Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

fstec логотип

BDU:2025-00868

Опубликовано: 12 июн. 2024
Источник: fstec
CVSS3: 5.5
CVSS2: 4.6
EPSS Низкий

Описание

Уязвимость функций blk_flush_complete_seq() и flush_end_io() компонента block (block/blk-flush.c) ядра операционных систем Linux связана с неправильной инициализацией. Эксплуатация уязвимости может позволить нарушителю вызвать отказ в обслуживании

Вендор

ООО «Ред Софт»
Red Hat Inc.
Novell Inc.
Canonical Ltd.
Сообщество свободного программного обеспечения
ООО «РусБИТех-Астра»
АО "НППКТ"

Наименование ПО

РЕД ОС
Red Hat Enterprise Linux
Suse Linux Enterprise Desktop
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Module for Basesystem
Ubuntu
SUSE Linux Enterprise Workstation Extension
OpenSUSE Leap
SUSE Linux Enterprise Module for Development Tools
Linux
Astra Linux Special Edition
SUSE Linux Enterprise High Availability Extension
SUSE Linux Enterprise Live Patching
SUSE Linux Enterprise Module for Public Cloud
SUSE Real Time Module
ОСОН ОСнова Оnyx

Версия ПО

7.3 (РЕД ОС)
9 (Red Hat Enterprise Linux)
15 SP6 (Suse Linux Enterprise Desktop)
15 SP6 (SUSE Linux Enterprise Server for SAP Applications)
15 SP6 (SUSE Linux Enterprise High Performance Computing)
15 SP6 (SUSE Linux Enterprise Module for Basesystem)
24.04 LTS (Ubuntu)
15 SP6 (SUSE Linux Enterprise Workstation Extension)
15.6 (OpenSUSE Leap)
15 SP6 (SUSE Linux Enterprise Module for Development Tools)
от 6.7 до 6.9.5 включительно (Linux)
1.8 (Astra Linux Special Edition)
15 SP6 (SUSE Linux Enterprise High Availability Extension)
15 SP6 (SUSE Linux Enterprise Live Patching)
15 SP6 (SUSE Linux Enterprise Module for Public Cloud)
15 SP6 (SUSE Real Time Module)
от 6.6 до 6.6.34 включительно (Linux)
до 2.12 (ОСОН ОСнова Оnyx)

Тип ПО

Операционная система
Прикладное ПО информационных систем

Операционные системы и аппаратные платформы

ООО «Ред Софт» РЕД ОС 7.3
Red Hat Inc. Red Hat Enterprise Linux 9
Novell Inc. Suse Linux Enterprise Desktop 15 SP6
Novell Inc. SUSE Linux Enterprise Server for SAP Applications 15 SP6
Canonical Ltd. Ubuntu 24.04 LTS
Novell Inc. OpenSUSE Leap 15.6
ООО «РусБИТех-Астра» Astra Linux Special Edition 1.8
Сообщество свободного программного обеспечения Linux от 6.10 до 6.10 rc4
Сообщество свободного программного обеспечения Linux от 6.6.0 до 6.6.35
Сообщество свободного программного обеспечения Linux от 6.9.0 до 6.9.6
АО "НППКТ" ОСОН ОСнова Оnyx до 2.12

Уровень опасности уязвимости

Средний уровень опасности (базовая оценка CVSS 2.0 составляет 4,6)
Средний уровень опасности (базовая оценка CVSS 3.0 составляет 5,5)

Возможные меры по устранению уязвимости

В условиях отсутствия обновлений безопасности от производителя рекомендуется придерживаться "Рекомендаций по безопасной настройке операционных систем LINUX", изложенных в методическом документе ФСТЭК России, утверждённом 25 декабря 2022 года.
Использование рекомендаций:
Для Linux:
https://lore.kernel.org/linux-cve-announce/2024071214-CVE-2024-40925-d411@gregkh/
https://git.kernel.org/stable/c/87907bd69721a8506618a954d41a1de3040e88aa
https://git.kernel.org/stable/c/d0321c812d89c5910d8da8e4b10c891c6b96ff70
https://git.kernel.org/stable/c/fe1e395563ccb051e9dbd8fa99859f5caaad2e71
Для РедОС:
http://repo.red-soft.ru/redos/7.3c/x86_64/updates/
Для программных продуктов Ubuntu:
https://ubuntu.com/security/CVE-2024-40925
Для программных продуктов Red Hat Inc.:
https://access.redhat.com/security/cve/CVE-2024-40925
Для программных продуктов Novell Inc.:
https://www.suse.com/security/cve/CVE-2024-40925.html
Обновление программного обеспечения linux до версии 6.6.66-0.osnova2u1
Для ОС Astra Linux:
- обновить пакет linux-6.6 до 6.12.11-1.astra1+ci18 или более высокой версии, используя рекомендации производителя: https://wiki.astralinux.ru/astra-linux-se18-bulletin-2025-0411SE18

Статус уязвимости

Подтверждена производителем

Наличие эксплойта

Данные уточняются

Информация об устранении

Уязвимость устранена

Идентификаторы других систем описаний уязвимостей

EPSS

Процентиль: 31%
0.00116
Низкий

5.5 Medium

CVSS3

4.6 Medium

CVSS2

Связанные уязвимости

ubuntu
11 месяцев назад

In the Linux kernel, the following vulnerability has been resolved: block: fix request.queuelist usage in flush Friedrich Weber reported a kernel crash problem and bisected to commit 81ada09cc25e ("blk-flush: reuse rq queuelist in flush state machine"). The root cause is that we use "list_move_tail(&rq->queuelist, pending)" in the PREFLUSH/POSTFLUSH sequences. But rq->queuelist.next == xxx since it's popped out from plug->cached_rq in __blk_mq_alloc_requests_batch(). We don't initialize its queuelist just for this first request, although the queuelist of all later popped requests will be initialized. Fix it by changing to use "list_add_tail(&rq->queuelist, pending)" so rq->queuelist doesn't need to be initialized. It should be ok since rq can't be on any list when PREFLUSH or POSTFLUSH, has no move actually. Please note the commit 81ada09cc25e ("blk-flush: reuse rq queuelist in flush state machine") also has another requirement that no drivers would touch rq->queuelist after bl...

CVSS3: 5.5
redhat
11 месяцев назад

In the Linux kernel, the following vulnerability has been resolved: block: fix request.queuelist usage in flush Friedrich Weber reported a kernel crash problem and bisected to commit 81ada09cc25e ("blk-flush: reuse rq queuelist in flush state machine"). The root cause is that we use "list_move_tail(&rq->queuelist, pending)" in the PREFLUSH/POSTFLUSH sequences. But rq->queuelist.next == xxx since it's popped out from plug->cached_rq in __blk_mq_alloc_requests_batch(). We don't initialize its queuelist just for this first request, although the queuelist of all later popped requests will be initialized. Fix it by changing to use "list_add_tail(&rq->queuelist, pending)" so rq->queuelist doesn't need to be initialized. It should be ok since rq can't be on any list when PREFLUSH or POSTFLUSH, has no move actually. Please note the commit 81ada09cc25e ("blk-flush: reuse rq queuelist in flush state machine") also has another requirement that no drivers would touch rq->queuelist after blk_mq_...

nvd
11 месяцев назад

In the Linux kernel, the following vulnerability has been resolved: block: fix request.queuelist usage in flush Friedrich Weber reported a kernel crash problem and bisected to commit 81ada09cc25e ("blk-flush: reuse rq queuelist in flush state machine"). The root cause is that we use "list_move_tail(&rq->queuelist, pending)" in the PREFLUSH/POSTFLUSH sequences. But rq->queuelist.next == xxx since it's popped out from plug->cached_rq in __blk_mq_alloc_requests_batch(). We don't initialize its queuelist just for this first request, although the queuelist of all later popped requests will be initialized. Fix it by changing to use "list_add_tail(&rq->queuelist, pending)" so rq->queuelist doesn't need to be initialized. It should be ok since rq can't be on any list when PREFLUSH or POSTFLUSH, has no move actually. Please note the commit 81ada09cc25e ("blk-flush: reuse rq queuelist in flush state machine") also has another requirement that no drivers would touch rq->queuelist after blk_m

debian
11 месяцев назад

In the Linux kernel, the following vulnerability has been resolved: b ...

github
11 месяцев назад

In the Linux kernel, the following vulnerability has been resolved: block: fix request.queuelist usage in flush Friedrich Weber reported a kernel crash problem and bisected to commit 81ada09cc25e ("blk-flush: reuse rq queuelist in flush state machine"). The root cause is that we use "list_move_tail(&rq->queuelist, pending)" in the PREFLUSH/POSTFLUSH sequences. But rq->queuelist.next == xxx since it's popped out from plug->cached_rq in __blk_mq_alloc_requests_batch(). We don't initialize its queuelist just for this first request, although the queuelist of all later popped requests will be initialized. Fix it by changing to use "list_add_tail(&rq->queuelist, pending)" so rq->queuelist doesn't need to be initialized. It should be ok since rq can't be on any list when PREFLUSH or POSTFLUSH, has no move actually. Please note the commit 81ada09cc25e ("blk-flush: reuse rq queuelist in flush state machine") also has another requirement that no drivers would touch rq->queuelist after bl...

EPSS

Процентиль: 31%
0.00116
Низкий

5.5 Medium

CVSS3

4.6 Medium

CVSS2

Уязвимость BDU:2025-00868