CVE-2024-53171 (GCVE-0-2024-53171)
Vulnerability from cvelistv5
Published
2024-12-27 13:49
Modified
2025-05-04 09:54
Summary
In the Linux kernel, the following vulnerability has been resolved: ubifs: authentication: Fix use-after-free in ubifs_tnc_end_commit After an insertion in TNC, the tree might split and cause a node to change its `znode->parent`. A further deletion of other nodes in the tree (which also could free the nodes), the aforementioned node's `znode->cparent` could still point to a freed node. This `znode->cparent` may not be updated when getting nodes to commit in `ubifs_tnc_start_commit()`. This could then trigger a use-after-free when accessing the `znode->cparent` in `write_index()` in `ubifs_tnc_end_commit()`. This can be triggered by running rm -f /etc/test-file.bin dd if=/dev/urandom of=/etc/test-file.bin bs=1M count=60 conv=fsync in a loop, and with `CONFIG_UBIFS_FS_AUTHENTICATION`. KASAN then reports: BUG: KASAN: use-after-free in ubifs_tnc_end_commit+0xa5c/0x1950 Write of size 32 at addr ffffff800a3af86c by task ubifs_bgt0_20/153 Call trace: dump_backtrace+0x0/0x340 show_stack+0x18/0x24 dump_stack_lvl+0x9c/0xbc print_address_description.constprop.0+0x74/0x2b0 kasan_report+0x1d8/0x1f0 kasan_check_range+0xf8/0x1a0 memcpy+0x84/0xf4 ubifs_tnc_end_commit+0xa5c/0x1950 do_commit+0x4e0/0x1340 ubifs_bg_thread+0x234/0x2e0 kthread+0x36c/0x410 ret_from_fork+0x10/0x20 Allocated by task 401: kasan_save_stack+0x38/0x70 __kasan_kmalloc+0x8c/0xd0 __kmalloc+0x34c/0x5bc tnc_insert+0x140/0x16a4 ubifs_tnc_add+0x370/0x52c ubifs_jnl_write_data+0x5d8/0x870 do_writepage+0x36c/0x510 ubifs_writepage+0x190/0x4dc __writepage+0x58/0x154 write_cache_pages+0x394/0x830 do_writepages+0x1f0/0x5b0 filemap_fdatawrite_wbc+0x170/0x25c file_write_and_wait_range+0x140/0x190 ubifs_fsync+0xe8/0x290 vfs_fsync_range+0xc0/0x1e4 do_fsync+0x40/0x90 __arm64_sys_fsync+0x34/0x50 invoke_syscall.constprop.0+0xa8/0x260 do_el0_svc+0xc8/0x1f0 el0_svc+0x34/0x70 el0t_64_sync_handler+0x108/0x114 el0t_64_sync+0x1a4/0x1a8 Freed by task 403: kasan_save_stack+0x38/0x70 kasan_set_track+0x28/0x40 kasan_set_free_info+0x28/0x4c __kasan_slab_free+0xd4/0x13c kfree+0xc4/0x3a0 tnc_delete+0x3f4/0xe40 ubifs_tnc_remove_range+0x368/0x73c ubifs_tnc_remove_ino+0x29c/0x2e0 ubifs_jnl_delete_inode+0x150/0x260 ubifs_evict_inode+0x1d4/0x2e4 evict+0x1c8/0x450 iput+0x2a0/0x3c4 do_unlinkat+0x2cc/0x490 __arm64_sys_unlinkat+0x90/0x100 invoke_syscall.constprop.0+0xa8/0x260 do_el0_svc+0xc8/0x1f0 el0_svc+0x34/0x70 el0t_64_sync_handler+0x108/0x114 el0t_64_sync+0x1a4/0x1a8 The offending `memcpy()` in `ubifs_copy_hash()` has a use-after-free when a node becomes root in TNC but still has a `cparent` to an already freed node. More specifically, consider the following TNC: zroot / / zp1 / / zn Inserting a new node `zn_new` with a key smaller then `zn` will trigger a split in `tnc_insert()` if `zp1` is full: zroot / \ / \ zp1 zp2 / \ / \ zn_new zn `zn->parent` has now been moved to `zp2`, *but* `zn->cparent` still points to `zp1`. Now, consider a removal of all the nodes _except_ `zn`. Just when `tnc_delete()` is about to delete `zroot` and `zp2`: zroot \ \ zp2 \ \ zn `zroot` and `zp2` get freed and the tree collapses: zn `zn` now becomes the new `zroot`. `get_znodes_to_commit()` will now only find `zn`, the new `zroot`, and `write_index()` will check its `znode->cparent` that wrongly points to the already freed `zp1`. `ubifs_copy_hash()` thus gets wrongly called with `znode->cparent->zbranch[znode->iip].hash` that triggers the use-after-free! Fix this by explicitly setting `znode->cparent` to `NULL` in `get_znodes_to_commit()` for the root node. The search for the dirty nodes ---truncated---
Impacted products
Vendor Product Version
Linux Linux Version: 16a26b20d2afd0cf063816725b45b12e78d5bb31
Version: 16a26b20d2afd0cf063816725b45b12e78d5bb31
Version: 16a26b20d2afd0cf063816725b45b12e78d5bb31
Version: 16a26b20d2afd0cf063816725b45b12e78d5bb31
Version: 16a26b20d2afd0cf063816725b45b12e78d5bb31
Version: 16a26b20d2afd0cf063816725b45b12e78d5bb31
Version: 16a26b20d2afd0cf063816725b45b12e78d5bb31
Version: 16a26b20d2afd0cf063816725b45b12e78d5bb31
Create a notification for this product.
Show details on NVD website


{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-53171",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-11T15:43:44.944550Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-11T15:45:27.208Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/ubifs/tnc_commit.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "daac4aa1825de0dbc1a6eede2fa7f9fc53f14223",
              "status": "affected",
              "version": "16a26b20d2afd0cf063816725b45b12e78d5bb31",
              "versionType": "git"
            },
            {
              "lessThan": "8d8b3f5f4cbfbf6cb0ea4a4d5dc296872b4151eb",
              "status": "affected",
              "version": "16a26b20d2afd0cf063816725b45b12e78d5bb31",
              "versionType": "git"
            },
            {
              "lessThan": "4d9807048b851d7a58d5bd089c16254af896e4df",
              "status": "affected",
              "version": "16a26b20d2afd0cf063816725b45b12e78d5bb31",
              "versionType": "git"
            },
            {
              "lessThan": "74981f7577d183acad1cd58f74c10d263711a215",
              "status": "affected",
              "version": "16a26b20d2afd0cf063816725b45b12e78d5bb31",
              "versionType": "git"
            },
            {
              "lessThan": "01d3a2293d7e4edfff96618c15727db7e51f11b6",
              "status": "affected",
              "version": "16a26b20d2afd0cf063816725b45b12e78d5bb31",
              "versionType": "git"
            },
            {
              "lessThan": "398a91599d263e41c5f95a2fd4ebdb6280b5c6c3",
              "status": "affected",
              "version": "16a26b20d2afd0cf063816725b45b12e78d5bb31",
              "versionType": "git"
            },
            {
              "lessThan": "2497479aecebe869d23a0064e0fd1a03e34f0e2a",
              "status": "affected",
              "version": "16a26b20d2afd0cf063816725b45b12e78d5bb31",
              "versionType": "git"
            },
            {
              "lessThan": "4617fb8fc15effe8eda4dd898d4e33eb537a7140",
              "status": "affected",
              "version": "16a26b20d2afd0cf063816725b45b12e78d5bb31",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/ubifs/tnc_commit.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.20"
            },
            {
              "lessThan": "4.20",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.287",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.231",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.174",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.120",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.64",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.287",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.231",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.174",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.120",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.64",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.11",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.2",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nubifs: authentication: Fix use-after-free in ubifs_tnc_end_commit\n\nAfter an insertion in TNC, the tree might split and cause a node to\nchange its `znode-\u003eparent`. A further deletion of other nodes in the\ntree (which also could free the nodes), the aforementioned node\u0027s\n`znode-\u003ecparent` could still point to a freed node. This\n`znode-\u003ecparent` may not be updated when getting nodes to commit in\n`ubifs_tnc_start_commit()`. This could then trigger a use-after-free\nwhen accessing the `znode-\u003ecparent` in `write_index()` in\n`ubifs_tnc_end_commit()`.\n\nThis can be triggered by running\n\n  rm -f /etc/test-file.bin\n  dd if=/dev/urandom of=/etc/test-file.bin bs=1M count=60 conv=fsync\n\nin a loop, and with `CONFIG_UBIFS_FS_AUTHENTICATION`. KASAN then\nreports:\n\n  BUG: KASAN: use-after-free in ubifs_tnc_end_commit+0xa5c/0x1950\n  Write of size 32 at addr ffffff800a3af86c by task ubifs_bgt0_20/153\n\n  Call trace:\n   dump_backtrace+0x0/0x340\n   show_stack+0x18/0x24\n   dump_stack_lvl+0x9c/0xbc\n   print_address_description.constprop.0+0x74/0x2b0\n   kasan_report+0x1d8/0x1f0\n   kasan_check_range+0xf8/0x1a0\n   memcpy+0x84/0xf4\n   ubifs_tnc_end_commit+0xa5c/0x1950\n   do_commit+0x4e0/0x1340\n   ubifs_bg_thread+0x234/0x2e0\n   kthread+0x36c/0x410\n   ret_from_fork+0x10/0x20\n\n  Allocated by task 401:\n   kasan_save_stack+0x38/0x70\n   __kasan_kmalloc+0x8c/0xd0\n   __kmalloc+0x34c/0x5bc\n   tnc_insert+0x140/0x16a4\n   ubifs_tnc_add+0x370/0x52c\n   ubifs_jnl_write_data+0x5d8/0x870\n   do_writepage+0x36c/0x510\n   ubifs_writepage+0x190/0x4dc\n   __writepage+0x58/0x154\n   write_cache_pages+0x394/0x830\n   do_writepages+0x1f0/0x5b0\n   filemap_fdatawrite_wbc+0x170/0x25c\n   file_write_and_wait_range+0x140/0x190\n   ubifs_fsync+0xe8/0x290\n   vfs_fsync_range+0xc0/0x1e4\n   do_fsync+0x40/0x90\n   __arm64_sys_fsync+0x34/0x50\n   invoke_syscall.constprop.0+0xa8/0x260\n   do_el0_svc+0xc8/0x1f0\n   el0_svc+0x34/0x70\n   el0t_64_sync_handler+0x108/0x114\n   el0t_64_sync+0x1a4/0x1a8\n\n  Freed by task 403:\n   kasan_save_stack+0x38/0x70\n   kasan_set_track+0x28/0x40\n   kasan_set_free_info+0x28/0x4c\n   __kasan_slab_free+0xd4/0x13c\n   kfree+0xc4/0x3a0\n   tnc_delete+0x3f4/0xe40\n   ubifs_tnc_remove_range+0x368/0x73c\n   ubifs_tnc_remove_ino+0x29c/0x2e0\n   ubifs_jnl_delete_inode+0x150/0x260\n   ubifs_evict_inode+0x1d4/0x2e4\n   evict+0x1c8/0x450\n   iput+0x2a0/0x3c4\n   do_unlinkat+0x2cc/0x490\n   __arm64_sys_unlinkat+0x90/0x100\n   invoke_syscall.constprop.0+0xa8/0x260\n   do_el0_svc+0xc8/0x1f0\n   el0_svc+0x34/0x70\n   el0t_64_sync_handler+0x108/0x114\n   el0t_64_sync+0x1a4/0x1a8\n\nThe offending `memcpy()` in `ubifs_copy_hash()` has a use-after-free\nwhen a node becomes root in TNC but still has a `cparent` to an already\nfreed node. More specifically, consider the following TNC:\n\n         zroot\n         /\n        /\n      zp1\n      /\n     /\n    zn\n\nInserting a new node `zn_new` with a key smaller then `zn` will trigger\na split in `tnc_insert()` if `zp1` is full:\n\n         zroot\n         /   \\\n        /     \\\n      zp1     zp2\n      /         \\\n     /           \\\n  zn_new          zn\n\n`zn-\u003eparent` has now been moved to `zp2`, *but* `zn-\u003ecparent` still\npoints to `zp1`.\n\nNow, consider a removal of all the nodes _except_ `zn`. Just when\n`tnc_delete()` is about to delete `zroot` and `zp2`:\n\n         zroot\n             \\\n              \\\n              zp2\n                \\\n                 \\\n                 zn\n\n`zroot` and `zp2` get freed and the tree collapses:\n\n           zn\n\n`zn` now becomes the new `zroot`.\n\n`get_znodes_to_commit()` will now only find `zn`, the new `zroot`, and\n`write_index()` will check its `znode-\u003ecparent` that wrongly points to\nthe already freed `zp1`. `ubifs_copy_hash()` thus gets wrongly called\nwith `znode-\u003ecparent-\u003ezbranch[znode-\u003eiip].hash` that triggers the\nuse-after-free!\n\nFix this by explicitly setting `znode-\u003ecparent` to `NULL` in\n`get_znodes_to_commit()` for the root node. The search for the dirty\nnodes\n---truncated---"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-04T09:54:50.620Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/daac4aa1825de0dbc1a6eede2fa7f9fc53f14223"
        },
        {
          "url": "https://git.kernel.org/stable/c/8d8b3f5f4cbfbf6cb0ea4a4d5dc296872b4151eb"
        },
        {
          "url": "https://git.kernel.org/stable/c/4d9807048b851d7a58d5bd089c16254af896e4df"
        },
        {
          "url": "https://git.kernel.org/stable/c/74981f7577d183acad1cd58f74c10d263711a215"
        },
        {
          "url": "https://git.kernel.org/stable/c/01d3a2293d7e4edfff96618c15727db7e51f11b6"
        },
        {
          "url": "https://git.kernel.org/stable/c/398a91599d263e41c5f95a2fd4ebdb6280b5c6c3"
        },
        {
          "url": "https://git.kernel.org/stable/c/2497479aecebe869d23a0064e0fd1a03e34f0e2a"
        },
        {
          "url": "https://git.kernel.org/stable/c/4617fb8fc15effe8eda4dd898d4e33eb537a7140"
        }
      ],
      "title": "ubifs: authentication: Fix use-after-free in ubifs_tnc_end_commit",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-53171",
    "datePublished": "2024-12-27T13:49:16.423Z",
    "dateReserved": "2024-11-19T17:17:25.006Z",
    "dateUpdated": "2025-05-04T09:54:50.620Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-53171\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-12-27T14:15:24.300\",\"lastModified\":\"2025-02-11T16:15:40.687\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nubifs: authentication: Fix use-after-free in ubifs_tnc_end_commit\\n\\nAfter an insertion in TNC, the tree might split and cause a node to\\nchange its `znode-\u003eparent`. A further deletion of other nodes in the\\ntree (which also could free the nodes), the aforementioned node\u0027s\\n`znode-\u003ecparent` could still point to a freed node. This\\n`znode-\u003ecparent` may not be updated when getting nodes to commit in\\n`ubifs_tnc_start_commit()`. This could then trigger a use-after-free\\nwhen accessing the `znode-\u003ecparent` in `write_index()` in\\n`ubifs_tnc_end_commit()`.\\n\\nThis can be triggered by running\\n\\n  rm -f /etc/test-file.bin\\n  dd if=/dev/urandom of=/etc/test-file.bin bs=1M count=60 conv=fsync\\n\\nin a loop, and with `CONFIG_UBIFS_FS_AUTHENTICATION`. KASAN then\\nreports:\\n\\n  BUG: KASAN: use-after-free in ubifs_tnc_end_commit+0xa5c/0x1950\\n  Write of size 32 at addr ffffff800a3af86c by task ubifs_bgt0_20/153\\n\\n  Call trace:\\n   dump_backtrace+0x0/0x340\\n   show_stack+0x18/0x24\\n   dump_stack_lvl+0x9c/0xbc\\n   print_address_description.constprop.0+0x74/0x2b0\\n   kasan_report+0x1d8/0x1f0\\n   kasan_check_range+0xf8/0x1a0\\n   memcpy+0x84/0xf4\\n   ubifs_tnc_end_commit+0xa5c/0x1950\\n   do_commit+0x4e0/0x1340\\n   ubifs_bg_thread+0x234/0x2e0\\n   kthread+0x36c/0x410\\n   ret_from_fork+0x10/0x20\\n\\n  Allocated by task 401:\\n   kasan_save_stack+0x38/0x70\\n   __kasan_kmalloc+0x8c/0xd0\\n   __kmalloc+0x34c/0x5bc\\n   tnc_insert+0x140/0x16a4\\n   ubifs_tnc_add+0x370/0x52c\\n   ubifs_jnl_write_data+0x5d8/0x870\\n   do_writepage+0x36c/0x510\\n   ubifs_writepage+0x190/0x4dc\\n   __writepage+0x58/0x154\\n   write_cache_pages+0x394/0x830\\n   do_writepages+0x1f0/0x5b0\\n   filemap_fdatawrite_wbc+0x170/0x25c\\n   file_write_and_wait_range+0x140/0x190\\n   ubifs_fsync+0xe8/0x290\\n   vfs_fsync_range+0xc0/0x1e4\\n   do_fsync+0x40/0x90\\n   __arm64_sys_fsync+0x34/0x50\\n   invoke_syscall.constprop.0+0xa8/0x260\\n   do_el0_svc+0xc8/0x1f0\\n   el0_svc+0x34/0x70\\n   el0t_64_sync_handler+0x108/0x114\\n   el0t_64_sync+0x1a4/0x1a8\\n\\n  Freed by task 403:\\n   kasan_save_stack+0x38/0x70\\n   kasan_set_track+0x28/0x40\\n   kasan_set_free_info+0x28/0x4c\\n   __kasan_slab_free+0xd4/0x13c\\n   kfree+0xc4/0x3a0\\n   tnc_delete+0x3f4/0xe40\\n   ubifs_tnc_remove_range+0x368/0x73c\\n   ubifs_tnc_remove_ino+0x29c/0x2e0\\n   ubifs_jnl_delete_inode+0x150/0x260\\n   ubifs_evict_inode+0x1d4/0x2e4\\n   evict+0x1c8/0x450\\n   iput+0x2a0/0x3c4\\n   do_unlinkat+0x2cc/0x490\\n   __arm64_sys_unlinkat+0x90/0x100\\n   invoke_syscall.constprop.0+0xa8/0x260\\n   do_el0_svc+0xc8/0x1f0\\n   el0_svc+0x34/0x70\\n   el0t_64_sync_handler+0x108/0x114\\n   el0t_64_sync+0x1a4/0x1a8\\n\\nThe offending `memcpy()` in `ubifs_copy_hash()` has a use-after-free\\nwhen a node becomes root in TNC but still has a `cparent` to an already\\nfreed node. More specifically, consider the following TNC:\\n\\n         zroot\\n         /\\n        /\\n      zp1\\n      /\\n     /\\n    zn\\n\\nInserting a new node `zn_new` with a key smaller then `zn` will trigger\\na split in `tnc_insert()` if `zp1` is full:\\n\\n         zroot\\n         /   \\\\\\n        /     \\\\\\n      zp1     zp2\\n      /         \\\\\\n     /           \\\\\\n  zn_new          zn\\n\\n`zn-\u003eparent` has now been moved to `zp2`, *but* `zn-\u003ecparent` still\\npoints to `zp1`.\\n\\nNow, consider a removal of all the nodes _except_ `zn`. Just when\\n`tnc_delete()` is about to delete `zroot` and `zp2`:\\n\\n         zroot\\n             \\\\\\n              \\\\\\n              zp2\\n                \\\\\\n                 \\\\\\n                 zn\\n\\n`zroot` and `zp2` get freed and the tree collapses:\\n\\n           zn\\n\\n`zn` now becomes the new `zroot`.\\n\\n`get_znodes_to_commit()` will now only find `zn`, the new `zroot`, and\\n`write_index()` will check its `znode-\u003ecparent` that wrongly points to\\nthe already freed `zp1`. `ubifs_copy_hash()` thus gets wrongly called\\nwith `znode-\u003ecparent-\u003ezbranch[znode-\u003eiip].hash` that triggers the\\nuse-after-free!\\n\\nFix this by explicitly setting `znode-\u003ecparent` to `NULL` in\\n`get_znodes_to_commit()` for the root node. The search for the dirty\\nnodes\\n---truncated---\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ubifs: authentication: Fix use-after-free en ubifs_tnc_end_commit Despu\u00e9s de una inserci\u00f3n en TNC, el \u00e1rbol podr\u00eda dividirse y hacer que un nodo cambie su `znode-\u0026gt;parent`. Una eliminaci\u00f3n adicional de otros nodos en el \u00e1rbol (que tambi\u00e9n podr\u00eda liberar los nodos), el `znode-\u0026gt;cparent` del nodo mencionado anteriormente a\u00fan podr\u00eda apuntar a un nodo liberado. Este `znode-\u0026gt;cparent` puede no actualizarse al hacer que los nodos se comprometan en `ubifs_tnc_start_commit()`. Esto podr\u00eda desencadenar un use-after-free al acceder a `znode-\u0026gt;cparent` en `write_index()` en `ubifs_tnc_end_commit()`. Esto se puede activar ejecutando rm -f /etc/test-file.bin dd if=/dev/urandom of=/etc/test-file.bin bs=1M count=60 conv=fsync en un bucle y con `CONFIG_UBIFS_FS_AUTHENTICATION`. KASAN luego informa: ERROR: KASAN: use-after-free en ubifs_tnc_end_commit+0xa5c/0x1950 Escritura de tama\u00f1o 32 en la direcci\u00f3n ffffff800a3af86c por la tarea ubifs_bgt0_20/153 Rastreo de llamadas: dump_backtrace+0x0/0x340 show_stack+0x18/0x24 dump_stack_lvl+0x9c/0xbc print_address_description.constprop.0+0x74/0x2b0 kasan_report+0x1d8/0x1f0 kasan_check_range+0xf8/0x1a0 memcpy+0x84/0xf4 ubifs_tnc_end_commit+0xa5c/0x1950 Asignado por la tarea 401: kasan_save_stack+0x38/0x70 __kasan_kmalloc+0x8c/0xd0 __kmalloc+0x34c/0x5bc tnc_insert+0x140/0x16a4 ubifs_tnc_add+0x370/0x52c ubifs_jnl_write_data+0x5d8/0x870 do_writepage+0x36c/0x510 ubifs_writepage+0x190/0x4dc __writepage+0x58/0x154 escritura_cach\u00e9_p\u00e1ginas+0x394/0x830 do_writepages+0x1f0/0x5b0 filemap_fdatawrite_wbc+0x170/0x25c intervalo_de_escritura_y_espera_de_archivo+0x140/0x190 ubifs_fsync+0xe8/0x290 intervalo_de_fsync_vfs+0xc0/0x1e4 do_fsync+0x40/0x90 __arm64_sys_fsync+0x34/0x50 invocar_llamada_al_sistema.constprop.0+0xa8/0x260 do_el0_svc+0xc8/0x1f0 el0_svc+0x34/0x70 el0t_64_sync_handler+0x108/0x114 el0t_64_sync+0x1a4/0x1a8 Liberado por la tarea 403: kasan_save_stack+0x38/0x70 kasan_set_track+0x28/0x40 kasan_set_free_info+0x28/0x4c __kasan_slab_free+0xd4/0x13c kfree+0xc4/0x3a0 tnc_delete+0x3f4/0xe40 ubifs_tnc_remove_range+0x368/0x73c ubifs_tnc_remove_ino+0x29c/0x2e0 ubifs_jnl_delete_inode+0x150/0x260 ubifs_evict_inode+0x1d4/0x2e4 El `memcpy()` ofensivo en `ubifs_copy_hash()` tiene un use-after-free cuando un nodo se convierte en ra\u00edz en TNC pero a\u00fan tiene un `cparent` para un nodo ya liberado. M\u00e1s espec\u00edficamente, considere la siguiente TNC: zroot // zp1 // zn Insertar un nuevo nodo `zn_new` con una clave menor que `zn` activar\u00e1 una divisi\u00f3n en `tnc_insert()` si `zp1` est\u00e1 lleno: zroot / \\\\ / \\\\ zp1 zp2 / \\\\ / \\\\ zn_new zn `zn-\u0026gt;parent` ahora se ha movido a `zp2`, *pero* `zn-\u0026gt;cparent` todav\u00eda apunta a `zp1`. Ahora, considere una eliminaci\u00f3n de todos los nodos _excepto_ `zn`. Justo cuando `tnc_delete()` est\u00e1 a punto de eliminar `zroot` y `zp2`: zroot \\\\ \\\\ zp2 \\\\ \\\\ zn `zroot` y `zp2` se liberan y el \u00e1rbol colapsa: zn `zn` ahora se convierte en el nuevo `zroot`. `get_znodes_to_commit()` ahora solo encontrar\u00e1 `zn`, el nuevo `zroot`, y `write_index()` verificar\u00e1 su `znode-\u0026gt;cparent` que apunta err\u00f3neamente al `zp1` ya liberado. Por lo tanto, `ubifs_copy_hash()` se llama err\u00f3neamente con `znode-\u0026gt;cparent-\u0026gt;zbranch[znode-\u0026gt;iip].hash` que activa el use-after-free. Solucione esto configurando expl\u00edcitamente `znode-\u0026gt;cparent` en `NULL` en `get_znodes_to_commit()` para el nodo ra\u00edz. La b\u00fasqueda de los nodos sucios ---truncada---\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.20\",\"versionEndExcluding\":\"5.4.287\",\"matchCriteriaId\":\"E4B15788-D35E-4E5B-A9C0-070AE3729B34\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.231\",\"matchCriteriaId\":\"B5C644CC-2BD7-4E32-BC54-8DCC7ABE9935\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.174\",\"matchCriteriaId\":\"419FD073-1517-4FD5-8158-F94BC68A1E89\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.120\",\"matchCriteriaId\":\"09AC6122-E2A4-40FE-9D33-268A1B2EC265\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.64\",\"matchCriteriaId\":\"CA16DEE3-ABEC-4449-9F4A-7A3DC4FC36C7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.11.11\",\"matchCriteriaId\":\"21434379-192D-472F-9B54-D45E3650E893\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.12\",\"versionEndExcluding\":\"6.12.2\",\"matchCriteriaId\":\"D8882B1B-2ABC-4838-AC1D-DBDBB5764776\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/01d3a2293d7e4edfff96618c15727db7e51f11b6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/2497479aecebe869d23a0064e0fd1a03e34f0e2a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/398a91599d263e41c5f95a2fd4ebdb6280b5c6c3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4617fb8fc15effe8eda4dd898d4e33eb537a7140\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4d9807048b851d7a58d5bd089c16254af896e4df\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/74981f7577d183acad1cd58f74c10d263711a215\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8d8b3f5f4cbfbf6cb0ea4a4d5dc296872b4151eb\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/daac4aa1825de0dbc1a6eede2fa7f9fc53f14223\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.8, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-53171\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-02-11T15:43:44.944550Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-416\", \"description\": \"CWE-416 Use After Free\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-02-11T15:43:47.043Z\"}}], \"cna\": {\"title\": \"ubifs: authentication: Fix use-after-free in ubifs_tnc_end_commit\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"16a26b20d2afd0cf063816725b45b12e78d5bb31\", \"lessThan\": \"daac4aa1825de0dbc1a6eede2fa7f9fc53f14223\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"16a26b20d2afd0cf063816725b45b12e78d5bb31\", \"lessThan\": \"8d8b3f5f4cbfbf6cb0ea4a4d5dc296872b4151eb\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"16a26b20d2afd0cf063816725b45b12e78d5bb31\", \"lessThan\": \"4d9807048b851d7a58d5bd089c16254af896e4df\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"16a26b20d2afd0cf063816725b45b12e78d5bb31\", \"lessThan\": \"74981f7577d183acad1cd58f74c10d263711a215\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"16a26b20d2afd0cf063816725b45b12e78d5bb31\", \"lessThan\": \"01d3a2293d7e4edfff96618c15727db7e51f11b6\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"16a26b20d2afd0cf063816725b45b12e78d5bb31\", \"lessThan\": \"398a91599d263e41c5f95a2fd4ebdb6280b5c6c3\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"16a26b20d2afd0cf063816725b45b12e78d5bb31\", \"lessThan\": \"2497479aecebe869d23a0064e0fd1a03e34f0e2a\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"16a26b20d2afd0cf063816725b45b12e78d5bb31\", \"lessThan\": \"4617fb8fc15effe8eda4dd898d4e33eb537a7140\", \"versionType\": \"git\"}], \"programFiles\": [\"fs/ubifs/tnc_commit.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.20\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"4.20\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.4.287\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.231\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.174\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.120\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.64\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11.11\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.11.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12.2\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.12.*\"}, {\"status\": \"unaffected\", \"version\": \"6.13\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"fs/ubifs/tnc_commit.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/daac4aa1825de0dbc1a6eede2fa7f9fc53f14223\"}, {\"url\": \"https://git.kernel.org/stable/c/8d8b3f5f4cbfbf6cb0ea4a4d5dc296872b4151eb\"}, {\"url\": \"https://git.kernel.org/stable/c/4d9807048b851d7a58d5bd089c16254af896e4df\"}, {\"url\": \"https://git.kernel.org/stable/c/74981f7577d183acad1cd58f74c10d263711a215\"}, {\"url\": \"https://git.kernel.org/stable/c/01d3a2293d7e4edfff96618c15727db7e51f11b6\"}, {\"url\": \"https://git.kernel.org/stable/c/398a91599d263e41c5f95a2fd4ebdb6280b5c6c3\"}, {\"url\": \"https://git.kernel.org/stable/c/2497479aecebe869d23a0064e0fd1a03e34f0e2a\"}, {\"url\": \"https://git.kernel.org/stable/c/4617fb8fc15effe8eda4dd898d4e33eb537a7140\"}], \"x_generator\": {\"engine\": \"bippy-5f407fcff5a0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nubifs: authentication: Fix use-after-free in ubifs_tnc_end_commit\\n\\nAfter an insertion in TNC, the tree might split and cause a node to\\nchange its `znode-\u003eparent`. A further deletion of other nodes in the\\ntree (which also could free the nodes), the aforementioned node\u0027s\\n`znode-\u003ecparent` could still point to a freed node. This\\n`znode-\u003ecparent` may not be updated when getting nodes to commit in\\n`ubifs_tnc_start_commit()`. This could then trigger a use-after-free\\nwhen accessing the `znode-\u003ecparent` in `write_index()` in\\n`ubifs_tnc_end_commit()`.\\n\\nThis can be triggered by running\\n\\n  rm -f /etc/test-file.bin\\n  dd if=/dev/urandom of=/etc/test-file.bin bs=1M count=60 conv=fsync\\n\\nin a loop, and with `CONFIG_UBIFS_FS_AUTHENTICATION`. KASAN then\\nreports:\\n\\n  BUG: KASAN: use-after-free in ubifs_tnc_end_commit+0xa5c/0x1950\\n  Write of size 32 at addr ffffff800a3af86c by task ubifs_bgt0_20/153\\n\\n  Call trace:\\n   dump_backtrace+0x0/0x340\\n   show_stack+0x18/0x24\\n   dump_stack_lvl+0x9c/0xbc\\n   print_address_description.constprop.0+0x74/0x2b0\\n   kasan_report+0x1d8/0x1f0\\n   kasan_check_range+0xf8/0x1a0\\n   memcpy+0x84/0xf4\\n   ubifs_tnc_end_commit+0xa5c/0x1950\\n   do_commit+0x4e0/0x1340\\n   ubifs_bg_thread+0x234/0x2e0\\n   kthread+0x36c/0x410\\n   ret_from_fork+0x10/0x20\\n\\n  Allocated by task 401:\\n   kasan_save_stack+0x38/0x70\\n   __kasan_kmalloc+0x8c/0xd0\\n   __kmalloc+0x34c/0x5bc\\n   tnc_insert+0x140/0x16a4\\n   ubifs_tnc_add+0x370/0x52c\\n   ubifs_jnl_write_data+0x5d8/0x870\\n   do_writepage+0x36c/0x510\\n   ubifs_writepage+0x190/0x4dc\\n   __writepage+0x58/0x154\\n   write_cache_pages+0x394/0x830\\n   do_writepages+0x1f0/0x5b0\\n   filemap_fdatawrite_wbc+0x170/0x25c\\n   file_write_and_wait_range+0x140/0x190\\n   ubifs_fsync+0xe8/0x290\\n   vfs_fsync_range+0xc0/0x1e4\\n   do_fsync+0x40/0x90\\n   __arm64_sys_fsync+0x34/0x50\\n   invoke_syscall.constprop.0+0xa8/0x260\\n   do_el0_svc+0xc8/0x1f0\\n   el0_svc+0x34/0x70\\n   el0t_64_sync_handler+0x108/0x114\\n   el0t_64_sync+0x1a4/0x1a8\\n\\n  Freed by task 403:\\n   kasan_save_stack+0x38/0x70\\n   kasan_set_track+0x28/0x40\\n   kasan_set_free_info+0x28/0x4c\\n   __kasan_slab_free+0xd4/0x13c\\n   kfree+0xc4/0x3a0\\n   tnc_delete+0x3f4/0xe40\\n   ubifs_tnc_remove_range+0x368/0x73c\\n   ubifs_tnc_remove_ino+0x29c/0x2e0\\n   ubifs_jnl_delete_inode+0x150/0x260\\n   ubifs_evict_inode+0x1d4/0x2e4\\n   evict+0x1c8/0x450\\n   iput+0x2a0/0x3c4\\n   do_unlinkat+0x2cc/0x490\\n   __arm64_sys_unlinkat+0x90/0x100\\n   invoke_syscall.constprop.0+0xa8/0x260\\n   do_el0_svc+0xc8/0x1f0\\n   el0_svc+0x34/0x70\\n   el0t_64_sync_handler+0x108/0x114\\n   el0t_64_sync+0x1a4/0x1a8\\n\\nThe offending `memcpy()` in `ubifs_copy_hash()` has a use-after-free\\nwhen a node becomes root in TNC but still has a `cparent` to an already\\nfreed node. More specifically, consider the following TNC:\\n\\n         zroot\\n         /\\n        /\\n      zp1\\n      /\\n     /\\n    zn\\n\\nInserting a new node `zn_new` with a key smaller then `zn` will trigger\\na split in `tnc_insert()` if `zp1` is full:\\n\\n         zroot\\n         /   \\\\\\n        /     \\\\\\n      zp1     zp2\\n      /         \\\\\\n     /           \\\\\\n  zn_new          zn\\n\\n`zn-\u003eparent` has now been moved to `zp2`, *but* `zn-\u003ecparent` still\\npoints to `zp1`.\\n\\nNow, consider a removal of all the nodes _except_ `zn`. Just when\\n`tnc_delete()` is about to delete `zroot` and `zp2`:\\n\\n         zroot\\n             \\\\\\n              \\\\\\n              zp2\\n                \\\\\\n                 \\\\\\n                 zn\\n\\n`zroot` and `zp2` get freed and the tree collapses:\\n\\n           zn\\n\\n`zn` now becomes the new `zroot`.\\n\\n`get_znodes_to_commit()` will now only find `zn`, the new `zroot`, and\\n`write_index()` will check its `znode-\u003ecparent` that wrongly points to\\nthe already freed `zp1`. `ubifs_copy_hash()` thus gets wrongly called\\nwith `znode-\u003ecparent-\u003ezbranch[znode-\u003eiip].hash` that triggers the\\nuse-after-free!\\n\\nFix this by explicitly setting `znode-\u003ecparent` to `NULL` in\\n`get_znodes_to_commit()` for the root node. The search for the dirty\\nnodes\\n---truncated---\"}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2025-01-20T06:20:27.160Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-53171\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-02-11T15:45:27.208Z\", \"dateReserved\": \"2024-11-19T17:17:25.006Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-12-27T13:49:16.423Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.


Loading…

Loading…

Loading…

Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.


Loading…

Loading…