In the Linux kernel, the following vulnerability has been resolved:
jbd2: check 'jh->b_transaction' before removing it from checkpoint
Following process will corrupt ext4 image: Step 1: jbd2journalcommittransaction _jbd2journalinsertcheckpoint(jh, committransaction) // Put jh into trans1->tcheckpointlist journal->jcheckpointtransactions = committransaction // Put trans1 into journal->jcheckpoint_transactions
Step 2: dogetwriteaccess testclearbufferdirty(bh) // clear buffer dirty,set jbd dirty _jbd2journalfilebuffer(jh, transaction) // jh belongs to trans2
Step 3: dropcache journalshrinkonecplist jbd2journaltryremovecheckpoint if (!trylockbuffer(bh)) // lock bh, true if (bufferdirty(bh)) // buffer is not dirty _jbd2journalremovecheckpoint(jh) // remove jh from trans1->tcheckpoint_list
Step 4: jbd2logdocheckpoint trans1 = journal->jcheckpointtransactions // jh is not in trans1->tcheckpointlist jbd2cleanupjournaltail(journal) // trans1 is done
Step 5: Power cut, trans2 is not committed, jh is lost in next mounting.
Fix it by checking 'jh->b_transaction' before remove it from checkpoint.
{
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/53xxx/CVE-2023-53526.json",
"cna_assigner": "Linux"
}"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-53526.json"
[
{
"target": {
"file": "fs/jbd2/checkpoint.c"
},
"digest": {
"line_hashes": [
"176685283397653743834004843106482660365",
"189257075049711219399791668885724717432",
"312202941830415552277790787623533991950"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "CVE-2023-53526-2f45997f",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dbafe636db415299e54d9dfefc1003bda9e71c9d",
"deprecated": false,
"signature_version": "v1"
},
{
"target": {
"file": "fs/jbd2/checkpoint.c"
},
"digest": {
"line_hashes": [
"176685283397653743834004843106482660365",
"189257075049711219399791668885724717432",
"312202941830415552277790787623533991950"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "CVE-2023-53526-35f5d8cd",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ef5fea70e5915afd64182d155e72bfb4f275e1fc",
"deprecated": false,
"signature_version": "v1"
},
{
"target": {
"file": "fs/jbd2/checkpoint.c"
},
"digest": {
"line_hashes": [
"176685283397653743834004843106482660365",
"189257075049711219399791668885724717432",
"312202941830415552277790787623533991950"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "CVE-2023-53526-6e32b96c",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2298f2589903a8bc03061b54b31fd97985ab6529",
"deprecated": false,
"signature_version": "v1"
},
{
"target": {
"file": "fs/jbd2/checkpoint.c",
"function": "jbd2_journal_try_remove_checkpoint"
},
"digest": {
"length": 278.0,
"function_hash": "309009471560161742447931383648385941018"
},
"signature_type": "Function",
"id": "CVE-2023-53526-8624c651",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2298f2589903a8bc03061b54b31fd97985ab6529",
"deprecated": false,
"signature_version": "v1"
},
{
"target": {
"file": "fs/jbd2/checkpoint.c",
"function": "jbd2_journal_try_remove_checkpoint"
},
"digest": {
"length": 278.0,
"function_hash": "309009471560161742447931383648385941018"
},
"signature_type": "Function",
"id": "CVE-2023-53526-bd0fd265",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ef5fea70e5915afd64182d155e72bfb4f275e1fc",
"deprecated": false,
"signature_version": "v1"
},
{
"target": {
"file": "fs/jbd2/checkpoint.c",
"function": "jbd2_journal_try_remove_checkpoint"
},
"digest": {
"length": 278.0,
"function_hash": "309009471560161742447931383648385941018"
},
"signature_type": "Function",
"id": "CVE-2023-53526-c480344a",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@590a809ff743e7bd890ba5fb36bc38e20a36de53",
"deprecated": false,
"signature_version": "v1"
},
{
"target": {
"file": "fs/jbd2/checkpoint.c",
"function": "jbd2_journal_try_remove_checkpoint"
},
"digest": {
"length": 278.0,
"function_hash": "309009471560161742447931383648385941018"
},
"signature_type": "Function",
"id": "CVE-2023-53526-c4f15326",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dbafe636db415299e54d9dfefc1003bda9e71c9d",
"deprecated": false,
"signature_version": "v1"
},
{
"target": {
"file": "fs/jbd2/checkpoint.c"
},
"digest": {
"line_hashes": [
"176685283397653743834004843106482660365",
"189257075049711219399791668885724717432",
"312202941830415552277790787623533991950"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "CVE-2023-53526-fcf1de43",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@590a809ff743e7bd890ba5fb36bc38e20a36de53",
"deprecated": false,
"signature_version": "v1"
}
]