PT-2024-8436

CVE-2024-27080

تاريخ النشر

2024-03-05

تاريخ التحديث

2025-03-28

الوصف من

CVSS 3.1

4.7

متوسطة

المقاييسAV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The issue is related to a race condition in the btrfs file system when detecting delalloc ranges during fiemap. This can lead to missing delalloc ranges for file regions that are currently holes, causing the caller of fiemap to be unaware of data in some file regions. This can be serious for use cases like the cp program in coreutils versions before 9.0, which used fiemap to detect holes and data in the source file. If cp was used with a source file that had delalloc in a hole, the destination file could end up without that data, resulting in a data loss issue.

Technical details about exploitation include:

The fiemap function is called without the FIEMAP FLAG SYNC flag for a file with delalloc in a range that is currently a hole.
The fiemap function locks the inode in shared mode and iterates the inode's subvolume tree searching for file extent items without having the whole fiemap target range locked in the inode's io tree.
The btrfs find delalloc in range() function is used to search for delalloc by checking for the EXTENT DELALLOC bit in the io tree for the range and ordered extents.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

قابلية الاستغلال

استغلال

التأثيرات

الباحثون

Filipe Manana

المورّدون