CVE-2024-27080

published 2024-05-01

CVE-2024-27080: In the Linux kernel, the following vulnerability has been resolved: btrfs: fix race when detecting delalloc ranges during fiemap For fiemap we recently stopped…

Priority P4 18 medium 4.7 CVSS 3.1

AV L AC H PR L UI N S U C N I N A H

In the Linux kernel, the following vulnerability has been resolved:

btrfs: fix race when detecting delalloc ranges during fiemap

For fiemap we recently stopped locking the target extent range for the
whole duration of the fiemap call, in order to avoid a deadlock in a
scenario where the fiemap buffer happens to be a memory mapped range of
the same file. This use case is very unlikely to be useful in practice but
it may be triggered by fuzz testing (syzbot, etc).

This however introduced a race that makes us miss delalloc ranges for
file regions that are currently holes, so the caller of fiemap will not
be aware that there's data for some file regions. This can be quite
serious for some use cases - for example in coreutils versions before 9.0,
the cp program used fiemap to detect holes and data in the source file,
copying only regions with data (extents or delalloc) from the source file
to the destination file in order to preserve holes (see the documentation
for its --sparse command line option). This means that if cp was used
with a source file that had delalloc in a hole, the destination file could
end up without that data, which is effectively a data loss issue, if it
happened to hit the race described below.

The race happens like this:

1) Fiemap is called, without the FIEMAP_FLAG_SYNC flag, for a file that
has delalloc in the file range [64M, 65M[, which is currently a hole;

2) Fiemap locks the inode in shared mode, then starts iterating the
inode's subvolume tree searching for file extent items, without having
the whole fiemap target range locked in the inode's io tree - the
change introduced recently by commit b0ad381fa769 ("btrfs: fix
deadlock with fiemap and extent locking"). It only locks ranges in
the io tree when it finds a hole or prealloc extent since that
commit;

3) Note that fiemap clones each leaf before using it, and this is to
avoid deadlocks when locking a file range in the inode's io tree and
the fiemap buffer is memory mapped to some file,

Affected

15 ranges

Vendor	Product	Version range	Fixed in
debian	linux	< linux 6.8.9-1 (forky)	linux 6.8.9-1 (forky)
linux	linux	—	—
linux	linux	—	—
linux	linux	>= 6.6.24 < 6.6.26	6.6.26
linux	linux	>= 6.7.12 < 6.8	6.8
linux	linux	>= b0ad381fa7690244802aed119b478b4bdafc31dd < ced63fffd63072c0ca55d5a451010d71bf08c0b3	ced63fffd63072c0ca55d5a451010d71bf08c0b3
linux	linux	>= b0ad381fa7690244802aed119b478b4bdafc31dd < 978b63f7464abcfd364a6c95f734282c50f3decf	978b63f7464abcfd364a6c95f734282c50f3decf
linux	linux	>= ded566b4637f1b6b4c9ba74e7d0b8493e93f19cf < 49d640d2946c35a17b051d54171a032dd95b0f50	49d640d2946c35a17b051d54171a032dd95b0f50
linux	linux_kernel	—	—
linux	linux_kernel	—	—
linux	linux_kernel	>= 0 < 6.8.9-1	6.8.9-1
linux	linux_kernel	>= 0 < 6.8.9-1	6.8.9-1
linux	linux_kernel	>= 0 < 6.8.0-35.35	6.8.0-35.35
linux	linux_kernel	>= 6.6.24 < 6.6.26	6.6.26
linux	linux_kernel	>= 6.7.12 < 6.8	6.8

CVSS provenance

nvd v3.1 4.7 MEDIUM CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

osv 5.5 MEDIUM

vendor_ubuntu 6.3 MEDIUM

vendor_debian 4.7 LOW

vendor_redhat 4.7 MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-362