Johannes Thumshirn

Name of the Vulnerable Software and Affected Versions: Linux kernel (affected versions not specified) Description: A vulnerability in the Linux kernel has been resolved, related to the btrfs file system. The issue occurs when updating the action of an existing reference to BTRFS DROP DELAYED REF, which deletes the reference from its list using `list del()`. This leaves the reference's `add list` member not reinitialized, causing a crash when `drop delayed ref()` is called later. The crash happens because `list empty()` returns false due to the list not being reinitialized after `list del()`, leading to an invalid list access. This results in a splat if `CONFIG LIST HARDENED` and `CONFIG DEBUG LIST` are set, or invalid poison pointer dereferences otherwise. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

اسم البرنامج المعرض للخطر والإصدارات المتأثرة: إصدارات نواة لينكس الأقدم من 6.6.74 الوصف: تم إصلاح ثغرة أمنية في نواة لينكس، وتحديدًا في وحدة btrfs. تتعلق المشكلة بتعطل تكراري محتمل تم اكتشافه عند تشغيل fstests btrfs/011 مع MKFS OPTIONS="-O rst". وقد يؤدي ذلك إلى حدوث حالة تعطل تام. تنشأ هذه الثغرة الأمنية عندما يحاول الوحدة النمطية btrfs الحصول على قفل (lock) تحتفظ به المهمة بالفعل. تتضمن التفاصيل الفنية حول استغلال الثغرة الدالة `btrfs map block()` والقفل `dev replace.rwsem`. التوصيات: لحل المشكلة، قم بتحديث نواة لينكس إلى الإصدار 6.6.74 أو أحدث. كحل مؤقت، يُنصح بتعطيل الدالة `btrfs dev replace by ioctl()` حتى يتوفر تصحيح. قم بتقييد الوصول إلى الدالة `btrfs map block()` لتقليل مخاطر الاستغلال. تجنب استخدام قفل `dev replace.rwsem` في نقاط نهاية واجهة برمجة التطبيقات (API) المتأثرة حتى يتم حل المشكلة.

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.10.0-rc7+ Description: The issue arises when the Linux kernel's btrfs filesystem is backed by a RAID stripe tree and readahead is performed on the relocation inode. This can lead to an ENOENT error due to preallocated extents not being mapped in the RST, causing the readahead to submit invalid reads to the device. As a result, an assertion occurs in the scatter-gather list code, leading to a kernel bug. The ` blk rq map sg` function is involved in this process, and the error can cause the system to crash. Recommendations: To resolve this issue, update the Linux kernel to a version newer than 6.10.0-rc7+. As a temporary workaround, consider disabling the readahead on relocation inode for btrfs filesystems to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Linux kernel (affected versions not specified) Description: The issue is related to a memory leak in the btrfs component of the Linux kernel. When `btrfs qgroup reserve data()` or `btrfs delalloc reserve metadata()` fail, the allocated `extent changeset` is not freed, leading to a memory leak. This issue only occurs in the direct IO write path, specifically after a certain commit (`65b3c08606e5`) that fixed an ENOSPC failure when attempting direct IO write into a NOCOW range, and also at `defrag one locked target()`. The memory leak can cause problems, but the exact impact is not specified. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue is related to a use-after-free vulnerability in the btrfs load zone info() function, which can be triggered by a race condition with a device replace operation. This happens because the function extracts a device from the chunk map into a local variable and then uses the device while not under the protection of the device replace rwsem. If a device replace operation occurs while the device is being extracted and the device is the source of the replace operation, a use-after-free can be triggered if the replace operation finishes and frees the device before the function finishes using it. The estimated number of potentially affected devices worldwide is not available. There is no information about real-world incidents where this issue was exploited.

The issue allows local users to read or write to arbitrary kernel memory locations or cause a denial of service by leveraging access to a /dev/sg device. This is due to the blk rq map user iov function in block/blk-map.c not properly restricting the type of iterator, leading to potential use-after-free conditions.