CVE-2024-35807

CVE Details

Release Date:

2024-05-17

Description

In the Linux kernel, the following vulnerability has been resolved:\next4: fix corruption during on-line resize\nWe observed a corruption during on-line resize of a file system that is\nlarger than 16 TiB with 4k block size. With having more then 2^32 blocks\nresize_inode is turned off by default by mke2fs. The issue can be\nreproduced on a smaller file system for convenience by explicitly\nturning off resize_inode. An on-line resize across an 8 GiB boundary (the\nsize of a meta block group in this setup) then leads to a corruption:\ndev=/dev/ # should be >= 16 GiB\nmkdir -p /corruption\n/sbin/mke2fs -t ext4 -b 4096 -O ^resize_inode 4161536\nmount -t ext4 /corruption\ndd if=/dev/zero bs=4096 of=/corruption/test count=4063232\nsha1sum /corruption/test\n# 79d2658b39dcfd77274e435b0934028adafaab11 /corruption/test\n/sbin/resize2fs 4194304\n# drop page cache to force reload the block from disk\necho 1 > /proc/sys/vm/drop_caches\nsha1sum /corruption/test\n# 3c2abc63cbf1a94c9e6977e0fbd72cd832c4d5c3 /corruption/test\n2^21 = 2^15*2^6 equals 8 GiB whereof 2^15 is the number of blocks per\nblock group and 2^6 are the number of block groups that make a meta\nblock group.\nThe last checksum might be different depending on how the file is laid\nout across the physical blocks. The actual corruption occurs at physical\nblock 63*2^15 = 2064384 which would be the location of the backup of the\nmeta block group's block descriptor. During the on-line resize the file\nsystem will be converted to meta_bg starting at s_first_meta_bg which is\n2 in the example - meaning all block groups after 16 GiB. However, in\next4_flex_group_add we might add block groups that are not part of the\nfirst meta block group yet. In the reproducer we achieved this by\nsubstracting the size of a whole block group from the point where the\nmeta block group would start. This must be considered when updating the\nbackup block group descriptors to follow the non-meta_bg layout. The fix\nis to add a test whether the group to add is already part of the meta\nblock group or not.

See more information about CVE-2024-35807 from MITRE CVE dictionary and NIST NVD

CVSS Scoring

NOTE: The following CVSS v3.1 metrics and score provided are preliminary and subject to review.

Base Score:	5.5	CVSS Vector:	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack Vector:	Local network	Attack Complexity:	Low
Privileges Required:	Low	User Interaction:	None
Scope:	Unchanged	Confidentiality Impact:	None
Integrity Impact:	None	Availability Impact:	High

Errata information

Platform	Errata	Release Date
Oracle Linux version 8 (kernel)	ELSA-2024-5101	2024-08-08
Oracle Linux version 9 (kernel)	ELSA-2024-9315	2024-11-14