CVE-2024-50217 btrfs: fix use-after-free of block device file in __btrfs_free_extra_devids()
A use-after-free in the Linux kernel btrfs filesystem allows local attackers to potentially execute code or escalate privileges via crafted mount sequences.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-50217?
CVE-2024-50217 is a high-severity use after free vulnerability in Linux kernel, published on 9 Nov 2024. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
In the Linux kernel, the following vulnerability has been resolved:
btrfs: fix use-after-free of block device file in __btrfs_free_extra_devids()
Mounting btrfs from two images (which have the same one fsid and two different dev_uuids) in certain executing order may trigger an UAF for variable 'device->bdev_file' in __btrfs_free_extra_devids(). And following are the details:
1. Attach image_1 to loop0, attach image_2 to loop1, and scan btrfs devices by ioctl(BTRFS_IOC_SCAN_DEV):
/ btrfs_device_1 → loop0 fs_device \ btrfs_device_2 → loop1 2. mount /dev/loop0 /mnt btrfs_open_devices btrfs_device_1->bdev_file = btrfs_get_bdev_and_sb(loop0) btrfs_device_2->bdev_file = btrfs_get_bdev_and_sb(loop1) btrfs_fill_super open_ctree fail: btrfs_close_devices // -ENOMEM btrfs_close_bdev(btrfs_device_1) fput(btrfs_device_1->bdev_file) // btrfs_device_1->bdev_file is freed btrfs_close_bdev(btrfs_device_2) fput(btrfs_device_2->bdev_file)
3. mount /dev/loop1 /mnt btrfs_open_devices btrfs_get_bdev_and_sb(&bdev_file) // EIO, btrfs_device_1->bdev_file is not assigned, // which points to a freed memory area btrfs_device_2->bdev_file = btrfs_get_bdev_and_sb(loop1) btrfs_fill_super open_ctree btrfs_free_extra_devids if (btrfs_device_1->bdev_file) fput(btrfs_device_1->bdev_file) // UAF !
Fix it by setting 'device->bdev_file' as 'NULL' after closing the btrfs_device in btrfs_close_one_device().
Weakness: CWE-416
Which versions are affected by CVE-2024-50217?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-50217?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2024-50217 being exploited?
There is no known exploitation of CVE-2024-50217 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-53057, AZL-53096, BELL-CVE-2024-50217, DEBIAN-CVE-2024-50217, GHSA-5684-4xfg-mxj4, ROOT-OS-DEBIAN-11-CVE-2024-50217 and 4 more.