243 lines
14 KiB
JSON
243 lines
14 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2025-68774",
|
|
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "Linux",
|
|
"dateReserved": "2025-12-24T10:30:51.035Z",
|
|
"datePublished": "2026-01-13T15:28:51.379Z",
|
|
"dateUpdated": "2026-08-05T12:11:24.278Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"providerMetadata": {
|
|
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"shortName": "Linux",
|
|
"dateUpdated": "2026-08-05T12:11:24.278Z"
|
|
},
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nhfsplus: fix missing hfs_bnode_get() in __hfs_bnode_create\n\nWhen sync() and link() are called concurrently, both threads may\nenter hfs_bnode_find() without finding the node in the hash table\nand proceed to create it.\n\nThread A:\n hfsplus_write_inode()\n -> hfsplus_write_system_inode()\n -> hfs_btree_write()\n -> hfs_bnode_find(tree, 0)\n -> __hfs_bnode_create(tree, 0)\n\nThread B:\n hfsplus_create_cat()\n -> hfs_brec_insert()\n -> hfs_bnode_split()\n -> hfs_bmap_alloc()\n -> hfs_bnode_find(tree, 0)\n -> __hfs_bnode_create(tree, 0)\n\nIn this case, thread A creates the bnode, sets refcnt=1, and hashes it.\nThread B also tries to create the same bnode, notices it has already\nbeen inserted, drops its own instance, and uses the hashed one without\ngetting the node.\n\n```\n\n\tnode2 = hfs_bnode_findhash(tree, cnid);\n\tif (!node2) { <- Thread A\n\t\thash = hfs_bnode_hash(cnid);\n\t\tnode->next_hash = tree->node_hash[hash];\n\t\ttree->node_hash[hash] = node;\n\t\ttree->node_hash_cnt++;\n\t} else { <- Thread B\n\t\tspin_unlock(&tree->hash_lock);\n\t\tkfree(node);\n\t\twait_event(node2->lock_wq,\n\t\t\t!test_bit(HFS_BNODE_NEW, &node2->flags));\n\t\treturn node2;\n\t}\n```\n\nHowever, hfs_bnode_find() requires each call to take a reference.\nHere both threads end up setting refcnt=1. When they later put the node,\nthis triggers:\n\nBUG_ON(!atomic_read(&node->refcnt))\n\nIn this scenario, Thread B in fact finds the node in the hash table\nrather than creating a new one, and thus must take a reference.\n\nFix this by calling hfs_bnode_get() when reusing a bnode newly created by\nanother thread to ensure the refcount is updated correctly.\n\nA similar bug was fixed in HFS long ago in commit\na9dc087fd3c4 (\"fix missing hfs_bnode_get() in __hfs_bnode_create\")\nbut the same issue remained in HFS+ until now."
|
|
}
|
|
],
|
|
"metrics": [
|
|
{
|
|
"cvssV3_1": {
|
|
"version": "3.1",
|
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
|
|
"baseScore": 7.5,
|
|
"baseSeverity": "HIGH"
|
|
},
|
|
"scenarios": [
|
|
{
|
|
"lang": "en",
|
|
"value": "AV:N - A guest-writable ksmbd share backed by HFS+ lets a remote SMB2 client issue FILE_LINK_INFORMATION, which reaches hfsplus_link() and the vulnerable B-tree allocation path.\nAC:L - The attacker can prime the catalog B-tree and drive concurrent hard-link operations and dirty writeback; no uncontrollable memory layout or rare configuration is required.\nPR:N - A guest-writable SMB share permits an anonymous session to operate as a write-capable guest identity without credentials or capabilities.\nUI:N - Once the HFS+ volume is mounted and exported, attacker requests and kernel writeback trigger the race without victim action.\nS:U - The vulnerability and resulting kernel failure remain within the host kernel's security authority and do not cross a virtualization or isolation boundary.\nC:N - The losing creator frees only its private duplicate, while the shared header node remains hashed; the bug provides no information-disclosure primitive.\nI:N - The raced node is the non-deletable B-tree header, and BUG_ON occurs before a negative decrement, so there is no demonstrated UAF, arbitrary write, or memory corruption.\nA:H - The missing reference causes a subsequent hfs_bnode_put() to hit BUG_ON and oops a writeback worker, potentially panicking the entire host when panic-on-oops is enabled."
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "unaffected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"fs/hfsplus/bnode.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
|
|
"lessThan": "3b0fc7af50b896d0f3d104e70787ba1973bc0b56",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
|
|
"lessThan": "39e149d58ef4d7883cbf87448d39d51292fd342d",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
|
|
"lessThan": "b68dc4134b18a3922cd33439ec614aad4172bc86",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
|
|
"lessThan": "b9d1c6bb5f19460074ce9862cb80be86b5fb0a50",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
|
|
"lessThan": "457f795e7abd7770de10216d7f9994a3f12a56d6",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
|
|
"lessThan": "5882e7c8cdbb5e254a69628b780acff89c78071e",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
|
|
"lessThan": "152af114287851583cf7e0abc10129941f19466a",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "affected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"fs/hfsplus/bnode.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "2.6.12",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "0",
|
|
"lessThan": "2.6.12",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "5.10.248",
|
|
"lessThanOrEqual": "5.10.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "5.15.198",
|
|
"lessThanOrEqual": "5.15.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.1.160",
|
|
"lessThanOrEqual": "6.1.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.6.120",
|
|
"lessThanOrEqual": "6.6.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.12.64",
|
|
"lessThanOrEqual": "6.12.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.18.3",
|
|
"lessThanOrEqual": "6.18.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.19",
|
|
"lessThanOrEqual": "*",
|
|
"status": "unaffected",
|
|
"versionType": "original_commit_for_fix"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"cpeApplicability": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "2.6.12",
|
|
"versionEndExcluding": "5.10.248"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "2.6.12",
|
|
"versionEndExcluding": "5.15.198"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "2.6.12",
|
|
"versionEndExcluding": "6.1.160"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "2.6.12",
|
|
"versionEndExcluding": "6.6.120"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "2.6.12",
|
|
"versionEndExcluding": "6.12.64"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "2.6.12",
|
|
"versionEndExcluding": "6.18.3"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "2.6.12",
|
|
"versionEndExcluding": "6.19"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/3b0fc7af50b896d0f3d104e70787ba1973bc0b56"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/39e149d58ef4d7883cbf87448d39d51292fd342d"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/b68dc4134b18a3922cd33439ec614aad4172bc86"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/b9d1c6bb5f19460074ce9862cb80be86b5fb0a50"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/457f795e7abd7770de10216d7f9994a3f12a56d6"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/5882e7c8cdbb5e254a69628b780acff89c78071e"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/152af114287851583cf7e0abc10129941f19466a"
|
|
}
|
|
],
|
|
"title": "hfsplus: fix missing hfs_bnode_get() in __hfs_bnode_create",
|
|
"x_generator": {
|
|
"engine": "bippy-1.2.0"
|
|
}
|
|
}
|
|
}
|
|
} |