Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。 - hfs修复 __hfs_bnode_create 中缺少的 hfs_bnode_get() Syzbot 在 hfs_bnode_put() 中发现一个内核缺陷 fs/hfs/bnode.c:466! 的内核缺陷无效的 opcode0000 [#1] PREEMPT SMP KASAN CPU: 0 PID: 3634 Comm kworker/u4:5 未受感染 6.1.0-rc7-syzkaller-00190-g97ee9d1c1696 #0 硬件名称Google Google Compute Engine/Google Compute Engine、BIOS Google 10/26/2022 Workqueuewriteback wb_workfn (flush-7:0) RIP 0010hfs_bnode_put+0x46f/0x480 fs/hfs/bnode.c:466 代码8a 80 ff e9 73 fe ff ff 89 d9 80 e1 07 80 c1 03 38 c1 0f 8c a0 fe ff ff 48 89 df e8 db 8a 80 ff e9 93 fe ff ff e8 a1 68 2c ff <0f> 0b e8 9a 68 2c ff 0f 0b 0f 1f 84 00 00 00 00 00 55 41 57 41 56 RSP0018:ffffc90003b4f258 EFLAGS: 00010293 RAX: ffff8fff84 0000000000000000 RCX: ffff8880739dd7c0 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc90003b4f430 R08: ffffffff825e2d9b R09: ffffed10045157d1 R10: ffffed10045157d1 R11: R121ffff110045157d0 : ffff8880228abe80 R13: ffff88807016c000 R14: dffffc0000000000 R15: ffff8880228abe00 FS: 0000000000000000(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fa6ebe88718 CR3: 000000001e93d000 CR4: 00000000003506f0 DR0 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: hfs_write_inode+0x1bc/0xb40 write_inode fs/fs-writeback.c:1440 [inline] __writeback_single_inode+0x4d6/0x670 fs/fs-writeback. c:1652 writeback_sb_inodes+0xb3b/0x18f0 fs/fs-writeback.c:1878 __writeback_inodes_wb+0x125/0x420 fs/fs-writeback.c:1949 wb_writeback+0x440/0x7b0 fs/fs-writeback.c:2054 wb_check_start_all fs/fs- writeback.c:2176 [内联] wb_do_writeback fs/fs-writeback.c:2202 [内联] wb_workfn+0x827/0xef0 fs/fs-writeback.c:2235 process_one_work+0x877/0xdb0 kernel/workqueue.c:2289 work_thread+0xb14 /0x1330 kernel/workqueue.c:2436 kthread+0x266/0x300 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306 BUG_ON() 在以下位置触发/*释放节点使用的资源 */ void hfs_bnode_put(struct hfs_bnode *node) {if (node) { BUG_ON(!atomic_read(&node->refcnt)); <- 此处有问题!!!! 通过跟踪 refcnt我发现 hfs_bmap_alloc() refcnt 为 1 创建该节点。然后 hfs_btree_write() 使用该节点。找到节点后缺少 hfs_bnode_get()。以下路径中会发生问题 hfs_bmap_alloc hfs_bnode_find __hfs_bnode_create <- 以 refcnt 分配新节点 1. hfs_bnode_put <- 减少 refcnt hfs_btree_write hfs_bnode_find __hfs_bnode_create hfs_bnode_findhash <- 增加 refcnt 时查找节点。 hfs_bnode_put <- 触发 BUG_ON() 因为 refcnt 为 0。(CVE-2023-53862] 请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

检测

插件搜索

high