Junglewise Threat Intelligence

CVE-2024-35936: Linux Kernel Btrfs denial of service in btrfs_relocate_sys_chunks

CVE-2024-35936 · Severity: medium · CVSS 5.5 · Published 2024-05-19

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability was identified in the Linux kernel's Btrfs file system component. This issue occurs during specific disk management operations (relocating system chunks) and can lead to a system crash or kernel panic if the file system encounters unexpected data structures. This primarily impacts system availability, potentially allowing a local user to cause a denial-of-service.

Technical details

A vulnerability exists in the Btrfs file system within the Linux kernel due to improper error handling in the btrfs_relocate_sys_chunks() function. The code previously utilized a BUG_ON() macro when encountering unexpected return values during a chunk tree lookup, which could be triggered by specific disk corruption scenarios or 'impossible' search key conditions (such as an offset of -1). An attacker with local access could potentially trigger this condition to cause a kernel panic (Denial of Service). The fix replaces the BUG_ON() with proper error handling that returns -EUCLEAN, allowing the system to handle the corruption gracefully instead of crashing. Patches have been backported to multiple stable kernel branches.

Affected products

  • Linux Linux Kernel up to 4.19.312, 5.5 to 5.10.215, 6.2 to 6.6.27, 4.20 to 5.4.274, 6.7 to 6.8.6, 5.16 to 6.1.86, 5.11 to 5.15.155

Timeline

  • 2024-05-19: advisory: Initial publication date
  • 2024-04-13: patched: Fix committed to stable trees

References

Related threats