CVE-2024-35832
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2024-35832
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-35832.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2024-35832
- Downstream
- Published
- 2024-05-17T13:48:20.877Z
- Modified
- 2025-11-15T19:47:45.323004Z
- Summary
- bcachefs: kvfree bch_fs::snapshots in bch2_fs_snapshots_exit
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
bcachefs: kvfree bchfs::snapshots in bch2fssnapshotsexit
bchfs::snapshots is allocated by kvzalloc in _snapshottmut. It should be freed by kvfree not kfree. Or umount will triger:
[ 406.829178 ] BUG: unable to handle page fault for address: ffffe7b487148008 [ 406.830676 ] #PF: supervisor read access in kernel mode [ 406.831643 ] #PF: errorcode(0x0000) - not-present page [ 406.832487 ] PGD 0 P4D 0 [ 406.832898 ] Oops: 0000 [#1] PREEMPT SMP PTI [ 406.833512 ] CPU: 2 PID: 1754 Comm: umount Kdump: loaded Tainted: G OE 6.7.0-rc7-custom+ #90 [ 406.834746 ] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux 1.16.3-1-1 04/01/2014 [ 406.835796 ] RIP: 0010:kfree+0x62/0x140 [ 406.836197 ] Code: 80 48 01 d8 0f 82 e9 00 00 00 48 c7 c2 00 00 00 80 48 2b 15 78 9f 1f 01 48 01 d0 48 c1 e8 0c 48 c1 e0 06 48 03 05 56 9f 1f 01 <48> 8b 50 08 48 89 c7 f6 c2 01 0f 85 b0 00 00 00 66 90 48 8b 07 f6 [ 406.837810 ] RSP: 0018:ffffb9d641607e48 EFLAGS: 00010286 [ 406.838213 ] RAX: ffffe7b487148000 RBX: ffffb9d645200000 RCX: ffffb9d641607dc4 [ 406.838738 ] RDX: 000065bb00000000 RSI: ffffffffc0d88b84 RDI: ffffb9d645200000 [ 406.839217 ] RBP: ffff9a4625d00068 R08: 0000000000000001 R09: 0000000000000001 [ 406.839650 ] R10: 0000000000000001 R11: 000000000000001f R12: ffff9a4625d4da80 [ 406.840055 ] R13: ffff9a4625d00000 R14: ffffffffc0e2eb20 R15: 0000000000000000 [ 406.840451 ] FS: 00007f0a264ffb80(0000) GS:ffff9a4e2d500000(0000) knlGS:0000000000000000 [ 406.840851 ] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 406.841125 ] CR2: ffffe7b487148008 CR3: 000000018c4d2000 CR4: 00000000000006f0 [ 406.841464 ] Call Trace: [ 406.841583 ] <TASK> [ 406.841682 ] ? _die+0x1f/0x70 [ 406.841828 ] ? pagefaultoops+0x159/0x470 [ 406.842014 ] ? fixupexception+0x22/0x310 [ 406.842198 ] ? excpagefault+0x1ed/0x200 [ 406.842382 ] ? asmexcpagefault+0x22/0x30 [ 406.842574 ] ? bch2fsrelease+0x54/0x280 [bcachefs] [ 406.842842 ] ? kfree+0x62/0x140 [ 406.842988 ] ? kfree+0x104/0x140 [ 406.843138 ] bch2fsrelease+0x54/0x280 [bcachefs] [ 406.843390 ] kobjectput+0xb7/0x170 [ 406.843552 ] deactivatelockedsuper+0x2f/0xa0 [ 406.843756 ] cleanupmnt+0xba/0x150 [ 406.843917 ] taskworkrun+0x59/0xa0 [ 406.844083 ] exittousermodeprepare+0x197/0x1a0 [ 406.844302 ] syscallexittousermode+0x16/0x40 [ 406.844510 ] dosyscall64+0x4e/0xf0 [ 406.844675 ] entrySYSCALL64afterhwframe+0x6e/0x76 [ 406.844907 ] RIP: 0033:0x7f0a2664e4fb
- References
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced1c6fdbd8f2465ddfb73a01ec620cbf3d14044e1aFixed56590678791119b9a655202e49898edfb9307271
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced1c6fdbd8f2465ddfb73a01ec620cbf3d14044e1aFixed369acf97d6fd5da620d053d0f1878ffe32eff555
Affected versions
v6.*
Database specific
vanir_signatures
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@369acf97d6fd5da620d053d0f1878ffe32eff555",
"signature_version": "v1",
"signature_type": "Line",
"id": "CVE-2024-35832-241cc85a",
"target": {
"file": "fs/bcachefs/snapshot.c"
},
"digest": {
"line_hashes": [
"66995957614701497119175498339209555686",
"176516682045514627223022268575169912629"
],
"threshold": 0.9
},
"deprecated": false
}
]