Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2024-35807— ext4: fix corruption during on-line resize

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于在调整文件系统大小期间发生损坏。

AI Predicted 7.5 Difficulty: Easy EPSS 0.27% · P18

Possible ATT&CK Techniques 1 AI

T1499 · Endpoint Denial of Service

Affected Version Matrix 20

VendorProduct Version RangeStatus
Linux Linux 01f795f9e0d67adeccc61a8b20c28acb45fa5fd8< 75cc31c2e7193b69f5d25650bda5bb42ed92f8a1 affected
01f795f9e0d67adeccc61a8b20c28acb45fa5fd8< ee4e9c1976147a850f6085a13fca95bcaa00d84c affected
01f795f9e0d67adeccc61a8b20c28acb45fa5fd8< e8e8b197317228b5089ed9e7802dadf3ccaa027a affected
01f795f9e0d67adeccc61a8b20c28acb45fa5fd8< 239c669edb2bffa1aa2612519b1d438ab35d6be6 affected
01f795f9e0d67adeccc61a8b20c28acb45fa5fd8< fb1088d51bbaa0faec5a55d4f5818a9ab79e24df affected
01f795f9e0d67adeccc61a8b20c28acb45fa5fd8< 37b6a3ba793bbbae057f5b991970ebcc52cb3db5 affected
01f795f9e0d67adeccc61a8b20c28acb45fa5fd8< b461910af8ba3bed80f48c2bf852686d05c6fc5c affected
01f795f9e0d67adeccc61a8b20c28acb45fa5fd8< 722d2c01b8b108f8283d1b7222209d5b2a5aa7bd affected
… +12 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2024-35807

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
ext4: fix corruption during on-line resize
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: ext4: fix corruption during on-line resize We observed a corruption during on-line resize of a file system that is larger than 16 TiB with 4k block size. With having more then 2^32 blocks resize_inode is turned off by default by mke2fs. The issue can be reproduced on a smaller file system for convenience by explicitly turning off resize_inode. An on-line resize across an 8 GiB boundary (the size of a meta block group in this setup) then leads to a corruption: dev=/dev/<some_dev> # should be >= 16 GiB mkdir -p /corruption /sbin/mke2fs -t ext4 -b 4096 -O ^resize_inode $dev $((2 * 2**21 - 2**15)) mount -t ext4 $dev /corruption dd if=/dev/zero bs=4096 of=/corruption/test count=$((2*2**21 - 4*2**15)) sha1sum /corruption/test # 79d2658b39dcfd77274e435b0934028adafaab11 /corruption/test /sbin/resize2fs $dev $((2*2**21)) # drop page cache to force reload the block from disk echo 1 > /proc/sys/vm/drop_caches sha1sum /corruption/test # 3c2abc63cbf1a94c9e6977e0fbd72cd832c4d5c3 /corruption/test 2^21 = 2^15*2^6 equals 8 GiB whereof 2^15 is the number of blocks per block group and 2^6 are the number of block groups that make a meta block group. The last checksum might be different depending on how the file is laid out across the physical blocks. The actual corruption occurs at physical block 63*2^15 = 2064384 which would be the location of the backup of the meta block group's block descriptor. During the on-line resize the file system will be converted to meta_bg starting at s_first_meta_bg which is 2 in the example - meaning all block groups after 16 GiB. However, in ext4_flex_group_add we might add block groups that are not part of the first meta block group yet. In the reproducer we achieved this by substracting the size of a whole block group from the point where the meta block group would start. This must be considered when updating the backup block group descriptors to follow the non-meta_bg layout. The fix is to add a test whether the group to add is already part of the meta block group or not.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于在调整文件系统大小期间发生损坏。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 01f795f9e0d67adeccc61a8b20c28acb45fa5fd8 ~ 75cc31c2e7193b69f5d25650bda5bb42ed92f8a1 -
Linux Linux 3.7 -

II. Public POCs for CVE-2024-35807

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2024-35807

请登录查看更多情报信息。

Mailing List Discussions for CVE-2024-35807 (2)

Other References for CVE-2024-35807 (8)

Same Patch Batch · Linux · 2024-05-17 · 135 CVEs total

CVE-2023-52687 9.8 CRITICAL crypto: safexcel - Add error handling for dma_map_sg() calls
CVE-2024-35856 8.8 HIGH Bluetooth: btusb: mediatek: Fix double free of skb in coredump
CVE-2024-35804 8.8 HIGH KVM: x86: Mark target gfn of emulated atomic instruction as dirty
CVE-2024-35843 8.8 HIGH iommu/vt-d: Use device rbtree in iopf reporting path
CVE-2024-35811 8.8 HIGH wifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach
CVE-2024-27415 8.8 HIGH netfilter: bridge: confirm multicast packets before passing them up the stack
CVE-2024-27416 8.8 HIGH Bluetooth: hci_event: Fix handling of HCI_EV_IO_CAPA_REQUEST
CVE-2024-27404 8.2 HIGH mptcp: fix data races on remote_id
CVE-2023-52669 8.2 HIGH crypto: s390/aes - Fix buffer overread in CTR mode
CVE-2024-35834 8.2 HIGH xsk: recycle buffer in case Rx queue was full
CVE-2024-35789 8.0 HIGH wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes
CVE-2024-35830 7.8 HIGH media: tc358743: register v4l2 async device only after successful setup
CVE-2024-35835 7.8 HIGH net/mlx5e: fix a double-free in arfs_create_groups
CVE-2024-35827 7.8 HIGH io_uring/net: fix overflow check in io_recvmsg_mshot_prep()
CVE-2023-52662 7.8 HIGH drm/vmwgfx: fix a memleak in vmw_gmrid_man_get_node
CVE-2024-35817 7.8 HIGH drm/amdgpu: amdgpu_ttm_gart_bind set gtt bound flag
CVE-2024-35808 7.8 HIGH md/dm-raid: don't call md_reap_sync_thread() directly
CVE-2024-35793 7.8 HIGH debugfs: fix wait/cancellation handling during remove
CVE-2024-35798 7.8 HIGH btrfs: fix race in read_extent_buffer_pages()
CVE-2024-35814 7.8 HIGH swiotlb: Fix double-allocation of slots due to broken alignment handling

Showing top 20 of 135 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2024-35807

No comments yet

Leave a comment