In the Linux kernel, the following vulnerability has been resolved:
fs/aio: Restrict kiocbsetcancel_fn() to I/O submitted via libaio
If kiocbsetcancelfn() is called for I/O submitted via iouring, the following kernel warning appears:
WARNING: CPU: 3 PID: 368 at fs/aio.c:598 kiocbsetcancelfn+0x9c/0xa8 Call trace: kiocbsetcancelfn+0x9c/0xa8 ffsepfilereaditer+0x144/0x1d0 ioread+0x19c/0x498 ioissuesqe+0x118/0x27c iosubmitsqes+0x25c/0x5fc _arm64sysiouringenter+0x104/0xab0 invokesyscall+0x58/0x11c el0svccommon+0xb4/0xf4 doel0svc+0x2c/0xb0 el0svc+0x2c/0xa4 el0t64synchandler+0x68/0xb4 el0t64sync+0x1a4/0x1a8
Fix this by setting the IOCBAIORW flag for read and write I/O that is submitted by libaio.
[
{
"id": "CVE-2024-26764-0b614687",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "fs/aio.c"
},
"digest": {
"line_hashes": [
"99536233091003349665909489904918295044",
"201498155154250598929184633363714792542",
"306245904569847221581353147649063183092",
"180794455678162063841563146870191471149",
"133811386898421980710501427364211669417",
"328873246194046099872173746452304743938",
"253691179381602909179210932603288848999"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@337b543e274fe7a8f47df3c8293cc6686ffa620f"
},
{
"id": "CVE-2024-26764-1511b69e",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "fs/aio.c",
"function": "aio_prep_rw"
},
"digest": {
"function_hash": "176237230356513041053261941253672118120",
"length": 713.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1dc7d74fe456944a9b1c57bd776280249f441ac6"
},
{
"id": "CVE-2024-26764-16673a54",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "fs/aio.c",
"function": "aio_prep_rw"
},
"digest": {
"function_hash": "186192465210734681174156225460907041158",
"length": 774.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b4eea7a05ee0ab5ab0514421e6ba8c5d249cf942"
},
{
"id": "CVE-2024-26764-20b94436",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "fs/aio.c"
},
"digest": {
"line_hashes": [
"99536233091003349665909489904918295044",
"201498155154250598929184633363714792542",
"306245904569847221581353147649063183092",
"180794455678162063841563146870191471149",
"133811386898421980710501427364211669417",
"328873246194046099872173746452304743938",
"253691179381602909179210932603288848999"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ea1cd64d59f22d6d13f367d62ec6e27b9344695f"
},
{
"id": "CVE-2024-26764-2231170e",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "fs/aio.c",
"function": "kiocb_set_cancel_fn"
},
"digest": {
"function_hash": "291338349373790618086886440464268366138",
"length": 398.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ea1cd64d59f22d6d13f367d62ec6e27b9344695f"
},
{
"id": "CVE-2024-26764-2e8eb949",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "fs/aio.c",
"function": "aio_prep_rw"
},
"digest": {
"function_hash": "176237230356513041053261941253672118120",
"length": 713.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b820de741ae48ccf50dd95e297889c286ff4f760"
},
{
"id": "CVE-2024-26764-30a38bb4",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "fs/aio.c"
},
"digest": {
"line_hashes": [
"99536233091003349665909489904918295044",
"201498155154250598929184633363714792542",
"306245904569847221581353147649063183092",
"180794455678162063841563146870191471149",
"133811386898421980710501427364211669417",
"328873246194046099872173746452304743938",
"253691179381602909179210932603288848999"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d7b6fa97ec894edd02f64b83e5e72e1aa352f353"
},
{
"id": "CVE-2024-26764-34ea770c",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "fs/aio.c",
"function": "aio_prep_rw"
},
"digest": {
"function_hash": "308453317256645361465509258703893941519",
"length": 796.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@337b543e274fe7a8f47df3c8293cc6686ffa620f"
},
{
"id": "CVE-2024-26764-43174663",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "fs/aio.c",
"function": "kiocb_set_cancel_fn"
},
"digest": {
"function_hash": "291338349373790618086886440464268366138",
"length": 398.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b4eea7a05ee0ab5ab0514421e6ba8c5d249cf942"
},
{
"id": "CVE-2024-26764-45fdf9f1",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "fs/aio.c",
"function": "kiocb_set_cancel_fn"
},
"digest": {
"function_hash": "291338349373790618086886440464268366138",
"length": 398.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@337b543e274fe7a8f47df3c8293cc6686ffa620f"
},
{
"id": "CVE-2024-26764-60092d55",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "fs/aio.c"
},
"digest": {
"line_hashes": [
"99536233091003349665909489904918295044",
"201498155154250598929184633363714792542",
"306245904569847221581353147649063183092",
"180794455678162063841563146870191471149",
"133811386898421980710501427364211669417",
"328873246194046099872173746452304743938",
"253691179381602909179210932603288848999"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b4eea7a05ee0ab5ab0514421e6ba8c5d249cf942"
},
{
"id": "CVE-2024-26764-615a1e02",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "fs/aio.c",
"function": "aio_prep_rw"
},
"digest": {
"function_hash": "176237230356513041053261941253672118120",
"length": 713.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@18f614369def2a11a52f569fe0f910b199d13487"
},
{
"id": "CVE-2024-26764-9851d7d3",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "fs/aio.c",
"function": "aio_prep_rw"
},
"digest": {
"function_hash": "176237230356513041053261941253672118120",
"length": 713.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e7e23fc5d5fe422827c9a43ecb579448f73876c7"
},
{
"id": "CVE-2024-26764-9aa6009b",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "fs/aio.c",
"function": "kiocb_set_cancel_fn"
},
"digest": {
"function_hash": "291338349373790618086886440464268366138",
"length": 398.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e7e23fc5d5fe422827c9a43ecb579448f73876c7"
},
{
"id": "CVE-2024-26764-c322549f",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "fs/aio.c"
},
"digest": {
"line_hashes": [
"99536233091003349665909489904918295044",
"201498155154250598929184633363714792542",
"306245904569847221581353147649063183092",
"157314208609685149032662107880773351678",
"323443454134929613308376017702503239673",
"134573652735939558110086208417703875927",
"84705991484840412483197998145028170944"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@18f614369def2a11a52f569fe0f910b199d13487"
},
{
"id": "CVE-2024-26764-c5eb6eb6",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "fs/aio.c",
"function": "kiocb_set_cancel_fn"
},
"digest": {
"function_hash": "291338349373790618086886440464268366138",
"length": 398.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d7b6fa97ec894edd02f64b83e5e72e1aa352f353"
},
{
"id": "CVE-2024-26764-ccce3be9",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "fs/aio.c"
},
"digest": {
"line_hashes": [
"99536233091003349665909489904918295044",
"201498155154250598929184633363714792542",
"306245904569847221581353147649063183092",
"157314208609685149032662107880773351678",
"323443454134929613308376017702503239673",
"134573652735939558110086208417703875927",
"84705991484840412483197998145028170944"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1dc7d74fe456944a9b1c57bd776280249f441ac6"
},
{
"id": "CVE-2024-26764-d36036c3",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "fs/aio.c"
},
"digest": {
"line_hashes": [
"99536233091003349665909489904918295044",
"201498155154250598929184633363714792542",
"306245904569847221581353147649063183092",
"157314208609685149032662107880773351678",
"323443454134929613308376017702503239673",
"134573652735939558110086208417703875927",
"84705991484840412483197998145028170944"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e7e23fc5d5fe422827c9a43ecb579448f73876c7"
},
{
"id": "CVE-2024-26764-d55870ec",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "fs/aio.c",
"function": "kiocb_set_cancel_fn"
},
"digest": {
"function_hash": "291338349373790618086886440464268366138",
"length": 398.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b820de741ae48ccf50dd95e297889c286ff4f760"
},
{
"id": "CVE-2024-26764-dd2080f5",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "fs/aio.c",
"function": "kiocb_set_cancel_fn"
},
"digest": {
"function_hash": "291338349373790618086886440464268366138",
"length": 398.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1dc7d74fe456944a9b1c57bd776280249f441ac6"
},
{
"id": "CVE-2024-26764-e4e11685",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "fs/aio.c",
"function": "kiocb_set_cancel_fn"
},
"digest": {
"function_hash": "291338349373790618086886440464268366138",
"length": 398.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@18f614369def2a11a52f569fe0f910b199d13487"
},
{
"id": "CVE-2024-26764-e7a4142b",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "fs/aio.c"
},
"digest": {
"line_hashes": [
"99536233091003349665909489904918295044",
"201498155154250598929184633363714792542",
"306245904569847221581353147649063183092",
"157314208609685149032662107880773351678",
"323443454134929613308376017702503239673",
"134573652735939558110086208417703875927",
"84705991484840412483197998145028170944"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b820de741ae48ccf50dd95e297889c286ff4f760"
},
{
"id": "CVE-2024-26764-f2ee6d67",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "fs/aio.c",
"function": "aio_prep_rw"
},
"digest": {
"function_hash": "186192465210734681174156225460907041158",
"length": 774.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d7b6fa97ec894edd02f64b83e5e72e1aa352f353"
},
{
"id": "CVE-2024-26764-f8c9a221",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "fs/aio.c",
"function": "aio_prep_rw"
},
"digest": {
"function_hash": "186192465210734681174156225460907041158",
"length": 774.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ea1cd64d59f22d6d13f367d62ec6e27b9344695f"
}
]