CVE-2024-35793 - OpenCVE

In the Linux kernel, the following vulnerability has been resolved: debugfs: fix wait/cancellation handling during remove Ben Greear further reports deadlocks during concurrent debugfs remove while files are being accessed, even though the code in question now uses debugfs cancellations. Turns out that despite all the review on the locking, we missed completely that the logic is wrong: if the refcount hits zero we can finish (and need not wait for the completion), but if it doesn't we have to trigger all the cancellations. As written, we can _never_ get into the loop triggering the cancellations. Fix this, and explain it better while at it.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

No data.

No data.

No data.

References

Link	Providers
https://git.kernel.org/stable/c/3d08cca5fd0aabb62b7015067ab40913b33da906
https://git.kernel.org/stable/c/952c3fce297f12c7ff59380adb66b564e2bc9b64
https://git.kernel.org/stable/c/e88b5ae01901c4a655a53158397746334778a57b
https://lore.kernel.org/linux-cve-announce/2024051709-CVE-2024-35793-6171@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2024-35793
https://www.cve.org/CVERecord?id=CVE-2024-35793

History

Tue, 22 Oct 2024 02:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-833

Thu, 12 Sep 2024 20:30:00 +0000

Type	Values Removed	Values Added
Metrics	ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Wed, 11 Sep 2024 13:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2024-05-17T12:24:56.630Z

Updated: 2024-11-05T09:22:28.117Z

Reserved: 2024-05-17T12:19:12.339Z

Link: CVE-2024-35793

Vulnrichment

Updated: 2024-08-02T03:21:47.366Z

NVD

Status : Awaiting Analysis

Published: 2024-05-17T13:15:59.023

Modified: 2024-05-17T18:35:35.070

Link: CVE-2024-35793

Redhat

Severity : Moderate

Publid Date: 2024-05-17T00:00:00Z

Links: CVE-2024-35793 - Bugzilla

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-35793", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-05-17T12:19:12.339Z", "datePublished": "2024-05-17T12:24:56.630Z", "dateUpdated": "2024-11-05T09:22:28.117Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2024-11-05T09:22:28.117Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndebugfs: fix wait/cancellation handling during remove\n\nBen Greear further reports deadlocks during concurrent debugfs\nremove while files are being accessed, even though the code in\nquestion now uses debugfs cancellations. Turns out that despite\nall the review on the locking, we missed completely that the\nlogic is wrong: if the refcount hits zero we can finish (and\nneed not wait for the completion), but if it doesn't we have\nto trigger all the cancellations. As written, we can _never_\nget into the loop triggering the cancellations. Fix this, and\nexplain it better while at it."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/debugfs/inode.c"], "versions": [{"version": "8c88a474357e", "lessThan": "e88b5ae01901", "status": "affected", "versionType": "git"}, {"version": "8c88a474357e", "lessThan": "3d08cca5fd0a", "status": "affected", "versionType": "git"}, {"version": "8c88a474357e", "lessThan": "952c3fce297f", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/debugfs/inode.c"], "versions": [{"version": "6.7", "status": "affected"}, {"version": "0", "lessThan": "6.7", "status": "unaffected", "versionType": "semver"}, {"version": "6.7.12", "lessThanOrEqual": "6.7.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.8.3", "lessThanOrEqual": "6.8.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.9", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "references": [{"url": "https://git.kernel.org/stable/c/e88b5ae01901c4a655a53158397746334778a57b"}, {"url": "https://git.kernel.org/stable/c/3d08cca5fd0aabb62b7015067ab40913b33da906"}, {"url": "https://git.kernel.org/stable/c/952c3fce297f12c7ff59380adb66b564e2bc9b64"}], "title": "debugfs: fix wait/cancellation handling during remove", "x_generator": {"engine": "bippy-9e1c9544281a"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T03:21:47.366Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/e88b5ae01901c4a655a53158397746334778a57b", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/3d08cca5fd0aabb62b7015067ab40913b33da906", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/952c3fce297f12c7ff59380adb66b564e2bc9b64", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-35793", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T15:42:47.871301Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T17:33:22.657Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/e88b5ae01901c4a655a53158397746334778a57b", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/3d08cca5fd0aabb62b7015067ab40913b33da906", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/952c3fce297f12c7ff59380adb66b564e2bc9b64", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T03:21:47.366Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-35793", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T15:42:47.871301Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T12:42:16.398Z"}}], "cna": {"title": "debugfs: fix wait/cancellation handling during remove", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "8c88a474357e", "lessThan": "e88b5ae01901", "versionType": "git"}, {"status": "affected", "version": "8c88a474357e", "lessThan": "3d08cca5fd0a", "versionType": "git"}, {"status": "affected", "version": "8c88a474357e", "lessThan": "952c3fce297f", "versionType": "git"}], "programFiles": ["fs/debugfs/inode.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.7"}, {"status": "unaffected", "version": "0", "lessThan": "6.7", "versionType": "custom"}, {"status": "unaffected", "version": "6.7.12", "versionType": "custom", "lessThanOrEqual": "6.7.*"}, {"status": "unaffected", "version": "6.8.3", "versionType": "custom", "lessThanOrEqual": "6.8.*"}, {"status": "unaffected", "version": "6.9", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["fs/debugfs/inode.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/e88b5ae01901c4a655a53158397746334778a57b"}, {"url": "https://git.kernel.org/stable/c/3d08cca5fd0aabb62b7015067ab40913b33da906"}, {"url": "https://git.kernel.org/stable/c/952c3fce297f12c7ff59380adb66b564e2bc9b64"}], "x_generator": {"engine": "bippy-a5840b7849dd"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndebugfs: fix wait/cancellation handling during remove\n\nBen Greear further reports deadlocks during concurrent debugfs\nremove while files are being accessed, even though the code in\nquestion now uses debugfs cancellations. Turns out that despite\nall the review on the locking, we missed completely that the\nlogic is wrong: if the refcount hits zero we can finish (and\nneed not wait for the completion), but if it doesn't we have\nto trigger all the cancellations. As written, we can _never_\nget into the loop triggering the cancellations. Fix this, and\nexplain it better while at it."}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2024-05-29T05:29:04.149Z"}}}, "cveMetadata": {"cveId": "CVE-2024-35793", "state": "PUBLISHED", "dateUpdated": "2024-09-11T17:33:22.657Z", "dateReserved": "2024-05-17T12:19:12.339Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-05-17T12:24:56.630Z", "assignerShortName": "Linux"}, "dataVersion": "5.1"}

{"bugzilla": {"description": "kernel: debugfs: fix wait/cancellation handling during remove", "id": "2281047", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2281047"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-833", "details": ["In the Linux kernel, the following vulnerability has been resolved:\ndebugfs: fix wait/cancellation handling during remove\nBen Greear further reports deadlocks during concurrent debugfs\nremove while files are being accessed, even though the code in\nquestion now uses debugfs cancellations. Turns out that despite\nall the review on the locking, we missed completely that the\nlogic is wrong: if the refcount hits zero we can finish (and\nneed not wait for the completion), but if it doesn't we have\nto trigger all the cancellations. As written, we can _never_\nget into the loop triggering the cancellations. Fix this, and\nexplain it better while at it.", "A flaw was found in the debugfs module in the Linux kernel. A deadlock can be triggered when files are removed and accessed, resulting in a denial of service."], "name": "CVE-2024-35793", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-05-17T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-35793\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-35793\nhttps://lore.kernel.org/linux-cve-announce/2024051709-CVE-2024-35793-6171@gregkh/T"], "statement": "The debugfs module in the Linux kernel as shipped in Red Hat Enterprise Linux 8 and 9 is not affected by this vulnerability because the vulnerable code was introduced in a newer version of the Linux kernel.", "threat_severity": "Moderate", "upstream_fix": "kernel 6.7.12, kernel 6.8.3, kernel 6.9"}