CVE-2024-56581

See a problem?
Please try reporting it to the source first.

Source

https://nvd.nist.gov/vuln/detail/CVE-2024-56581

Import Source

https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-56581.json

JSON Data

https://api.test.osv.dev/v1/vulns/CVE-2024-56581

Related

Published

2024-12-27T15:15:17Z

Modified

2025-03-04T03:49:56.470017Z

Severity

7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

[none]

Details

In the Linux kernel, the following vulnerability has been resolved:

btrfs: ref-verify: fix use-after-free after invalid ref action

At btrfsreftreemod() after we successfully inserted the new ref entry (local variable 'ref') into the respective block entry's rbtree (local variable 'be'), if we find an unexpected action of BTRFSDROPDELAYEDREF, we error out and free the ref entry without removing it from the block entry's rbtree. Then in the error path of btrfsreftreemod() we call btrfsfreerefcache(), which iterates over all block entries and then calls freeblockentry() for each one, and there we will trigger a use-after-free when we are called against the block entry to which we added the freed ref entry to its rbtree, since the rbtree still points to the block entry, as we didn't remove it from the rbtree before freeing it in the error path at btrfsreftree_mod(). Fix this by removing the new ref entry from the rbtree before freeing it.

Syzbot report this with the following stack traces:

BTRFS error (device loop0 state EA): Ref action 2, root 5, refroot 0, parent 8564736, owner 0, offset 0, numrefs 18446744073709551615 _btrfsmodref+0x7dd/0xac0 fs/btrfs/extent-tree.c:2523 updaterefforcow+0x9cd/0x11f0 fs/btrfs/ctree.c:512 btrfsforcecowblock+0x9f6/0x1da0 fs/btrfs/ctree.c:594 btrfscowblock+0x35e/0xa40 fs/btrfs/ctree.c:754 btrfssearchslot+0xbdd/0x30d0 fs/btrfs/ctree.c:2116 btrfsinsertemptyitems+0x9c/0x1a0 fs/btrfs/ctree.c:4314 btrfsinsertemptyitem fs/btrfs/ctree.h:669 [inline] btrfsinsertorphanitem+0x1f1/0x320 fs/btrfs/orphan.c:23 btrfsorphanadd+0x6d/0x1a0 fs/btrfs/inode.c:3482 btrfsunlink+0x267/0x350 fs/btrfs/inode.c:4293 vfsunlink+0x365/0x650 fs/namei.c:4469 dounlinkat+0x4ae/0x830 fs/namei.c:4533 _dosysunlinkat fs/namei.c:4576 [inline] _sesysunlinkat fs/namei.c:4569 [inline] _x64sysunlinkat+0xcc/0xf0 fs/namei.c:4569 dosyscallx64 arch/x86/entry/common.c:52 [inline] dosyscall64+0xf3/0x230 arch/x86/entry/common.c:83 entrySYSCALL64afterhwframe+0x77/0x7f BTRFS error (device loop0 state EA): Ref action 1, root 5, refroot 5, parent 0, owner 260, offset 0, numrefs 1 _btrfsmodref+0x76b/0xac0 fs/btrfs/extent-tree.c:2521 updaterefforcow+0x96a/0x11f0 btrfsforcecowblock+0x9f6/0x1da0 fs/btrfs/ctree.c:594 btrfscowblock+0x35e/0xa40 fs/btrfs/ctree.c:754 btrfssearchslot+0xbdd/0x30d0 fs/btrfs/ctree.c:2116 btrfslookupinode+0xdc/0x480 fs/btrfs/inode-item.c:411 _btrfsupdatedelayedinode+0x1e7/0xb90 fs/btrfs/delayed-inode.c:1030 btrfsupdatedelayedinode fs/btrfs/delayed-inode.c:1114 [inline] _btrfscommitinodedelayeditems+0x2318/0x24a0 fs/btrfs/delayed-inode.c:1137 _btrfsrundelayeditems+0x213/0x490 fs/btrfs/delayed-inode.c:1171 btrfscommittransaction+0x8a8/0x3740 fs/btrfs/transaction.c:2313 preparetorelocate+0x3c4/0x4c0 fs/btrfs/relocation.c:3586 relocateblockgroup+0x16c/0xd40 fs/btrfs/relocation.c:3611 btrfsrelocateblockgroup+0x77d/0xd90 fs/btrfs/relocation.c:4081 btrfsrelocatechunk+0x12c/0x3b0 fs/btrfs/volumes.c:3377 _btrfsbalance+0x1b0f/0x26b0 fs/btrfs/volumes.c:4161 btrfsbalance+0xbdc/0x10c0 fs/btrfs/volumes.c:4538 BTRFS error (device loop0 state EA): Ref action 2, root 5, refroot 0, parent 8564736, owner 0, offset 0, numrefs 18446744073709551615 _btrfsmodref+0x7dd/0xac0 fs/btrfs/extent-tree.c:2523 updaterefforcow+0x9cd/0x11f0 fs/btrfs/ctree.c:512 btrfsforcecowblock+0x9f6/0x1da0 fs/btrfs/ctree.c:594 btrfscowblock+0x35e/0xa40 fs/btrfs/ctree.c:754 btrfssearchslot+0xbdd/0x30d0 fs/btrfs/ctree.c:2116 btrfslookupinode+0xdc/0x480 fs/btrfs/inode-item.c:411 _btrfsupdatedelayedinode+0x1e7/0xb90 fs/btrfs/delayed-inode.c:1030 btrfsupdatedelayed_i ---truncated---

References

Affected packages

Debian:11 / linux

Package

Name: linux
Purl: pkg:deb/debian/linux?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

5.10.234-1

Affected versions

5.*

5.10.46-4

5.10.46-5

5.10.70-1~bpo10+1

5.10.70-1

5.10.84-1

5.10.92-1~bpo10+1

5.10.92-1

5.10.92-2

5.10.103-1~bpo10+1

5.10.103-1

5.10.106-1

5.10.113-1

5.10.120-1~bpo10+1

5.10.120-1

5.10.127-1

5.10.127-2~bpo10+1

5.10.127-2

5.10.136-1

5.10.140-1

5.10.148-1

5.10.149-1

5.10.149-2

5.10.158-1

5.10.158-2

5.10.162-1

5.10.178-1

5.10.178-2

5.10.178-3

5.10.179-1

5.10.179-2

5.10.179-3

5.10.179-4

5.10.179-5

5.10.191-1

5.10.197-1

5.10.205-1

5.10.205-2

5.10.209-1

5.10.209-2

5.10.216-1

5.10.218-1

5.10.221-1

5.10.223-1

5.10.226-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:12 / linux

Package

Name: linux
Purl: pkg:deb/debian/linux?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

6.1.123-1

Affected versions

6.*

6.1.27-1

6.1.37-1

6.1.38-1

6.1.38-2~bpo11+1

6.1.38-2

6.1.38-3

6.1.38-4~bpo11+1

6.1.38-4

6.1.52-1

6.1.55-1~bpo11+1

6.1.55-1

6.1.64-1

6.1.66-1

6.1.67-1

6.1.69-1~bpo11+1

6.1.69-1

6.1.76-1~bpo11+1

6.1.76-1

6.1.82-1

6.1.85-1

6.1.90-1~bpo11+1

6.1.90-1

6.1.94-1~bpo11+1

6.1.94-1

6.1.98-1

6.1.99-1

6.1.106-1

6.1.106-2

6.1.106-3

6.1.112-1

6.1.115-1

6.1.119-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:13 / linux

Package

Name: linux
Purl: pkg:deb/debian/linux?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

6.12.5-1

Affected versions

6.*

6.1.27-1

6.1.37-1

6.1.38-1

6.1.38-2~bpo11+1

6.1.38-2

6.1.38-3

6.1.38-4~bpo11+1

6.1.38-4

6.1.52-1

6.1.55-1~bpo11+1

6.1.55-1

6.1.64-1

6.1.66-1

6.1.67-1

6.1.69-1~bpo11+1

6.1.69-1

6.1.76-1~bpo11+1

6.1.76-1

6.1.82-1

6.1.85-1

6.1.90-1~bpo11+1

6.1.90-1

6.1.94-1~bpo11+1

6.1.94-1

6.1.98-1

6.1.99-1

6.1.106-1

6.1.106-2

6.1.106-3

6.1.112-1

6.1.115-1

6.1.119-1

6.1.123-1

6.1.124-1

6.1.128-1

6.3.1-1~exp1

6.3.2-1~exp1

6.3.4-1~exp1

6.3.5-1~exp1

6.3.7-1~bpo12+1

6.3.7-1

6.3.11-1

6.4~rc6-1~exp1

6.4~rc7-1~exp1

6.4.1-1~exp1

6.4.4-1~bpo12+1

6.4.4-1

6.4.4-2

6.4.4-3~bpo12+1

6.4.4-3

6.4.11-1

6.4.13-1

6.5~rc4-1~exp1

6.5~rc6-1~exp1

6.5~rc7-1~exp1

6.5.1-1~exp1

6.5.3-1~bpo12+1

6.5.3-1

6.5.6-1

6.5.8-1

6.5.10-1~bpo12+1

6.5.10-1

6.5.13-1

6.6.3-1~exp1

6.6.4-1~exp1

6.6.7-1~exp1

6.6.8-1

6.6.9-1

6.6.11-1

6.6.13-1~bpo12+1

6.6.13-1

6.6.15-1

6.6.15-2

6.7-1~exp1

6.7.1-1~exp1

6.7.4-1~exp1

6.7.7-1

6.7.9-1

6.7.9-2

6.7.12-1~bpo12+1

6.7.12-1

6.8.9-1

6.8.11-1

6.8.12-1~bpo12+1

6.8.12-1

6.9.2-1~exp1

6.9.7-1~bpo12+1

6.9.7-1

6.9.8-1

6.9.9-1

6.9.10-1~bpo12+1

6.9.10-1

6.9.11-1

6.9.12-1

6.10-1~exp1

6.10.1-1~exp1

6.10.3-1

6.10.4-1

6.10.6-1~bpo12+1

6.10.6-1

6.10.7-1

6.10.9-1

6.10.11-1~bpo12+1

6.10.11-1

6.10.12-1

6.11~rc4-1~exp1

6.11~rc5-1~exp1

6.11-1~exp1

6.11.2-1

6.11.4-1

6.11.5-1~bpo12+1

6.11.5-1

6.11.6-1

6.11.7-1

6.11.9-1

6.11.10-1~bpo12+1

6.11.10-1

6.12~rc6-1~exp1

6.12.3-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:11 / linux-6.1

Package

Name: linux-6.1
Purl: pkg:deb/debian/linux-6.1?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

6.1.128-1~deb11u1

Affected versions

6.*

6.1.106-3~deb11u1

6.1.106-3~deb11u2

6.1.106-3~deb11u3

6.1.112-1~deb11u1

6.1.119-1~deb11u1

Ecosystem specific

{
    "urgency": "not yet assigned"
}