Към съдържанието
Търсене

CVE-2024-56779: Linux, отказ на услуга

9.8

CVSS 3.1

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

Атакува се по мрежата, без особени условия, без вход и без действие от потребителя.

CVE радар: още уязвимости от този вид

  • Експлоатация: няма данни за експлоатация
  • Атаката не може да се автоматизира

Описание

Оригинално описание

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix nfs4_openowner leak when concurrent nfsd4_open occur The action force umount(umount -f) will attempt to kill all rpc_task even umount operation may ultimately fail if some files remain open. Consequently, if an action attempts to open a file, it can potentially send two rpc_task to nfs server. NFS CLIENT thread1 thread2 open("file") ... nfs4_do_open _nfs4_do_open _nfs4_open_and_get_state _nfs4_proc_open nfs4_run_open_task /* rpc_task1 */ rpc_run_task rpc_wait_for_completion_task umount -f nfs_umount_begin rpc_killall_tasks rpc_signal_task rpc_task1 been wakeup and return -512 _nfs4_do_open // while loop ... nfs4_run_open_task /* rpc_task2 */ rpc_run_task rpc_wait_for_completion_task While processing an open request, nfsd will first attempt to find or allocate an nfs4_openowner. If it finds an nfs4_openowner that is not marked as NFS4_OO_CONFIRMED, this nfs4_openowner will released. Since two rpc_task can attempt to open the same file simultaneously from the client to server, and because two instances of nfsd can run concurrently, this situation can lead to lots of memory leak. Additionally, when we echo 0 to /proc/fs/nfsd/threads, warning will be triggered. NFS SERVER nfsd1 nfsd2 echo 0 > /proc/fs/nfsd/threads nfsd4_open nfsd4_process_open1 find_or_alloc_open_stateowner // alloc oo1, stateid1 nfsd4_open nfsd4_process_open1 find_or_alloc_open_stateowner // find oo1, without NFS4_OO_CONFIRMED release_openowner unhash_openowner_locked

Засегнати продукти

  • Linux Linux: 3234975f477f746c22d076ea178a79ea104b2ca7 преди a85364f0d30dee01c5d5b4afa55a9629a8f36d8e; 3234975f477f746c22d076ea178a79ea104b2ca7 преди 2d505a801e57428057563762f67a5a62009b2600; 3234975f477f746c22d076ea178a79ea104b2ca7 преди 0ab0a3ad24e970e894abcac58f85c332d1726749; 3234975f477f746c22d076ea178a79ea104b2ca7 преди 45abb68c941ebc9a35c6d3a7b08196712093c636; 3234975f477f746c22d076ea178a79ea104b2ca7 преди 37dfc81266d3a32294524bfadd3396614f8633ee; 3234975f477f746c22d076ea178a79ea104b2ca7 преди 6f73f920b7ad0084373e46121d7ac34117aed652; 3234975f477f746c22d076ea178a79ea104b2ca7 преди 98100e88dd8865999dc6379a3356cd799795fe7b
  • Linux Linux: 3.17; преди 3.17; 5.4.287 до 5.4.*; 5.10.231 до 5.10.*; 5.15.174 до 5.15.*; 6.1.120 до 6.1.*; 6.6.64 до 6.6.*; 6.12.4 до 6.12.*; от 6.13 нататък
  • Siemens: още 3 продукта, добавени от Siemens

    SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP, SIPLUS S7-1500 CPU 1518-4 PN/DP MFP

Вид слабост

История

  • 8 януари 2025 Публикувано

Други уязвимости в Linux Linux

Първоизточници

CVE-2024-56779: Linux, отказ на услуга | freedomonline.bg