Към съдържанието
Търсене

CVE-2025-71183: Linux, състезание за ресурс

9.1

CVSS 3.1

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

Атакува се по мрежата, без особени условия, без вход и без действие от потребителя.

CVE радар: още уязвимости от този вид

  • Експлоатация: няма данни за експлоатация
  • Атаката може да се автоматизира

Описание

Оригинално описание

In the Linux kernel, the following vulnerability has been resolved: btrfs: always detect conflicting inodes when logging inode refs After rename exchanging (either with the rename exchange operation or regular renames in multiple non-atomic steps) two inodes and at least one of them is a directory, we can end up with a log tree that contains only of the inodes and after a power failure that can result in an attempt to delete the other inode when it should not because it was not deleted before the power failure. In some case that delete attempt fails when the target inode is a directory that contains a subvolume inside it, since the log replay code is not prepared to deal with directory entries that point to root items (only inode items). 1) We have directories "dir1" (inode A) and "dir2" (inode B) under the same parent directory; 2) We have a file (inode C) under directory "dir1" (inode A); 3) We have a subvolume inside directory "dir2" (inode B); 4) All these inodes were persisted in a past transaction and we are currently at transaction N; 5) We rename the file (inode C), so at btrfs_log_new_name() we update inode C's last_unlink_trans to N; 6) We get a rename exchange for "dir1" (inode A) and "dir2" (inode B), so after the exchange "dir1" is inode B and "dir2" is inode A. During the rename exchange we call btrfs_log_new_name() for inodes A and B, but because they are directories, we don't update their last_unlink_trans to N; 7) An fsync against the file (inode C) is done, and because its inode has a last_unlink_trans with a value of N we log its parent directory (inode A) (through btrfs_log_all_parents(), called from btrfs_log_inode_parent()). 8) So we end up with inode B not logged, which now has the old name of inode A. At copy_inode_items_to_log(), when logging inode A, we did not check if we had any conflicting inode to log because inode A has a generation lower than the current transaction (created in a pas

Засегнати продукти

  • Linux Linux: 56f23fdbb600e6087db7b009775b95ce07cc3195 преди c7f0207db68d5a1b4af23acbef1a8e8ddc431ebb; 56f23fdbb600e6087db7b009775b95ce07cc3195 преди a63998cd6687c14b160dccb0bbcf281b2eb0dab3; 56f23fdbb600e6087db7b009775b95ce07cc3195 преди 0c2413c69129f6ce60157f7b53d9ba880260400b; 56f23fdbb600e6087db7b009775b95ce07cc3195 преди d52af58dd463821c5c516aebb031a58934f696ea; 56f23fdbb600e6087db7b009775b95ce07cc3195 преди 7ba0b6461bc4edb3005ea6e00cdae189bcf908a5; 048605483fbdd1e77ead32a7cd7b95cc17eaaf0e; 033ad030df0ea932a21499582fea59e1df95769b; 1653a3b0e9436c10eb307c318776cf91fe18ff08; ff440e9185e96cbb94481fc8b6192b944dcfc061; 3.18.32 преди 3.19; 4.1.23 преди 4.2; 4.4.8 преди 4.5; 4.5.2 преди 4.6
  • Linux Linux: 4.6; преди 4.6; 6.1.161 до 6.1.*; 6.6.121 до 6.6.*; 6.12.66 до 6.12.*; 6.18.6 до 6.18.*; 6.19 до *

Вид слабост

История

  • 31 януари 2026 Публикувано

Други уязвимости в Linux Linux

Първоизточници

CVE-2025-71183: Linux, състезание за ресурс | freedomonline.bg