CVE-2024-42077

CVE Details

Release Date:

2024-07-29

Description

In the Linux kernel, the following vulnerability has been resolved:\nocfs2: fix DIO failure due to insufficient transaction credits\nThe code in ocfs2_dio_end_io_write() estimates number of necessary\ntransaction credits using ocfs2_calc_extend_credits(). This however does\nnot take into account that the IO could be arbitrarily large and can\ncontain arbitrary number of extents.\nExtent tree manipulations do often extend the current transaction but not\nin all of the cases. For example if we have only single block extents in\nthe tree, ocfs2_mark_extent_written() will end up calling\nocfs2_replace_extent_rec() all the time and we will never extend the\ncurrent transaction and eventually exhaust all the transaction credits if\nthe IO contains many single block extents. Once that happens a\nWARN_ON(jbd2_handle_buffer_credits(handle) <= 0) is triggered in\njbd2_journal_dirty_metadata() and subsequently OCFS2 aborts in response to\nthis error. This was actually triggered by one of our customers on a\nheavily fragmented OCFS2 filesystem.\nTo fix the issue make sure the transaction always has enough credits for\none extent insert before each call of ocfs2_mark_extent_written().\nHeming Zhao said:\n------\nPANIC: 'Kernel panic - not syncing: OCFS2: (device dm-1): panic forced after error'\nPID: xxx TASK: xxxx CPU: 5 COMMAND: 'SubmitThread-CA'\n#0 machine_kexec at ffffffff8c069932\n#1 __crash_kexec at ffffffff8c1338fa\n#2 panic at ffffffff8c1d69b9\n#3 ocfs2_handle_error at ffffffffc0c86c0c [ocfs2]\n#4 __ocfs2_abort at ffffffffc0c88387 [ocfs2]\n#5 ocfs2_journal_dirty at ffffffffc0c51e98 [ocfs2]\n#6 ocfs2_split_extent at ffffffffc0c27ea3 [ocfs2]\n#7 ocfs2_change_extent_flag at ffffffffc0c28053 [ocfs2]\n#8 ocfs2_mark_extent_written at ffffffffc0c28347 [ocfs2]\n#9 ocfs2_dio_end_io_write at ffffffffc0c2bef9 [ocfs2]\n#10 ocfs2_dio_end_io at ffffffffc0c2c0f5 [ocfs2]\n#11 dio_complete at ffffffff8c2b9fa7\n#12 do_blockdev_direct_IO at ffffffff8c2bc09f\n#13 ocfs2_direct_IO at ffffffffc0c2b653 [ocfs2]\n#14 generic_file_direct_write at ffffffff8c1dcf14\n#15 __generic_file_write_iter at ffffffff8c1dd07b\n#16 ocfs2_file_write_iter at ffffffffc0c49f1f [ocfs2]\n#17 aio_write at ffffffff8c2cc72e\n#18 kmem_cache_alloc at ffffffff8c248dde\n#19 do_io_submit at ffffffff8c2ccada\n#20 do_syscall_64 at ffffffff8c004984\n#21 entry_SYSCALL_64_after_hwframe at ffffffff8c8000ba

See more information about CVE-2024-42077 from MITRE CVE dictionary and NIST NVD

CVSS Scoring

NOTE: The following CVSS v3.1 metrics and score provided are preliminary and subject to review.

Base Score:	5.5	CVSS Vector:	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack Vector:	Local network	Attack Complexity:	Low
Privileges Required:	Low	User Interaction:	None
Scope:	Unchanged	Confidentiality Impact:	None
Integrity Impact:	None	Availability Impact:	High

Errata information

Platform	Errata	Release Date
Oracle Linux version 8 (kernel-uek)	ELSA-2024-12618	2024-09-12
Oracle Linux version 9 (kernel-uek)	ELSA-2024-12618	2024-09-12