Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2024-56581— btrfs: ref-verify: fix use-after-free after invalid ref action

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于btrfs文件系统中释放后重用问题。

CVSS 7.0 · High EPSS 0.24% · P15

Affected Version Matrix 16

VendorProduct Version RangeStatus
Linux Linux fd708b81d972a0714b02a60eb4792fdbf15868c4< dfb9fe7de61f34cc241ab3900bdde93341096e0e affected
fd708b81d972a0714b02a60eb4792fdbf15868c4< 6fd018aa168e472ce35be32296d109db6adb87ea affected
fd708b81d972a0714b02a60eb4792fdbf15868c4< d2b85ce0561fde894e28fa01bd5d32820d585006 affected
fd708b81d972a0714b02a60eb4792fdbf15868c4< 6370db28af9a8ae3bbdfe97f8a48f8f995e144cf affected
fd708b81d972a0714b02a60eb4792fdbf15868c4< 4275ac2741941c9c7c2293619fdbacb9f70ba85b affected
fd708b81d972a0714b02a60eb4792fdbf15868c4< a6f9e7a0bf1185c9070c0de03bb85eafb9abd650 affected
fd708b81d972a0714b02a60eb4792fdbf15868c4< 7c4e39f9d2af4abaf82ca0e315d1fd340456620f affected
4.15 affected
… +8 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2024-56581

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
btrfs: ref-verify: fix use-after-free after invalid ref action
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: btrfs: ref-verify: fix use-after-free after invalid ref action At btrfs_ref_tree_mod() after we successfully inserted the new ref entry (local variable 'ref') into the respective block entry's rbtree (local variable 'be'), if we find an unexpected action of BTRFS_DROP_DELAYED_REF, we error out and free the ref entry without removing it from the block entry's rbtree. Then in the error path of btrfs_ref_tree_mod() we call btrfs_free_ref_cache(), which iterates over all block entries and then calls free_block_entry() for each one, and there we will trigger a use-after-free when we are called against the block entry to which we added the freed ref entry to its rbtree, since the rbtree still points to the block entry, as we didn't remove it from the rbtree before freeing it in the error path at btrfs_ref_tree_mod(). Fix this by removing the new ref entry from the rbtree before freeing it. Syzbot report this with the following stack traces: BTRFS error (device loop0 state EA): Ref action 2, root 5, ref_root 0, parent 8564736, owner 0, offset 0, num_refs 18446744073709551615 __btrfs_mod_ref+0x7dd/0xac0 fs/btrfs/extent-tree.c:2523 update_ref_for_cow+0x9cd/0x11f0 fs/btrfs/ctree.c:512 btrfs_force_cow_block+0x9f6/0x1da0 fs/btrfs/ctree.c:594 btrfs_cow_block+0x35e/0xa40 fs/btrfs/ctree.c:754 btrfs_search_slot+0xbdd/0x30d0 fs/btrfs/ctree.c:2116 btrfs_insert_empty_items+0x9c/0x1a0 fs/btrfs/ctree.c:4314 btrfs_insert_empty_item fs/btrfs/ctree.h:669 [inline] btrfs_insert_orphan_item+0x1f1/0x320 fs/btrfs/orphan.c:23 btrfs_orphan_add+0x6d/0x1a0 fs/btrfs/inode.c:3482 btrfs_unlink+0x267/0x350 fs/btrfs/inode.c:4293 vfs_unlink+0x365/0x650 fs/namei.c:4469 do_unlinkat+0x4ae/0x830 fs/namei.c:4533 __do_sys_unlinkat fs/namei.c:4576 [inline] __se_sys_unlinkat fs/namei.c:4569 [inline] __x64_sys_unlinkat+0xcc/0xf0 fs/namei.c:4569 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f BTRFS error (device loop0 state EA): Ref action 1, root 5, ref_root 5, parent 0, owner 260, offset 0, num_refs 1 __btrfs_mod_ref+0x76b/0xac0 fs/btrfs/extent-tree.c:2521 update_ref_for_cow+0x96a/0x11f0 btrfs_force_cow_block+0x9f6/0x1da0 fs/btrfs/ctree.c:594 btrfs_cow_block+0x35e/0xa40 fs/btrfs/ctree.c:754 btrfs_search_slot+0xbdd/0x30d0 fs/btrfs/ctree.c:2116 btrfs_lookup_inode+0xdc/0x480 fs/btrfs/inode-item.c:411 __btrfs_update_delayed_inode+0x1e7/0xb90 fs/btrfs/delayed-inode.c:1030 btrfs_update_delayed_inode fs/btrfs/delayed-inode.c:1114 [inline] __btrfs_commit_inode_delayed_items+0x2318/0x24a0 fs/btrfs/delayed-inode.c:1137 __btrfs_run_delayed_items+0x213/0x490 fs/btrfs/delayed-inode.c:1171 btrfs_commit_transaction+0x8a8/0x3740 fs/btrfs/transaction.c:2313 prepare_to_relocate+0x3c4/0x4c0 fs/btrfs/relocation.c:3586 relocate_block_group+0x16c/0xd40 fs/btrfs/relocation.c:3611 btrfs_relocate_block_group+0x77d/0xd90 fs/btrfs/relocation.c:4081 btrfs_relocate_chunk+0x12c/0x3b0 fs/btrfs/volumes.c:3377 __btrfs_balance+0x1b0f/0x26b0 fs/btrfs/volumes.c:4161 btrfs_balance+0xbdc/0x10c0 fs/btrfs/volumes.c:4538 BTRFS error (device loop0 state EA): Ref action 2, root 5, ref_root 0, parent 8564736, owner 0, offset 0, num_refs 18446744073709551615 __btrfs_mod_ref+0x7dd/0xac0 fs/btrfs/extent-tree.c:2523 update_ref_for_cow+0x9cd/0x11f0 fs/btrfs/ctree.c:512 btrfs_force_cow_block+0x9f6/0x1da0 fs/btrfs/ctree.c:594 btrfs_cow_block+0x35e/0xa40 fs/btrfs/ctree.c:754 btrfs_search_slot+0xbdd/0x30d0 fs/btrfs/ctree.c:2116 btrfs_lookup_inode+0xdc/0x480 fs/btrfs/inode-item.c:411 __btrfs_update_delayed_inode+0x1e7/0xb90 fs/btrfs/delayed-inode.c:1030 btrfs_update_delayed_i ---truncated---
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于btrfs文件系统中释放后重用问题。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux fd708b81d972a0714b02a60eb4792fdbf15868c4 ~ dfb9fe7de61f34cc241ab3900bdde93341096e0e -
Linux Linux 4.15 -

II. Public POCs for CVE-2024-56581

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2024-56581

请登录查看更多情报信息。

Patches & Fixes for CVE-2024-56581 (7)

Same Patch Batch · Linux · 2024-12-27 · 221 CVEs total

CVE-2024-56640 9.8 CRITICAL net/smc: fix LGR and link use-after-free issue
CVE-2024-56645 9.8 CRITICAL can: j1939: j1939_session_new(): fix skb reference counting
CVE-2024-53169 9.8 CRITICAL nvme-fabrics: fix kernel crash while shutting down controller
CVE-2024-53209 9.8 CRITICAL bnxt_en: Fix receive ring space parameters when XDP is active
CVE-2024-53206 9.8 CRITICAL tcp: Fix use-after-free of nreq in reqsk_timer_handler().
CVE-2024-56656 9.8 CRITICAL bnxt_en: Fix aggregation ID mask to prevent oops on 5760X chips
CVE-2024-53186 9.8 CRITICAL ksmbd: fix use-after-free in SMB request handling
CVE-2024-53176 9.8 CRITICAL smb: During unmount, ensure all cached dir instances drop their dentry
CVE-2024-53177 9.8 CRITICAL smb: prevent use-after-free due to open_cached_dir error paths
CVE-2024-53179 9.8 CRITICAL smb: client: fix use-after-free of signing key
CVE-2024-56591 8.8 HIGH Bluetooth: hci_conn: Use disable_delayed_work_sync
CVE-2024-56626 8.8 HIGH ksmbd: fix Out-of-Bounds Write in ksmbd_vfs_stream_write
CVE-2024-53237 8.8 HIGH Bluetooth: fix use-after-free in device_for_each_child()
CVE-2024-53224 8.8 HIGH RDMA/mlx5: Move events notifier registration to be after device registration
CVE-2024-56651 8.8 HIGH can: hi311x: hi3110_can_ist(): fix potential use-after-free
CVE-2024-56653 8.8 HIGH Bluetooth: btmtk: avoid UAF in btmtk_process_coredump
CVE-2024-56669 8.8 HIGH iommu/vt-d: Remove cache tags before disabling ATS
CVE-2024-56627 8.1 HIGH ksmbd: fix Out-of-Bounds Read in ksmbd_vfs_stream_read
CVE-2024-53232 7.8 HIGH iommu/s390: Implement blocking domain
CVE-2024-56608 7.8 HIGH drm/amd/display: Fix out-of-bounds access in 'dcn21_link_encoder_create'

Showing top 20 of 221 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2024-56581

No comments yet

Leave a comment