Description
In the Linux kernel, the following vulnerability has been resolved: ima: return error early if file xattr cannot be changed During early boot, the filesystem is read-only and any changes to xattrs are not allowed. This fails in case of ext4 because changing xattr starts an ext4 transaction which fails with the following warning. WARNING: fs/ext4/ext4_jbd2.c:75 at ext4_journal_check_start+0x63/0xa0 [ext4], CPU#1: systemd-sysroot/561 CPU: 1 UID: 0 PID: 561 Comm: systemd-sysroot Not tainted 6.19.12-1-default #1 PREEMPT(voluntary) openSUSE Tumbleweed c2dfc3c9d9f6f1233251c5d4410574fe82a348ee Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS unknown 02/02/2022 RIP: 0010:ext4_journal_check_start+0x63/0xa0 [ext4] Call Trace: __ext4_journal_start_sb+0x3e/0x180 [ext4 6d025f3bc52c89a957b89a89d211fadf5e9434e1] ext4_xattr_set+0x104/0x150 [ext4 6d025f3bc52c89a957b89a89d211fadf5e9434e1] __vfs_setxattr+0x9a/0xd0 __vfs_setxattr_noperm+0x76/0x1f0 ima_appraise_measurement+0x23e/0xe40 ima_d_path+0x5a/0xd0 process_measurement+0xb29/0xc40 ? copy_from_kernel_nofault+0x21/0xe0 ? fscrypt_file_open+0xc0/0xe0 ? ext4_file_open+0x60/0x490 [ext4 6d025f3bc52c89a957b89a89d211fadf5e9434e1] ? bpf_prog_31efb7c56239148b_restrict_filesystems+0xab/0x126 ? __bpf_prog_exit+0x23/0xd0 ? __bpf_tramp_exit+0xd/0x50 ? bpf_trampoline_6442530367+0x9f/0xea ima_file_check+0x57/0x80 security_file_post_open+0x50/0xf0 path_openat+0x493/0x1650 do_filp_open+0xc7/0x170 Detect the state of the file early and return the error.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
07f6a79415d7d502ee0c7d02ace6594a7be7429a to < 86acb68ebb220b83def94e7f4c33e24e843970e0affected07f6a79415d7d502ee0c7d02ace6594a7be7429a to < 4d98295357bcacb70874e73117e298a9d7d9b830affected07f6a79415d7d502ee0c7d02ace6594a7be7429a to < c6988714c0549e06610635c7a71e88635da6db64affected07f6a79415d7d502ee0c7d02ace6594a7be7429a to < 8c77312728d07b60fc028f676e42d842df918bcdaffected07f6a79415d7d502ee0c7d02ace6594a7be7429a to < dce1b66fcfb40c935f426f602c3a41a7b9f62ba4affected07f6a79415d7d502ee0c7d02ace6594a7be7429a to < 2f29f880e98bf0087215726c45a485afd15b42cfaffected07f6a79415d7d502ee0c7d02ace6594a7be7429a to < 69fc6474236d9edda6983623e4282f2bdfd8e3d8affected
Linux Linux
Default version status: affected
3.7affected0 to < 3.7unaffected5.10.271 to ≤ 5.10.*unaffected5.15.222 to ≤ 5.15.*unaffected6.1.189 to ≤ 6.1.*unaffected6.6.158 to ≤ 6.6.*unaffected6.12.111 to ≤ 6.12.*unaffected6.18.53 to ≤ 6.18.*unaffected7.2 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/86acb68ebb220b83def94e7f4c33e24e843970e0 ↗
- https://git.kernel.org/stable/c/4d98295357bcacb70874e73117e298a9d7d9b830 ↗
- https://git.kernel.org/stable/c/c6988714c0549e06610635c7a71e88635da6db64 ↗
- https://git.kernel.org/stable/c/8c77312728d07b60fc028f676e42d842df918bcd ↗
- https://git.kernel.org/stable/c/dce1b66fcfb40c935f426f602c3a41a7b9f62ba4 ↗
- https://git.kernel.org/stable/c/2f29f880e98bf0087215726c45a485afd15b42cf ↗
- https://git.kernel.org/stable/c/69fc6474236d9edda6983623e4282f2bdfd8e3d8 ↗