CVE-2024-41078 btrfs: qgroup: fix quota root leak after quota disable failure
A memory leak in the Linux kernel Btrfs filesystem can lead to resource exhaustion and denial of service when quota disabling fails.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-41078?
CVE-2024-41078 is a medium-severity memory corruption vulnerability in Linux kernel, published on 29 Jul 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
btrfs: qgroup: fix quota root leak after quota disable failure
If during the quota disable we fail when cleaning the quota tree or when deleting the root from the root tree, we jump to the 'out' label without ever dropping the reference on the quota root, resulting in a leak of the root since fs_info->quota_root is no longer pointing to the root (we have set it to NULL just before those steps).
Fix this by always doing a btrfs_put_root() call under the 'out' label. This is a problem that exists since qgroups were first added in 2012 by commit bed92eae26cc ("Btrfs: qgroup implementation and prototypes"), but back then we missed a kfree on the quota root and free_extent_buffer() calls on its root and commit root nodes, since back then roots were not yet reference counted.
Weakness: CWE-401
Which versions are affected by CVE-2024-41078?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-41078?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2024-41078 being exploited?
There is no known exploitation of CVE-2024-41078 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2024-41078, DEBIAN-CVE-2024-41078, GHSA-pw84-w4v5-39jj, UBUNTU-CVE-2024-41078.