CVE-2024-56779— Linux kernel 安全漏洞
一分钟漏洞结论
影响对象
Linux Linux
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于nfsd在处理并发nfsd4_open请求时，可能会导致nfs4_openowner内存泄漏，进而影响文件系统的性能和稳定性。
可能的 ATT&CK 技术 1 AI
T1496 · Resource Hijacking影响版本矩阵 16
| 厂商 | 产品 | 版本范围 | 状态 |
|---|---|---|---|
| Linux | Linux | 3234975f477f746c22d076ea178a79ea104b2ca7< a85364f0d30dee01c5d5b4afa55a9629a8f36d8e |
affected |
3234975f477f746c22d076ea178a79ea104b2ca7< 2d505a801e57428057563762f67a5a62009b2600 |
affected | ||
3234975f477f746c22d076ea178a79ea104b2ca7< 0ab0a3ad24e970e894abcac58f85c332d1726749 |
affected | ||
3234975f477f746c22d076ea178a79ea104b2ca7< 45abb68c941ebc9a35c6d3a7b08196712093c636 |
affected | ||
3234975f477f746c22d076ea178a79ea104b2ca7< 37dfc81266d3a32294524bfadd3396614f8633ee |
affected | ||
3234975f477f746c22d076ea178a79ea104b2ca7< 6f73f920b7ad0084373e46121d7ac34117aed652 |
affected | ||
3234975f477f746c22d076ea178a79ea104b2ca7< 98100e88dd8865999dc6379a3356cd799795fe7b |
affected | ||
3.17 |
affected | ||
| … +8 条更多 | |||
获取后续新漏洞提醒
登录后订阅
一、 漏洞 CVE-2024-56779 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
nfsd: fix nfs4_openowner leak when concurrent nfsd4_open occur
来源: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved:
nfsd: fix nfs4_openowner leak when concurrent nfsd4_open occur
The action force umount(umount -f) will attempt to kill all rpc_task even
umount operation may ultimately fail if some files remain open.
Consequently, if an action attempts to open a file, it can potentially
send two rpc_task to nfs server.
NFS CLIENT
thread1 thread2
open("file")
...
nfs4_do_open
_nfs4_do_open
_nfs4_open_and_get_state
_nfs4_proc_open
nfs4_run_open_task
/* rpc_task1 */
rpc_run_task
rpc_wait_for_completion_task
umount -f
nfs_umount_begin
rpc_killall_tasks
rpc_signal_task
rpc_task1 been wakeup
and return -512
_nfs4_do_open // while loop
...
nfs4_run_open_task
/* rpc_task2 */
rpc_run_task
rpc_wait_for_completion_task
While processing an open request, nfsd will first attempt to find or
allocate an nfs4_openowner. If it finds an nfs4_openowner that is not
marked as NFS4_OO_CONFIRMED, this nfs4_openowner will released. Since
two rpc_task can attempt to open the same file simultaneously from the
client to server, and because two instances of nfsd can run
concurrently, this situation can lead to lots of memory leak.
Additionally, when we echo 0 to /proc/fs/nfsd/threads, warning will be
triggered.
NFS SERVER
nfsd1 nfsd2 echo 0 > /proc/fs/nfsd/threads
nfsd4_open
nfsd4_process_open1
find_or_alloc_open_stateowner
// alloc oo1, stateid1
nfsd4_open
nfsd4_process_open1
find_or_alloc_open_stateowner
// find oo1, without NFS4_OO_CONFIRMED
release_openowner
unhash_openowner_locked
list_del_init(&oo->oo_perclient)
// cannot find this oo
// from client, LEAK!!!
alloc_stateowner // alloc oo2
nfsd4_process_open2
init_open_stateid
// associate oo1
// with stateid1, stateid1 LEAK!!!
nfs4_get_vfs_file
// alloc nfsd_file1 and nfsd_file_mark1
// all LEAK!!!
nfsd4_process_open2
...
write_threads
...
nfsd_destroy_serv
nfsd_shutdown_net
nfs4_state_shutdown_net
nfs4_state_destroy_net
destroy_client
__destroy_client
// won't find oo1!!!
nfsd_shutdown_generic
nfsd_file_cache_shutdown
kmem_cache_destroy
for nfsd_file_slab
and nfsd_file_mark_slab
// bark since nfsd_file1
// and nfsd_file_mark1
// still alive
=======================================================================
BUG nfsd_file (Not tainted): Objects remaining in nfsd_file on
__kmem_cache_shutdown()
-----------------------------------------------------------------------
Slab 0xffd4000004438a80 objects=34 used=1 fp=0xff11000110e2ad28
flags=0x17ffffc0000240(workingset|head|node=0|zone=2|lastcpupid=0x1fffff)
CPU: 4 UID: 0 PID: 757 Comm: sh Not tainted 6.12.0-rc6+ #19
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
1.16.1-2.fc37 04/01/2014
Call Trace:
<TASK>
dum
---truncated---
来源: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
来源: CVE Program / CVE List V5
Vulnerability Type
N/A
来源: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
来源: 中国国家信息安全漏洞库 CNNVD
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于nfsd在处理并发nfsd4_open请求时，可能会导致nfs4_openowner内存泄漏，进而影响文件系统的性能和稳定性。
来源: 中国国家信息安全漏洞库 CNNVD
CVSS Information
N/A
来源: 中国国家信息安全漏洞库 CNNVD
Vulnerability Type
N/A
来源: 中国国家信息安全漏洞库 CNNVD
受影响产品
二、漏洞 CVE-2024-56779 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC
高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2024-56779 的情报信息
请登录查看更多情报信息。
CVE-2024-56779 补丁与修复 (7)
同批安全公告 · Linux · 2025-01-08 · 共 16 条
| CVE-2024-56775 | 7.8 HIGH | Linux kernel 安全漏洞 |
| CVE-2024-56784 | 7.8 HIGH | Linux kernel 缓冲区错误漏洞 |
| CVE-2024-56770 | Linux kernel 安全漏洞 | |
| CVE-2024-56771 | Linux kernel 安全漏洞 | |
| CVE-2024-56773 | Linux kernel 代码问题漏洞 | |
| CVE-2024-56772 | Linux kernel 资源管理错误漏洞 | |
| CVE-2024-56774 | Linux kernel 代码问题漏洞 | |
| CVE-2024-56776 | Linux kernel 代码问题漏洞 | |
| CVE-2024-56777 | Linux kernel 代码问题漏洞 | |
| CVE-2024-56778 | Linux kernel 代码问题漏洞 | |
| CVE-2024-56780 | Linux kernel 安全漏洞 | |
| CVE-2024-56782 | Linux kernel 代码问题漏洞 | |
| CVE-2024-56783 | Linux kernel 安全漏洞 | |
| CVE-2024-56785 | Linux kernel 安全漏洞 | |
| CVE-2024-56787 | Linux kernel 安全漏洞 |
IV. Related Vulnerabilities
V. Comments for CVE-2024-56779
暂无评论