cbcvebase.
CVE-2024-26792
published 2024-04-04

CVE-2024-26792: In the Linux kernel, the following vulnerability has been resolved: btrfs: fix double free of anonymous device after snapshot creation failure When creating a…

PriorityP338high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.24%
14.8th percentile
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix double free of anonymous device after snapshot creation failure When creating a snapshot we may do a double free of an anonymous device in case there's an error committing the transaction. The second free may result in freeing an anonymous device number that was allocated by some other subsystem in the kernel or another btrfs filesystem. The steps that lead to this: 1) At ioctl.c:create_snapshot() we allocate an anonymous device number and assign it to pending_snapshot->anon_dev; 2) Then we call btrfs_commit_transaction() and end up at transaction.c:create_pending_snapshot(); 3) There we call btrfs_get_new_fs_root() and pass it the anonymous device number stored in pending_snapshot->anon_dev; 4) btrfs_get_new_fs_root() frees that anonymous device number because btrfs_lookup_fs_root() returned a root - someone else did a lookup of the new root already, which could some task doing backref walking; 5) After that some error happens in the transaction commit path, and at ioctl.c:create_snapshot() we jump to the 'fail' label, and after that we free again the same anonymous device number, which in the meanwhile may have been reallocated somewhere else, because pending_snapshot->anon_dev still has the same value as in step 1. Recently syzbot ran into this and reported the following trace: ------------[ cut here ]------------ ida_free called for id=51 which is not allocated. WARNING: CPU: 1 PID: 31038 at lib/idr.c:525 ida_free+0x370/0x420 lib/idr.c:525 Modules linked in: CPU: 1 PID: 31038 Comm: syz-executor.2 Not tainted 6.8.0-rc4-syzkaller-00410-gc02197fc9076 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024 RIP: 0010:ida_free+0x370/0x420 lib/idr.c:525 Code: 10 42 80 3c 28 (...) RSP: 0018:ffffc90015a67300 EFLAGS: 00010246 RAX: be5130472f5dd000 RBX: 0000000000000033 RCX: 0000000000040000 RDX: ffffc90009a7a000 RSI: 000000000003ffff RDI: 000000000

Affected

20 ranges
VendorProductVersion rangeFixed in
debianlinux< linux 6.7.9-1 (forky)linux 6.7.9-1 (forky)
linuxlinux
linuxlinux
linuxlinux>= 5.10.210 < 5.115.11
linuxlinux>= 5.15.149 < 5.165.16
linuxlinux>= 5a172344bfdabb46458e03708735d7b1a918c468 < c8ab7521665bd0f8bc4a900244d1d5a7095cc3b9c8ab7521665bd0f8bc4a900244d1d5a7095cc3b9
linuxlinux>= 6.1.79 < 6.1.816.1.81
linuxlinux>= 6.6.18 < 6.6.216.6.21
linuxlinux>= 6.7.6 < 6.7.96.7.9
linuxlinux>= 66b317a2fc45b2ef66527ee3f8fa08fb5beab88d < c34adc20b91a8e55e048b18d63f4f4ae003ecf8fc34adc20b91a8e55e048b18d63f4f4ae003ecf8f
linuxlinux>= 833775656d447c545133a744a0ed1e189ce61430 < eb3441093aad251418921246fc3b224fd1575701eb3441093aad251418921246fc3b224fd1575701
linuxlinux>= e03ee2fe873eb68c1f9ba5112fee70303ebf9dfb < e2b54eaf28df0c978626c9736b94f003b523b451e2b54eaf28df0c978626c9736b94f003b523b451
linuxlinux_kernel>= 0 < 6.7.9-16.7.9-1
linuxlinux_kernel>= 0 < 6.7.9-16.7.9-1
linuxlinux_kernel>= 0 < 5.15.0-112.1225.15.0-112.122
linuxlinux_kernel>= 5.10.210 < 5.115.11
linuxlinux_kernel>= 5.15.149 < 5.165.16
linuxlinux_kernel>= 6.1.79 < 6.1.816.1.81
linuxlinux_kernel>= 6.6.18 < 6.6.216.6.21
linuxlinux_kernel>= 6.7.6 < 6.7.96.7.9

CVSS provenance

nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.8HIGH
vendor_debian7.8LOW
vendor_redhat7.8HIGH
vendor_ubuntu7.0HIGH
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.