A vulnerability has been identified and resolved in the Linux kernel, specifically related to the netfs/fscache. The vulnerability stemmed from a missing memory barrier between a bit-clearing operation and a wake-up operation in the fscache_create_volume() function. This could potentially cause an indefinite wait in certain situations. In this post, we will dive into the details of the vulnerability, its potential impact, and the fix implemented to address it.
Exploit Details
This issue could be triggered as follows, involving two cookies named cookie1 and cookie2, as well as a volume work process, all sharing the same volume.
The process execution flow is as follows
[cookie1] [cookie2] [volume_work]
fscache_perform_lookup
fscache_create_volume
fscache_perform_lookup
fscache_create_volume
fscache_create_volume_work
cachefiles_acquire_volume
clear_and_wake_up_bit
test_and_set_bit
test_and_set_bit
goto maybe_wait
goto no_wait
In the above scenario, when cookie1 enters the *-no_wait-* process, it clears the bit and wakes up the waiting process. However, if a memory barrier is missing between these operations, cookie2 might remain indefinitely in the *-wait-* process.
It's worth noting that in commit 3288666c7256 ("fscache: Use clear_and_wake_up_bit() in fscache_create_volume_work()"), memory barriers were added to similar operations in fscache_create_volume_work(), but fscache_create_volume() was missed.
Resolution
To fix this issue, the developers combined the clear and wake operations into the clear_and_wake_up_bit() function, effectively resolving the vulnerability caused by the missing memory barrier. This ensures that the correct memory order is maintained and the waiting process is woken up as intended.
Original References
The original commit that fixed this issue could be found at Linux Kernel Git Commit - Fix Missing Memory Barrier.
Conclusion
The Linux kernel vulnerability (CVE-2024-56755) in netfs/fscache has been resolved by adding a missing memory barrier for FSCACHE_VOLUME_CREATING in the fscache_create_volume() function. Developers and system administrators should ensure they are using a kernel version with this fix applied to avoid the potential impacts of this vulnerability.
Timeline
Published on: 12/29/2024 12:15:09 UTC
Last modified on: 01/06/2025 20:26:39 UTC