CVE-2024-26629— Linux kernel 安全漏洞
一分钟漏洞结论
影响对象
Linux Linux
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于nfsd4_release_lockowner（）存在安全漏洞。
可能的 ATT&CK 技术 1 AI
T1068 · Exploitation for Privilege Escalation影响版本矩阵 29
| 厂商 | 产品 | 版本范围 | 状态 |
|---|---|---|---|
| Linux | Linux | ef481b262bba4f454351eec43f024fec942c2d4c< 10d75984495f7fe62152c3b0dbfa3f0a6b739c9b |
affected |
3097f38e91266c7132c3fdb7e778fac858c00670< 99fb654d01dc3f08b5905c663ad6c89a9d83302f |
affected | ||
e2fc17fcc503cfca57b5d1dd3b646ca7eebead97< c6f8b3fcc62725e4129f2c0fd550d022d4a7685a |
affected | ||
ce3c4ad7f4ce5db7b4f08a1e237d8dd94b39180b< e4cf8941664cae2f89f0189c29fe2ce8c6be0d03 |
affected | ||
ce3c4ad7f4ce5db7b4f08a1e237d8dd94b39180b< b7d2eee1f53899b53f069bba3a59a419fc3d331b |
affected | ||
ce3c4ad7f4ce5db7b4f08a1e237d8dd94b39180b< 8f5b860de87039b007e84a28a5eefc888154e098 |
affected | ||
ce3c4ad7f4ce5db7b4f08a1e237d8dd94b39180b< edcf9725150e42beeca42d085149f4c88fa97afd |
affected | ||
fea1d0940301378206955264a01778700fc9c16f |
affected | ||
| … +21 条更多 | |||
获取后续新漏洞提醒
登录后订阅
一、 漏洞 CVE-2024-26629 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
nfsd: fix RELEASE_LOCKOWNER
来源: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved:
nfsd: fix RELEASE_LOCKOWNER
The test on so_count in nfsd4_release_lockowner() is nonsense and
harmful. Revert to using check_for_locks(), changing that to not sleep.
First: harmful.
As is documented in the kdoc comment for nfsd4_release_lockowner(), the
test on so_count can transiently return a false positive resulting in a
return of NFS4ERR_LOCKS_HELD when in fact no locks are held. This is
clearly a protocol violation and with the Linux NFS client it can cause
incorrect behaviour.
If RELEASE_LOCKOWNER is sent while some other thread is still
processing a LOCK request which failed because, at the time that request
was received, the given owner held a conflicting lock, then the nfsd
thread processing that LOCK request can hold a reference (conflock) to
the lock owner that causes nfsd4_release_lockowner() to return an
incorrect error.
The Linux NFS client ignores that NFS4ERR_LOCKS_HELD error because it
never sends NFS4_RELEASE_LOCKOWNER without first releasing any locks, so
it knows that the error is impossible. It assumes the lock owner was in
fact released so it feels free to use the same lock owner identifier in
some later locking request.
When it does reuse a lock owner identifier for which a previous RELEASE
failed, it will naturally use a lock_seqid of zero. However the server,
which didn't release the lock owner, will expect a larger lock_seqid and
so will respond with NFS4ERR_BAD_SEQID.
So clearly it is harmful to allow a false positive, which testing
so_count allows.
The test is nonsense because ... well... it doesn't mean anything.
so_count is the sum of three different counts.
1/ the set of states listed on so_stateids
2/ the set of active vfs locks owned by any of those states
3/ various transient counts such as for conflicting locks.
When it is tested against '2' it is clear that one of these is the
transient reference obtained by find_lockowner_str_locked(). It is not
clear what the other one is expected to be.
In practice, the count is often 2 because there is precisely one state
on so_stateids. If there were more, this would fail.
In my testing I see two circumstances when RELEASE_LOCKOWNER is called.
In one case, CLOSE is called before RELEASE_LOCKOWNER. That results in
all the lock states being removed, and so the lockowner being discarded
(it is removed when there are no more references which usually happens
when the lock state is discarded). When nfsd4_release_lockowner() finds
that the lock owner doesn't exist, it returns success.
The other case shows an so_count of '2' and precisely one state listed
in so_stateid. It appears that the Linux client uses a separate lock
owner for each file resulting in one lock state per lock owner, so this
test on '2' is safe. For another client it might not be safe.
So this patch changes check_for_locks() to use the (newish)
find_any_file_locked() so that it doesn't take a reference on the
nfs4_file and so never calls nfsd_file_put(), and so never sleeps. With
this check is it safe to restore the use of check_for_locks() rather
than testing so_count against the mysterious '2'.
来源: CVE Program / CVE List V5
CVSS Information
N/A
来源: CVE Program / CVE List V5
Vulnerability Type
N/A
来源: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
来源: 中国国家信息安全漏洞库 CNNVD
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于nfsd4_release_lockowner（）存在安全漏洞。
来源: 中国国家信息安全漏洞库 CNNVD
CVSS Information
N/A
来源: 中国国家信息安全漏洞库 CNNVD
Vulnerability Type
N/A
来源: 中国国家信息安全漏洞库 CNNVD
受影响产品
二、漏洞 CVE-2024-26629 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC
高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2024-26629 的情报信息
请登录查看更多情报信息。
CVE-2024-26629 邮件列表归档 (3)
CVE-2024-26629 其他参考 (5)
同批安全公告 · Linux · 2024-03-13 · 共 3 条
| CVE-2024-26630 | 7.1 HIGH | Linux kernel 安全漏洞 |
| CVE-2023-52608 | Linux kernel 安全漏洞 |
IV. Related Vulnerabilities
V. Comments for CVE-2024-26629
暂无评论