CVE-2024-50273 btrfs: reinitialize delayed ref list after deleting it from the list
A local attacker can trigger a kernel crash in the btrfs filesystem by exploiting improper list handling during delayed reference updates.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-50273?
CVE-2024-50273 is a high-severity vulnerability in Linux kernel, published on 19 Nov 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
btrfs: reinitialize delayed ref list after deleting it from the list
At insert_delayed_ref() if we need to update the action of an existing ref to BTRFS_DROP_DELAYED_REF, we delete the ref from its ref head's ref_add_list using list_del(), which leaves the ref's add_list member not reinitialized, as list_del() sets the next and prev members of the list to LIST_POISON1 and LIST_POISON2, respectively.
If later we end up calling drop_delayed_ref() against the ref, which can happen during merging or when destroying delayed refs due to a transaction abort, we can trigger a crash since at drop_delayed_ref() we call list_empty() against the ref's add_list, which returns false since the list was not reinitialized after the list_del() and as a consequence we call list_del() again at drop_delayed_ref(). This results in an invalid list access since the next and prev members are set to poison pointers, resulting in a splat if CONFIG_LIST_HARDENED and CONFIG_DEBUG_LIST are set or invalid poison pointer dereferences otherwise.
So fix this by deleting from the list with list_del_init() instead.
Weakness: CWE-908
Which versions are affected by CVE-2024-50273?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-50273?
Apply the vendor's patch.
Is CVE-2024-50273 being exploited?
There is no known exploitation of CVE-2024-50273 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-53414, AZL-53775, BELL-CVE-2024-50273, DEBIAN-CVE-2024-50273, GHSA-mf47-w2f7-gc7f, UBUNTU-CVE-2024-50273.