cbcvebase.
CVE-2023-52896
published 2024-08-21

CVE-2023-52896: In the Linux kernel, the following vulnerability has been resolved: btrfs: fix race between quota rescan and disable leading to NULL pointer deref If we have…

PriorityP417medium4.7CVSS 3.1
AVLACHPRLUINSUCNINAH
EPSS
0.24%
15.1th percentile
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix race between quota rescan and disable leading to NULL pointer deref If we have one task trying to start the quota rescan worker while another one is trying to disable quotas, we can end up hitting a race that results in the quota rescan worker doing a NULL pointer dereference. The steps for this are the following: 1) Quotas are enabled; 2) Task A calls the quota rescan ioctl and enters btrfs_qgroup_rescan(). It calls qgroup_rescan_init() which returns 0 (success) and then joins a transaction and commits it; 3) Task B calls the quota disable ioctl and enters btrfs_quota_disable(). It clears the bit BTRFS_FS_QUOTA_ENABLED from fs_info->flags and calls btrfs_qgroup_wait_for_completion(), which returns immediately since the rescan worker is not yet running. Then it starts a transaction and locks fs_info->qgroup_ioctl_lock; 4) Task A queues the rescan worker, by calling btrfs_queue_work(); 5) The rescan worker starts, and calls rescan_should_stop() at the start of its while loop, which results in 0 iterations of the loop, since the flag BTRFS_FS_QUOTA_ENABLED was cleared from fs_info->flags by task B at step 3); 6) Task B sets fs_info->quota_root to NULL; 7) The rescan worker tries to start a transaction and uses fs_info->quota_root as the root argument for btrfs_start_transaction(). This results in a NULL pointer dereference down the call chain of btrfs_start_transaction(). The stack trace is something like the one reported in Link tag below: general protection fault, probably for non-canonical address 0xdffffc0000000041: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000208-0x000000000000020f] CPU: 1 PID: 34 Comm: kworker/u4:2 Not tainted 6.1.0-syzkaller-13872-gb6bb9676f216 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 Workqueue: btrfs-qgroup-rescan btrfs_work_helper RIP: 0010:start_transaction+0x48/0x10f0 fs/b

Affected

22 ranges
VendorProductVersion rangeFixed in
debianlinux< linux 6.1.8-1 (bookworm)linux 6.1.8-1 (bookworm)
linuxlinux——
linuxlinux——
linuxlinux>= 26b3901d20bf9da2c6a00cb1fb48932166f80a45 < 89ac597e3e807b91e2ebd6a7c36fec7b9729023389ac597e3e807b91e2ebd6a7c36fec7b97290233
linuxlinux>= 32747e01436aac8ef93fe85b5b523b4f3b52f040 < 3bd43374857103ba3cac751d6d4afa8d83b5d92a3bd43374857103ba3cac751d6d4afa8d83b5d92a
linuxlinux>= 5.10.99 < 5.10.1655.10.165
linuxlinux>= 5.15.22 < 5.15.905.15.90
linuxlinux>= 5.16.8 < 5.175.17
linuxlinux>= 5.4.178 < 5.4.2305.4.230
linuxlinux>= 89d4cca583fc9594ee7d1a0bc986886d6fb587e6 < 64287cd456a22373053998c1fccf14b651e9cbbd64287cd456a22373053998c1fccf14b651e9cbbd
linuxlinux>= e804861bd4e69cc5fe1053eedcb024982dde8e48 < 1004fc90f0d79a4b7d9e3d432729914f472f9ad11004fc90f0d79a4b7d9e3d432729914f472f9ad1
linuxlinux>= e804861bd4e69cc5fe1053eedcb024982dde8e48 < b7adbf9ada3513d2092362c8eac5cddc5b651f5cb7adbf9ada3513d2092362c8eac5cddc5b651f5c
linuxlinux_kernel< 5.175.17
linuxlinux_kernel——
linuxlinux_kernel>= 0 < 5.10.178-15.10.178-1
linuxlinux_kernel>= 0 < 6.1.8-16.1.8-1
linuxlinux_kernel>= 0 < 6.1.8-16.1.8-1
linuxlinux_kernel>= 0 < 6.1.8-16.1.8-1
linuxlinux_kernel>= 5.10.99 < 5.10.1655.10.165
linuxlinux_kernel>= 5.15.22 < 5.15.905.15.90
linuxlinux_kernel>= 5.17 < 6.1.86.1.8
linuxlinux_kernel>= 5.4.178 < 5.4.2305.4.230

CVSS provenance

nvdv3.14.7MEDIUMCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
osv4.7MEDIUM
vendor_debian4.7MEDIUM
vendor_redhat4.7MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.