Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且供應商未提供可用的修補程式。

  - btrfs在卸載期間停止清理器 kthread 之前排清 delalloc 背景工作佇列。在卸載路徑期間於 close_ctree() 處我們先使用會釋放相關 task_struct 的 kthread_stop() 來停止清理器 kthread然後停止並破壞所有工作佇列。但是在我們停止清除器之後我們可能仍然有來自 delalloc_workers 佇列的背景工作執行 inode.c:submit_compressed_extents()這會呼叫 btrfs_add_delayed_iput()而後者會嘗試喚醒之前已經遭到破壞的清除器 kthread導致task_struct 上有一個釋放後使用問題。Syzbot 以下列堆疊追踪報告此問題並附上下列堆疊追踪錯誤KASAN在 __lock_acquire+0x78/0x2100 kernel/locking/lockdep.c:5089 讀取地址 ffff8880259d2818 的大小 8 (由 kworker/u8:3/ 作業) 52 CPU1 UID
    0 PID52 通訊kworker/u8:3 未受污染 6.13.0-rc1-syzkaller-00002-gcdd30ebb1b9f #0 硬體名稱Google Google Compute Engine/Google Compute Engine、BIOS Google 09/13/2024 工作佇列btrfs-delalloc btrfs_work_helper 呼叫追踪 <TASK> __dump_stack lib/dump_stack.c:94 [內嵌] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [內嵌] print_report+0x169/0x550 mm/kasan /report.c:489 kasan_report+0x143/0x180 mm/kasan/report.c:602 __lock_acquire+0x78/0x2100 kernel/locking/lockdep.c:5089 lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5849
    __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [內嵌] _raw_spin_lock_irqsave+0xd5/0x120 kernel/locking/spinlock.c:162 class_raw_spinlock_irqsave_constructor include/linux/spinlock.h:551 [內嵌] try_to_wake_up+0xc2/0x1470 kernel .c:4205 submit_compressed_extents+0xdf/0x16e0 fs/btrfs/inode.c:1615 run_ordered_work fs/btrfs/async-thread.c:288 [內嵌] btrfs_work_helper+0x96f/0xc40 fs/btrfs/async-thread.c:324 process_one_work kernel/workqueue.c:3229 [內嵌] process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310 worker_thread+0x870/0xd30 kernel/workqueue.c:3391 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/ 0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 </TASK> 由工作 2 分配 kasan_save_stack mm/kasan/common.c:47 [內嵌] kasan_save_track+ 0x3f/0x80 mm/kasan/common.c:68 unpoison_slab_object mm/kasan/common.c:319 [內嵌] __kasan_slab_alloc+0x66/0x80 mm/kasan/common.c:345 kasan_slab_alloc include/linu x/kasan.h:250 [內嵌] slab_post_alloc_hook mm/slub.c:4104 [內嵌] slab_alloc_node mm/slub.c:4153 [內嵌] kmem_cache_alloc_node_noprof+0x1d9/0x380 mm/slub.c:4205 alloc_task_struct_node kernel/fork.c :180 [內嵌] dup_task_struct+0x57/0x8c0 kernel/fork.c:1113 copy_process+0x5d1/0x3d50 kernel/fork.c:2225 kernel_clone+0x223/0x870 kernel/fork.c:2807 kernel_thread+0x1bc/0x240 kernel/fork。 c:2869 create_kthread kernel/kthread.c:412 [內嵌] kthreadd+0x60d/0x810 kernel/kthread.c:767 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86 /entry/entry_64.S:244 已由工作 24 釋放 kasan_save_stack mm/kasan/common.c:47 [內嵌] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 kasan_save_free_info+0x40/0x50 mm/kasan/generic .c:582 pulp_slab_object mm/kasan/common.c:247 [內嵌]
    __kasan_slab_free+0x59/0x70 mm/kasan/common.c:264 kasan_slab_free include/linux/kasan.h:233 [內嵌] slab_free_hook mm/slub.c:2338 [內嵌] slab_free mm/slub.c:4598 [內嵌] kmem_cache_free +0x195/0x410 mm/slub.c:4700 put_task_struct include/linux/sched/task.h:144 [內嵌] delayed_put_task_struct+0x125/0x300 kernel/exit.c:227 rcu_do_batch kernel/rcu/tree.c:2567 [內嵌] rcu_core+0xaaa/0x17a0 kernel/rcu/tree.c:2823 handle_softirqs+0x2d4/0x9b0 kernel/softirq.c:554 run_ksoftirqd+0xca/0x130 kernel/softirq.c:943 ---truncated--- (CVE-2024-57896)

請注意，Nessus 依賴供應商報告的套件存在。

偵測

Linux Distros 未修補的弱點：CVE-2024-57896

high Nessus Plugin ID 231592

版本 1.7