CVE-2024-49868— Linux kernel 安全漏洞
一分钟漏洞结论
影响对象
Linux Linux
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于btrfs文件系统在事务启动失败时会导致空指针取消引用。
影响版本矩阵 18
| 厂商 | 产品 | 版本范围 | 状态 |
|---|---|---|---|
| Linux | Linux | 3fd0a5585eb98e074fb9934549c8d85c49756c0d< 1282f001cbf56e5dd6e90a18e205a566793f4be0 |
affected |
3fd0a5585eb98e074fb9934549c8d85c49756c0d< d73d48acf36f57362df7e4f9d76568168bf5e944 |
affected | ||
3fd0a5585eb98e074fb9934549c8d85c49756c0d< 37fee9c220b92c3b7bf22b51c51dde5364e7590b |
affected | ||
3fd0a5585eb98e074fb9934549c8d85c49756c0d< d13249c0df7aab885acb149695f82c54c0822a70 |
affected | ||
3fd0a5585eb98e074fb9934549c8d85c49756c0d< 7ad0c5868f2f0418619089513d95230c66cb7eb4 |
affected | ||
3fd0a5585eb98e074fb9934549c8d85c49756c0d< dc02c1440705e3451abd1c2c8114a5c1bb188e9f |
affected | ||
3fd0a5585eb98e074fb9934549c8d85c49756c0d< 39356ec0e319ed07627b3a0f402d0608546509e6 |
affected | ||
3fd0a5585eb98e074fb9934549c8d85c49756c0d< c3b47f49e83197e8dffd023ec568403bcdbb774b |
affected | ||
| … +10 条更多 | |||
获取后续新漏洞提醒
登录后订阅
一、 漏洞 CVE-2024-49868 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
btrfs: fix a NULL pointer dereference when failed to start a new trasacntion
来源: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved:
btrfs: fix a NULL pointer dereference when failed to start a new trasacntion
[BUG]
Syzbot reported a NULL pointer dereference with the following crash:
FAULT_INJECTION: forcing a failure.
start_transaction+0x830/0x1670 fs/btrfs/transaction.c:676
prepare_to_relocate+0x31f/0x4c0 fs/btrfs/relocation.c:3642
relocate_block_group+0x169/0xd20 fs/btrfs/relocation.c:3678
...
BTRFS info (device loop0): balance: ended with status: -12
Oops: general protection fault, probably for non-canonical address 0xdffffc00000000cc: 0000 [#1] PREEMPT SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000660-0x0000000000000667]
RIP: 0010:btrfs_update_reloc_root+0x362/0xa80 fs/btrfs/relocation.c:926
Call Trace:
<TASK>
commit_fs_roots+0x2ee/0x720 fs/btrfs/transaction.c:1496
btrfs_commit_transaction+0xfaf/0x3740 fs/btrfs/transaction.c:2430
del_balance_item fs/btrfs/volumes.c:3678 [inline]
reset_balance_state+0x25e/0x3c0 fs/btrfs/volumes.c:3742
btrfs_balance+0xead/0x10c0 fs/btrfs/volumes.c:4574
btrfs_ioctl_balance+0x493/0x7c0 fs/btrfs/ioctl.c:3673
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:907 [inline]
__se_sys_ioctl+0xf9/0x170 fs/ioctl.c:893
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
[CAUSE]
The allocation failure happens at the start_transaction() inside
prepare_to_relocate(), and during the error handling we call
unset_reloc_control(), which makes fs_info->balance_ctl to be NULL.
Then we continue the error path cleanup in btrfs_balance() by calling
reset_balance_state() which will call del_balance_item() to fully delete
the balance item in the root tree.
However during the small window between set_reloc_contrl() and
unset_reloc_control(), we can have a subvolume tree update and created a
reloc_root for that subvolume.
Then we go into the final btrfs_commit_transaction() of
del_balance_item(), and into btrfs_update_reloc_root() inside
commit_fs_roots().
That function checks if fs_info->reloc_ctl is in the merge_reloc_tree
stage, but since fs_info->reloc_ctl is NULL, it results a NULL pointer
dereference.
[FIX]
Just add extra check on fs_info->reloc_ctl inside
btrfs_update_reloc_root(), before checking
fs_info->reloc_ctl->merge_reloc_tree.
That DEAD_RELOC_TREE handling is to prevent further modification to the
reloc tree during merge stage, but since there is no reloc_ctl at all,
we do not need to bother that.
来源: CVE Program / CVE List V5
CVSS Information
N/A
来源: CVE Program / CVE List V5
Vulnerability Type
N/A
来源: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
来源: 中国国家信息安全漏洞库 CNNVD
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于btrfs文件系统在事务启动失败时会导致空指针取消引用。
来源: 中国国家信息安全漏洞库 CNNVD
CVSS Information
N/A
来源: 中国国家信息安全漏洞库 CNNVD
Vulnerability Type
N/A
来源: 中国国家信息安全漏洞库 CNNVD
受影响产品
二、漏洞 CVE-2024-49868 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC
高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2024-49868 的情报信息
请登录查看更多情报信息。
CVE-2024-49868 补丁与修复 (3)
同批安全公告 · Linux · 2024-10-21 · 共 372 条
| CVE-2024-50043 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2022-48985 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2024-47695 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2024-50033 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2024-49855 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2024-50047 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2024-50046 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2022-49003 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2024-49996 | 9.4 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2024-47678 | 9.4 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2022-49017 | 8.8 HIGH | Linux kernel 安全漏洞 |
| CVE-2024-50029 | 8.8 HIGH | Linux kernel 安全漏洞 |
| CVE-2024-50041 | 8.8 HIGH | Linux kernel 安全漏洞 |
| CVE-2024-49939 | 8.8 HIGH | Linux kernel 安全漏洞 |
| CVE-2022-48960 | 8.8 HIGH | Linux kernel 安全漏洞 |
| CVE-2022-48962 | 8.8 HIGH | Linux kernel 安全漏洞 |
| CVE-2022-48964 | 8.8 HIGH | Linux kernel 安全漏洞 |
| CVE-2022-49015 | 8.8 HIGH | Linux kernel 安全漏洞 |
| CVE-2022-48967 | 8.8 HIGH | Linux kernel 安全漏洞 |
| CVE-2024-49930 | 8.8 HIGH | Linux kernel 安全漏洞 |
显示前 20 条，共 372 条。 查看全部 → →
IV. Related Vulnerabilities
V. Comments for CVE-2024-49868
暂无评论