cbcvebase.
CVE-2023-52569
published 2024-03-02

CVE-2023-52569: In the Linux kernel, the following vulnerability has been resolved: btrfs: remove BUG() after failure to insert delayed dir index item Instead of calling BUG()…

PriorityP419medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.24%
14.9th percentile
In the Linux kernel, the following vulnerability has been resolved: btrfs: remove BUG() after failure to insert delayed dir index item Instead of calling BUG() when we fail to insert a delayed dir index item into the delayed node's tree, we can just release all the resources we have allocated/acquired before and return the error to the caller. This is fine because all existing call chains undo anything they have done before calling btrfs_insert_delayed_dir_index() or BUG_ON (when creating pending snapshots in the transaction commit path). So remove the BUG() call and do proper error handling. This relates to a syzbot report linked below, but does not fix it because it only prevents hitting a BUG(), it does not fix the issue where somehow we attempt to use twice the same index number for different index items.

Affected

16 ranges
VendorProductVersion rangeFixed in
debianlinux< linux 6.6.8-1 (forky)linux 6.6.8-1 (forky)
linuxlinux
linuxlinux
linuxlinux
linuxlinux>= 5.15.149 < 5.165.16
linuxlinux>= 6.4.12 < 6.56.5
linuxlinux>= 9b378f6ad48cfa195ed868db9123c09ee7ec5ea2 < d10fd53393cc5de4b9cf1a4b8f9984f0a037aa51d10fd53393cc5de4b9cf1a4b8f9984f0a037aa51
linuxlinux>= 9b378f6ad48cfa195ed868db9123c09ee7ec5ea2 < 2c58c3931ede7cd08cbecf1f1a4acaf0a04a41a92c58c3931ede7cd08cbecf1f1a4acaf0a04a41a9
linuxlinux_kernel< 6.1.566.1.56
linuxlinux_kernel
linuxlinux_kernel>= 0 < 6.6.8-16.6.8-1
linuxlinux_kernel>= 0 < 6.6.8-16.6.8-1
linuxlinux_kernel>= 6.2 < 6.5.66.5.6
msrccbl2_kernel_5.15.186.1-1_on_cbl_mariner_2.0
msrccbl2_kernel_5.15.200.1-1_on_cbl_mariner_2.0
msrccbl2_kernel_5.15.202.1-1_on_cbl_mariner_2.0

CVSS provenance

nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_debian5.5LOW
vendor_msrc5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.