alma — https://bugzilla.redhat.com/2281938
Vendor advisory: alma — https://bugzilla.redhat.com/2281833
Vendor advisory: alma — https://bugzilla.redhat.com/2281821
Vendor advisory: alma — https://bugzilla.redhat.com/2281819
Vendor advisory: alma — https://bugzilla.redhat.com/2281758
Vendor advisory: alma — https://bugzilla.redhat.com/2281752
Vendor advisory: alma — https://bugzilla.redhat.com/2281725
Vendor advisory: alma — https://bugzilla.redhat.com/2281682
Vendor advisory: alma — https://bugzilla.redhat.com/2281675
Vendor advisory: alma — https://bugzilla.redhat.com/2281672
Vendor advisory: alma — https://bugzilla.redhat.com/2281667
Vendor advisory: alma — https://bugzilla.redhat.com/2281664
Vendor advisory: alma — https://bugzilla.redhat.com/2281641
Vendor advisory: alma — https://bugzilla.redhat.com/2281636
Vendor advisory: alma — https://bugzilla.redhat.com/2281519
Vendor advisory: alma — https://bugzilla.redhat.com/2281510
Vendor advisory: alma — https://bugzilla.redhat.com/2281360
Vendor advisory: alma — https://bugzilla.redhat.com/2281326
Vendor advisory: alma — https://bugzilla.redhat.com/2281268
Vendor advisory: alma — https://bugzilla.redhat.com/2281235
Vendor advisory: alma — https://bugzilla.redhat.com/2281221
Vendor advisory: alma — https://bugzilla.redhat.com/2281215
Vendor advisory: alma — https://bugzilla.redhat.com/2281207
Vendor advisory: alma — https://bugzilla.redhat.com/2281190
Vendor advisory: alma — https://bugzilla.redhat.com/2281189
Vendor advisory: alma — https://bugzilla.redhat.com/2281149
Vendor advisory: alma — https://bugzilla.redhat.com/2281133
Vendor advisory: alma — https://bugzilla.redhat.com/2281054
Vendor advisory: alma — https://bugzilla.redhat.com/2280440
Vendor advisory: alma — https://bugzilla.redhat.com/2278989
Vendor advisory: alma — https://bugzilla.redhat.com/2278539
Vendor advisory: alma — https://bugzilla.redhat.com/2278535
Vendor advisory: alma — https://bugzilla.redhat.com/2278515
Vendor advisory: alma — https://bugzilla.redhat.com/2278484
Vendor advisory: alma — https://bugzilla.redhat.com/2278380
Vendor advisory: alma — https://bugzilla.redhat.com/2278279
Vendor advisory: alma — https://bugzilla.redhat.com/2278277
Vendor advisory: alma — https://bugzilla.redhat.com/2278258
Vendor advisory: alma — https://bugzilla.redhat.com/2278256
Vendor advisory: alma — https://bugzilla.redhat.com/2278218
Vendor advisory: alma — https://bugzilla.redhat.com/2278182
Vendor advisory: alma — https://bugzilla.redhat.com/2278178
Vendor advisory: alma — https://bugzilla.redhat.com/2278176
Vendor advisory: alma — https://bugzilla.redhat.com/2277840
Vendor advisory: alma — https://bugzilla.redhat.com/2277238
Vendor advisory: alma — https://bugzilla.redhat.com/2277166
Vendor advisory: alma — https://bugzilla.redhat.com/2275928
Vendor advisory: alma — https://bugzilla.redhat.com/2275761
Vendor advisory: alma — https://bugzilla.redhat.com/2275748
Vendor advisory: alma — https://bugzilla.redhat.com/2275744
Vendor advisory: alma — https://bugzilla.redhat.com/2275711
Vendor advisory: alma — https://bugzilla.redhat.com/2275694
Vendor advisory: alma — https://bugzilla.redhat.com/2275580
Vendor advisory: alma — https://bugzilla.redhat.com/2275573
Vendor advisory: alma — https://bugzilla.redhat.com/2275565
Vendor advisory: alma — https://bugzilla.redhat.com/2273654
Vendor advisory: alma — https://bugzilla.redhat.com/2273427
Vendor advisory: alma — https://bugzilla.redhat.com/2273268
Vendor advisory: alma — https://bugzilla.redhat.com/2273247
Vendor advisory: alma — https://bugzilla.redhat.com/2273242
Vendor advisory: alma — https://bugzilla.redhat.com/2273236
Vendor advisory: alma — https://bugzilla.redhat.com/2273174
Vendor advisory: alma — https://bugzilla.redhat.com/2273117
Vendor advisory: alma — https://bugzilla.redhat.com/2273109
Vendor advisory: alma — https://bugzilla.redhat.com/2272795
Vendor advisory: alma — https://bugzilla.redhat.com/2272782
Vendor advisory: alma — https://bugzilla.redhat.com/2271688
Vendor advisory: alma — https://bugzilla.redhat.com/2271686
Vendor advisory: alma — https://bugzilla.redhat.com/2270700
Vendor advisory: alma — https://bugzilla.redhat.com/2270100
Vendor advisory: alma — https://bugzilla.redhat.com/2270084
Vendor advisory: alma — https://bugzilla.redhat.com/2269211
Vendor advisory: alma — https://bugzilla.redhat.com/2269070
Vendor advisory: alma — https://bugzilla.redhat.com/2268118
Vendor advisory: alma — https://bugzilla.redhat.com/2267787
Vendor advisory: alma — https://bugzilla.redhat.com/2266594
Vendor advisory: alma — https://bugzilla.redhat.com/2266497
Vendor advisory: alma — https://bugzilla.redhat.com/2266347
Vendor advisory: alma — https://bugzilla.redhat.com/2266341
Vendor advisory: alma — https://bugzilla.redhat.com/2265797
Vendor advisory: alma — https://bugzilla.redhat.com/2265650
Vendor advisory: alma — https://bugzilla.redhat.com/2265645
Vendor advisory: alma — https://bugzilla.redhat.com/2263879
Vendor advisory: alma — https://access.redhat.com/errata/RHSA-2024:5101
Vendor advisory: debian — https://security-tracker.debian.org/tracker/CVE-2024-26958
Vendor advisory: suse — https://www.suse.com/security/cve/CVE-2024-26958.html
Vendor advisory: rocky — https://errata.rockylinux.org/RLSA-2024:5101
Vendor advisory: rocky — https://errata.rockylinux.org/RLSA-2024:5102
Vendor advisory: rocky — https://errata.rockylinux.org/RXSA-2024:5101
Vendor advisory: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 — https://git.kernel.org/stable/c/e25447c35f8745337ea8bc0c9697fcac14df8605
Vendor advisory: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 — https://git.kernel.org/stable/c/e25447c35f8745337ea8bc0c9697fcac14df8605
Vendor advisory: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 — https://git.kernel.org/stable/c/cf54f66e1dd78990ec6b32177bca7e6ea2144a95
Vendor advisory: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 — https://git.kernel.org/stable/c/cf54f66e1dd78990ec6b32177bca7e6ea2144a95
Vendor advisory: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 — https://git.kernel.org/stable/c/80d24b308b7ee7037fc90d8ac99f6f78df0a256f
Vendor advisory: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 — https://git.kernel.org/stable/c/4595d90b5d2ea5fa4d318d13f59055aa4bf3e7f5
Vendor advisory: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 — https://git.kernel.org/stable/c/4595d90b5d2ea5fa4d318d13f59055aa4bf3e7f5
Vendor advisory: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 — https://git.kernel.org/stable/c/3abc2d160ed8213948b147295d77d44a22c88fa3
Vendor advisory: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 — https://git.kernel.org/stable/c/1daf52b5ffb24870fbeda20b4967526d8f9e12ab
Vendor advisory: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 — https://git.kernel.org/stable/c/17f46b803d4f23c66cacce81db35fef3adb8f2af
Vendor advisory: redhat — https://access.redhat.com/errata/RHSA-2024:9315
OS impact
| OS | Version | Status | Fixed in |
|---|---|---|---|
| rhel | 9 | fixed | |
| rocky | 8 | fixed | |
| sles | affected | | |
| debian | bookworm | fixed | 6.1.85-1 |
| debian | bullseye | fixed | 5.10.216-1 |
| debian | forky | fixed | 6.7.12-1 |
| debian | sid | fixed | 6.7.12-1 |
| debian | trixie | fixed | 6.7.12-1 |
| debian | 10.0 | affected | |
| linux-kernel | affected | 5.10.215 | |
| almalinux | 8 | fixed | kernel-doc-4.18.0-553.16.1.el8_10.noarch.rpm |
References
- https://access.redhat.com/errata/RHSA-2024:9315
- https://git.kernel.org/stable/c/17f46b803d4f23c66cacce81db35fef3adb8f2af
- https://git.kernel.org/stable/c/1daf52b5ffb24870fbeda20b4967526d8f9e12ab
- https://git.kernel.org/stable/c/3abc2d160ed8213948b147295d77d44a22c88fa3
- https://git.kernel.org/stable/c/4595d90b5d2ea5fa4d318d13f59055aa4bf3e7f5
- https://git.kernel.org/stable/c/6cd3f13aaa62970b5169d990e936b2e96943bc6a
- https://git.kernel.org/stable/c/80d24b308b7ee7037fc90d8ac99f6f78df0a256f
- https://git.kernel.org/stable/c/cf54f66e1dd78990ec6b32177bca7e6ea2144a95
- https://git.kernel.org/stable/c/e25447c35f8745337ea8bc0c9697fcac14df8605
- https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html
- https://cert-portal.siemens.com/productcert/html/ssa-265688.html
- https://errata.rockylinux.org/RXSA-2024:5101
- https://errata.rockylinux.org/RLSA-2024:5102
- https://errata.rockylinux.org/RLSA-2024:5101
- https://www.suse.com/security/cve/CVE-2024-26958.html
- https://security-tracker.debian.org/tracker/CVE-2024-26958
- https://access.redhat.com/errata/RHSA-2024:5101
- https://bugzilla.redhat.com/2263879
- https://bugzilla.redhat.com/2265645
- https://bugzilla.redhat.com/2265650
- https://bugzilla.redhat.com/2265797
- https://bugzilla.redhat.com/2266341
- https://bugzilla.redhat.com/2266347
- https://bugzilla.redhat.com/2266497
- https://bugzilla.redhat.com/2266594
CWEs
CWE-416
Verify integrity in audit chain (admin only). AS-IS.