Executive brief
A vulnerability was identified in the Linux kernel's Btrfs file system component. This issue occurs during specific disk management operations (relocating system chunks) and can lead to a system crash or kernel panic if the file system encounters unexpected data structures. This primarily impacts system availability, potentially allowing a local user to cause a denial-of-service.
Technical details
A vulnerability exists in the Btrfs file system within the Linux kernel due to improper error handling in the btrfs_relocate_sys_chunks() function. The code previously utilized a BUG_ON() macro when encountering unexpected return values during a chunk tree lookup, which could be triggered by specific disk corruption scenarios or 'impossible' search key conditions (such as an offset of -1). An attacker with local access could potentially trigger this condition to cause a kernel panic (Denial of Service). The fix replaces the BUG_ON() with proper error handling that returns -EUCLEAN, allowing the system to handle the corruption gracefully instead of crashing. Patches have been backported to multiple stable kernel branches.
Affected products
- Linux Linux Kernel up to 4.19.312, 5.5 to 5.10.215, 6.2 to 6.6.27, 4.20 to 5.4.274, 6.7 to 6.8.6, 5.16 to 6.1.86, 5.11 to 5.15.155
Timeline
- 2024-05-19: advisory: Initial publication date
- 2024-04-13: patched: Fix committed to stable trees
References
- https://git.kernel.org/stable/c/0d23b34c68c46cd225b55868bc8a269e3134816d
- https://git.kernel.org/stable/c/1f9212cdbd005bc55f2b7422e7b560d9c02bd1da
- https://git.kernel.org/stable/c/36c2a2863bc3896243eb724dc3fd4cf9aea633f2
- https://git.kernel.org/stable/c/576164bd01bd795f8b09fb194b493103506b33c9
- https://git.kernel.org/stable/c/7411055db5ce64f836aaffd422396af0075fdc99
- https://git.kernel.org/stable/c/87299cdaae757f3f41212146cfb5b3af416b8385
- https://git.kernel.org/stable/c/bebd9e0ff90034875c5dfe4bd514fd7055fc7a89