Executive brief
A vulnerability in the Linux kernel's Btrfs file system could allow a local user to potentially access sensitive system information. The issue occurs during specific file system operations where internal memory addresses might be exposed through error messages. While the risk of a full system takeover is low, this information could be used to facilitate more complex attacks.
Technical details
A vulnerability exists in the Btrfs 'send' implementation within the Linux kernel, specifically in the 'iterate_inode_ref()' function. The code previously used a 'BUG_ON' macro when encountering a path buffer underflow, which could lead to a kernel panic or the accidental printing of kernel pointers in error logs (CWE-209). An attacker with local access could trigger this condition to leak kernel memory addresses, potentially aiding in bypassing KASLR. The fix replaces the 'BUG_ON' with proper error handling and ensures that sensitive pointers are not included in the resulting error messages. Patches have been backported to multiple stable kernel branches including 4.19, 5.4, 5.10, 5.15, 6.1, and 6.6.
Affected products
- Linux Linux Kernel up to 4.19.312, 4.20 to 5.4.274, 5.5 to 5.10.215, 5.11 to 5.15.155, 5.16 to 6.1.86, 6.2 to 6.6.27, 6.7 to 6.8.6
Timeline
- 2024-02-06: other: Vulnerability fixed in source code
- 2024-05-19: advisory: CVE published by NVD
References
- https://git.kernel.org/stable/c/024529c27c8b4b273325a169e078337c8279e229
- https://git.kernel.org/stable/c/03938619a1e718b6168ae4528e1b0f979293f1a5
- https://git.kernel.org/stable/c/2f6174fd4ccf403b42b3d5f0d1b6b496a0e5330a
- https://git.kernel.org/stable/c/3c6ee34c6f9cd12802326da26631232a61743501
- https://git.kernel.org/stable/c/4720d590c4cb5d9ffa0060b89743651cc7e995f9
- https://git.kernel.org/stable/c/9ae356c627b493323e1433dcb27a26917668c07c
- https://git.kernel.org/stable/c/be2b6bcc936ae17f42fff6494106a5660b35d8d3