Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2024-56759— btrfs: fix use-after-free when COWing tree bock and tracing is enabled

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于在btrfs文件系统中，当进行树块COW操作且启用了trace_btrfs_cow_block跟踪点时，如果内核启用了抢占（CONFIG_PREEMPT=y），在某些路径下调用btrfs_cow_block时，可能会在tracepoint代码中触发对已释放的COWed extent buffer的释放后重用，导致内核崩溃或不稳定。

CVSS 7.8 · High EPSS 0.22% · P12

Possible ATT&CK Techniques 1 AI

T1073

Affected Version Matrix 14

VendorProduct Version RangeStatus
Linux Linux 3083ee2e18b701122a3b841db83448543a87a583< ba5120a2fb5f23b4d39d302e181aa5d4e28a90d1 affected
3083ee2e18b701122a3b841db83448543a87a583< 526ff5b27f090fb15040471f892cd2c9899ce314 affected
3083ee2e18b701122a3b841db83448543a87a583< 66376f1a73cba57fd0af2631d7888605b738e499 affected
3083ee2e18b701122a3b841db83448543a87a583< 9a466b8693b9add05de99af00c7bdff8259ecf19 affected
3083ee2e18b701122a3b841db83448543a87a583< c3a403d8ce36f5a809a492581de5ad17843e4701 affected
3083ee2e18b701122a3b841db83448543a87a583< 44f52bbe96dfdbe4aca3818a2534520082a07040 affected
3.4 affected
< 3.4 unaffected
… +6 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2024-56759

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
btrfs: fix use-after-free when COWing tree bock and tracing is enabled
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix use-after-free when COWing tree bock and tracing is enabled When a COWing a tree block, at btrfs_cow_block(), and we have the tracepoint trace_btrfs_cow_block() enabled and preemption is also enabled (CONFIG_PREEMPT=y), we can trigger a use-after-free in the COWed extent buffer while inside the tracepoint code. This is because in some paths that call btrfs_cow_block(), such as btrfs_search_slot(), we are holding the last reference on the extent buffer @buf so btrfs_force_cow_block() drops the last reference on the @buf extent buffer when it calls free_extent_buffer_stale(buf), which schedules the release of the extent buffer with RCU. This means that if we are on a kernel with preemption, the current task may be preempted before calling trace_btrfs_cow_block() and the extent buffer already released by the time trace_btrfs_cow_block() is called, resulting in a use-after-free. Fix this by moving the trace_btrfs_cow_block() from btrfs_cow_block() to btrfs_force_cow_block() before the COWed extent buffer is freed. This also has a side effect of invoking the tracepoint in the tree defrag code, at defrag.c:btrfs_realloc_node(), since btrfs_force_cow_block() is called there, but this is fine and it was actually missing there.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于在btrfs文件系统中，当进行树块COW操作且启用了trace_btrfs_cow_block跟踪点时，如果内核启用了抢占（CONFIG_PREEMPT=y），在某些路径下调用btrfs_cow_block时，可能会在tracepoint代码中触发对已释放的COWed extent buffer的释放后重用，导致内核崩溃或不稳定。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 3083ee2e18b701122a3b841db83448543a87a583 ~ ba5120a2fb5f23b4d39d302e181aa5d4e28a90d1 -
Linux Linux 3.4 -

II. Public POCs for CVE-2024-56759

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2024-56759

请登录查看更多情报信息。

Patches & Fixes for CVE-2024-56759 (6)

Same Patch Batch · Linux · 2025-01-06 · 12 CVEs total

CVE-2024-56757 7.8 HIGH Bluetooth: btusb: mediatek: add intf release flow when usb disconnect
CVE-2024-56764 7.8 HIGH ublk: detach gendisk from ublk device if add_disk() fails
CVE-2024-56765 7.8 HIGH powerpc/pseries/vas: Add close() callback in vas_vm_ops struct
CVE-2024-56758 btrfs: check folio mapping after unlock in relocate_one_folio()
CVE-2024-56760 PCI/MSI: Handle lack of irqdomain gracefully
CVE-2024-56761 x86/fred: Clear WFE in missing-ENDBRANCH #CPs
CVE-2024-56763 tracing: Prevent bad count for tracing_cpumask_write
CVE-2024-56767 dmaengine: at_xdmac: avoid null_prt_deref in at_xdmac_prep_dma_memset
CVE-2024-56766 mtd: rawnand: fix double free in atmel_pmecc_create_user()
CVE-2024-56768 bpf: Fix bpf_get_smp_processor_id() on !CONFIG_SMP
CVE-2024-56769 media: dvb-frontends: dib3000mb: fix uninit-value in dib3000_write_reg

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2024-56759

No comments yet

Leave a comment