CVE-2024-56780

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

quota: flush quota_release_work upon quota writeback

One of the paths quota writeback is called from is:

freeze_super()

sync_filesystem()

ext4_sync_fs()

dquot_writeback_dquots()

Since we currently don't always flush the quota_release_work queue in

this path, we can end up with the following race:

1. dquot are added to releasing_dquots list during regular operations.

2. FS Freeze starts, however, this does not flush the quota_release_work queue.

3. Freeze completes.

4. Kernel eventually tries to flush the workqueue while FS is frozen which

hits a WARN_ON since transaction gets started during frozen state:

ext4_journal_check_start+0x28/0x110 [ext4] (unreliable)

__ext4_journal_start_sb+0x64/0x1c0 [ext4]

ext4_release_dquot+0x90/0x1d0 [ext4]

quota_release_workfn+0x43c/0x4d0

Which is the following line:

WARN_ON(sb->s_writers.frozen == SB_FREEZE_COMPLETE);

Which ultimately results in gen

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References