Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - btrfs卸载期间停止清除器 kthread 之前刷新 delalloc 工作线程队列在 unmount 路径中在 close_ctree() 我们首先使用可释放相关联的 task_struct 的 kthread_stop() 停止清除器 kthread然后停止并破坏所有工作队列。但是在我们停止清除程序后delalloc_workers 队列中可能仍有一个工作程序在运行 inode.c:submit_compressed_extents() 它会调用 btrfs_add_delayed_iput()而 btrfs_add_delayed_iput() 进而会尝试唤醒之前已被破坏的清除程序 kthread因此task_struct 中的释放后使用。Syzbot 通过下列堆栈跟踪报告了此问题“BUG: KASAN: slab-use-after-free in __lock_acquire+0x78/0x2100 kernel/locking/lockdep.c:5089 由任务 kworker/u8:3/ 执行的地址 ffff8880259d2818 中大小为 8 的读取” 52 CPU1 UID
    0 PID52 Commkworker/u8:3 Not tainted 6.13.0-rc1-syzkaller-00002-gcdd30ebb1b9f #0 硬件名称Google Google Compute Engine/Google Compute Engine、BIOS Google 09/13/2024 Workqueuebtrfs-delalloc btrfs_work_helper 调用跟踪 <TASK> __dump_stack lib/dump_stack.c:94 [内联] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [内联] print_report+0x169/0x550 mm/kasan /report.c:489 kasan_report+0x143/0x180 mm/kasan/report.c:602 __lock_acquire+0x78/0x2100 kernel/locking/lockdep.c:5089 lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5849
    __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [内联] _raw_spin_lock_irqsave+0xd5/0x120 kernel/locking/spinlock.c:162 class_raw_spinlock_irqsave_constructor include/linux/spinlock.h:551 [内联] try_to_wake_up+0xc2/0x1470 kernel/sched/core .c:4205 submit_compressed_extents+0xdf/0x16e0 fs/btrfs/inode.c:1615 run_ordered_work fs/btrfs/async-thread.c:288 [内联] btrfs_work_helper+0x96f/0xc40 fs/btrfs/async-thread.c:324 process_one_work kernel/workqueue.c:3229 [inline] process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310 worker_thread+0x870/0xd30 kernel/workqueue.c:3391 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/ 0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 </TASK> 由任务分配 2kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+ 0x3f/0x80 mm/kasan/common.c:68 unpoison_slab_object mm/kasan/common.c:319 [内联] __kasan_slab_alloc+0x66/0x80 mm/kasan/common.c:345 kasan_slab_alloc include/linu x/kasan.h:250 [inline] slab_post_alloc_hook mm/slub.c:4104 [inline] slab_alloc_node mm/slub.c:4153 [inline] kmem_cache_alloc_node_noprof+0x1d9/0x380 mm/slub.c:4205 alloc_task_struct_node kernel/fork.c 180 [inline] dup_task_struct+0x57/0x8c0 kernel/fork.c:1113 copy_process+0x5d1/0x3d50 kernel/fork.c:2225 kernel_clone+0x223/0x870 kernel/fork.c:2807 kernel_thread+0x1bc/0x240 kernel/fork。 c:2869 create_kthread kernel/kthread.c:412 [inline] kthreadd+0x60d/0x810 kernel/kthread.c:767 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86 /entry/entry_64.S:244 由任务释放 24kasan_save_stack mm/kasan/common.c:47 [内联] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 kasan_save_free_info+0x40/0x50 mm/kasan/generic .c:582 oxide_slab_object mm/kasan/common.c:247 [内联]
    __kasan_slab_free+0x59/0x70 mm/kasan/common.c:264 kasan_slab_free include/linux/kasan.h:233 [内联] slab_free_hook mm/slub.c:2338 [内联] slab_free mm/slub.c:4598 [内联] kmem_cache_free +0x195/0x410 mm/slub.c:4700 put_task_struct include/linux/sched/task.h:144 [内联] delayed_put_task_struct+0x125/0x300 kernel/exit.c:227 rcu_do_batch kernel/rcu/tree.c:2567 [内联] rcu_core+0xaaa/0x17a0 kernel/rcu/tree.c:2823 handle_softirqs+0x2d4/0x9b0 kernel/softirq.c:554 run_ksoftirqd+0xca/0x130 kernel/softirq.c:943 ---truncated--- (CVE-2024-57896)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

检测

Linux Distros 未修补的漏洞：CVE-2024-57896

high Nessus 插件 ID 231592

版本 1.17