CVE-2024-27058 tmpfs: fix race on handling dquot rbtree
A race condition in the Linux kernel tmpfs dquot rbtree handling can cause a warning and potential denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-27058?
CVE-2024-27058 is a high-severity vulnerability in Linux kernel, published on 1 May 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
tmpfs: fix race on handling dquot rbtree
A syzkaller reproducer found a race while attempting to remove dquot information from the rb tree.
Fetching the rb_tree root node must also be protected by the dqopt->dqio_sem, otherwise, giving the right timing, shmem_release_dquot() will trigger a warning because it couldn't find a node in the tree, when the real reason was the root node changing before the search starts:
Thread 1 Thread 2 - shmem_release_dquot() - shmem_{acquire,release}_dquot()
- fetch ROOT - Fetch ROOT
- acquire dqio_sem - wait dqio_sem
- do something, triger a tree rebalance - release dqio_sem
- acquire dqio_sem - start searching for the node, but from the wrong location, missing the node, and triggering a warning.
Weakness: CWE-362
Which versions are affected by CVE-2024-27058?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-27058?
Apply the vendor's patch.
Is CVE-2024-27058 being exploited?
There is no known exploitation of CVE-2024-27058 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-40322, BELL-CVE-2024-27058, DEBIAN-CVE-2024-27058, GHSA-rr8j-q4x4-g24r, UBUNTU-CVE-2024-27058.