CVE-2024-46734
published 2024-09-18CVE-2024-46734: In the Linux kernel, the following vulnerability has been resolved: btrfs: fix race between direct IO write and fsync when using same fd If we have 2 threads…
PriorityP418medium4.7CVSS 3.1
AVLACHPRLUINSUCNINAH
EPSS
0.19%
8.9th percentile
In the Linux kernel, the following vulnerability has been resolved:
btrfs: fix race between direct IO write and fsync when using same fd
If we have 2 threads that are using the same file descriptor and one of
them is doing direct IO writes while the other is doing fsync, we have a
race where we can end up either:
1) Attempt a fsync without holding the inode's lock, triggering an
assertion failures when assertions are enabled;
2) Do an invalid memory access from the fsync task because the file private
points to memory allocated on stack by the direct IO task and it may be
used by the fsync task after the stack was destroyed.
The race happens like this:
1) A user space program opens a file descriptor with O_DIRECT;
2) The program spawns 2 threads using libpthread for example;
3) One of the threads uses the file descriptor to do direct IO writes,
while the other calls fsync using the same file descriptor.
4) Call task A the thread doing direct IO writes and task B the thread
doing fsyncs;
5) Task A does a direct IO write, and at btrfs_direct_write() sets the
file's private to an on stack allocated private with the member
'fsync_skip_inode_lock' set to true;
6) Task B enters btrfs_sync_file() and sees that there's a private
structure associated to the file which has 'fsync_skip_inode_lock' set
to true, so it skips locking the inode's VFS lock;
7) Task A completes the direct IO write, and resets the file's private to
NULL since it had no prior private and our private was stack allocated.
Then it unlocks the inode's VFS lock;
8) Task B enters btrfs_get_ordered_extents_for_logging(), then the
assertion that checks the inode's VFS lock is held fails, since task B
never locked it and task A has already unlocked it.
The stack trace produced is the following:
assertion failed: inode_is_locked(&inode->vfs_inode), in fs/btrfs/ordered-data.c:983
------------[ cut here ]------------
kernel BUG at fs/btrfs/ordered-data.c:983!
Oops: invalid opcode: 0000 [#1] PREEMPT S
Affected
23 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.1.112-1 (bookworm) | linux 6.1.112-1 (bookworm) |
| debian | linux-6.1 | < linux 6.1.112-1 (bookworm) | linux 6.1.112-1 (bookworm) |
| linux | linux | >= 0a108bde616a7017653385b5a12111015051a294 < 7b5595f33c3c273613b590892a578d78186bb400 | 7b5595f33c3c273613b590892a578d78186bb400 |
| linux | linux | >= 3831170f740685fddc8f6aa57a83ad0fef4711bf < 01681aa609b5f110502f56c4e3b2938efcf4a5bc | 01681aa609b5f110502f56c4e3b2938efcf4a5bc |
| linux | linux | >= 4e17707035a65f6e5b2a4d987a308cf8ed8c5ad1 < d116a0b0e02f395cedfb8c725bd67480aa7c428c | d116a0b0e02f395cedfb8c725bd67480aa7c428c |
| linux | linux | >= 5.15.165 < 5.15.167 | 5.15.167 |
| linux | linux | >= 6.1.105 < 6.1.110 | 6.1.110 |
| linux | linux | >= 6.10.5 < 6.10.10 | 6.10.10 |
| linux | linux | >= 6.6.46 < 6.6.51 | 6.6.51 |
| linux | linux | >= 6cae8d04d8b3d1ecfadcaa989e673f6f73349ed5 < cd3087582e4fa36e89be4e6f859e75a4400292b4 | cd3087582e4fa36e89be4e6f859e75a4400292b4 |
| linux | linux | >= 939b656bc8ab203fdbde26ccac22bcb7f0985be5 < cd9253c23aedd61eb5ff11f37a36247cd46faf86 | cd9253c23aedd61eb5ff11f37a36247cd46faf86 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 6.1.112-1 | 6.1.112-1 |
| linux | linux_kernel | >= 0 < 6.10.11-1 | 6.10.11-1 |
| linux | linux_kernel | >= 0 < 6.10.11-1 | 6.10.11-1 |
| linux | linux_kernel | >= 5.15.165 < 5.15.167 | 5.15.167 |
| linux | linux_kernel | >= 6.1.105 < 6.1.110 | 6.1.110 |
| linux | linux_kernel | >= 6.10.5 < 6.10.10 | 6.10.10 |
| linux | linux_kernel | >= 6.6.46 < 6.6.51 | 6.6.51 |
CVSS provenance
nvdv3.14.7MEDIUMCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
osv4.7MEDIUM
vendor_debian4.7MEDIUM
vendor_redhat4.7MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2024-46734: In the Linux kernel, the following vulnerability has been resolved: btrfs: fix race between direct IO write and fsync when using same fd If we have 2
osv·2024-09-18·CVSS 4.7
CVE-2024-46734 [MEDIUM] CVE-2024-46734: In the Linux kernel, the following vulnerability has been resolved: btrfs: fix race between direct IO write and fsync when using same fd If we have 2
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix race between direct IO write and fsync when using same fd If we have 2 threads that are using the same file descriptor and one of them is doing direct IO writes while the other is doing fsync, we have a race where we can end up either: 1) Attempt a fsync without holding the inode's lock, triggering an assertion failures when assertions are enabled; 2) Do an invalid memory access from the fsync task because the file private points to memory allocated on stack by the direct IO task and it may be used by the fsync task after the stack was destroyed. The race happens like this: 1) A user space program opens a file descriptor with O_DIRECT; 2) The program spawns 2 threads using libpthread for example; 3) One of the t
GHSA
GHSA-pw8w-hq42-r2hw: In the Linux kernel, the following vulnerability has been resolved:
btrfs: fix race between direct IO write and fsync when using same fd
If we have
ghsa_unreviewed·2024-09-18
CVE-2024-46734 [MEDIUM] CWE-362 GHSA-pw8w-hq42-r2hw: In the Linux kernel, the following vulnerability has been resolved:
btrfs: fix race between direct IO write and fsync when using same fd
If we have
In the Linux kernel, the following vulnerability has been resolved:
btrfs: fix race between direct IO write and fsync when using same fd
If we have 2 threads that are using the same file descriptor and one of
them is doing direct IO writes while the other is doing fsync, we have a
race where we can end up either:
1) Attempt a fsync without holding the inode's lock, triggering an
assertion failures when assertions are enabled;
2) Do an invalid memory access from the fsync task because the file private
points to memory allocated on stack by the direct IO task and it may be
used by the fsync task after the stack was destroyed.
The race happens like this:
1) A user space program opens a file descriptor with O_DIRECT;
2) The program spawns 2 threads using libpthread for example;
3) One
Red Hat
kernel: btrfs: fix race between direct IO write and fsync when using same fd
vendor_redhat·2024-09-18·CVSS 4.7
CVE-2024-46734 [MEDIUM] CWE-362 kernel: btrfs: fix race between direct IO write and fsync when using same fd
kernel: btrfs: fix race between direct IO write and fsync when using same fd
In the Linux kernel, the following vulnerability has been resolved:
btrfs: fix race between direct IO write and fsync when using same fd
If we have 2 threads that are using the same file descriptor and one of
them is doing direct IO writes while the other is doing fsync, we have a
race where we can end up either:
1) Attempt a fsync without holding the inode's lock, triggering an
assertion failures when assertions are enabled;
2) Do an invalid memory access from the fsync task because the file private
points to memory allocated on stack by the direct IO task and it may be
used by the fsync task after the stack was destroyed.
The race happens like this:
1) A user space program opens a file descriptor with O_DIRECT;
Debian
CVE-2024-46734: linux - In the Linux kernel, the following vulnerability has been resolved: btrfs: fix ...
vendor_debian·2024·CVSS 4.7
CVE-2024-46734 [MEDIUM] CVE-2024-46734: linux - In the Linux kernel, the following vulnerability has been resolved: btrfs: fix ...
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix race between direct IO write and fsync when using same fd If we have 2 threads that are using the same file descriptor and one of them is doing direct IO writes while the other is doing fsync, we have a race where we can end up either: 1) Attempt a fsync without holding the inode's lock, triggering an assertion failures when assertions are enabled; 2) Do an invalid memory access from the fsync task because the file private points to memory allocated on stack by the direct IO task and it may be used by the fsync task after the stack was destroyed. The race happens like this: 1) A user space program opens a file descriptor with O_DIRECT; 2) The program spawns 2 threads using libpthread for example; 3) One of the t
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://git.kernel.org/stable/c/01681aa609b5f110502f56c4e3b2938efcf4a5bchttps://git.kernel.org/stable/c/7b5595f33c3c273613b590892a578d78186bb400https://git.kernel.org/stable/c/cd3087582e4fa36e89be4e6f859e75a4400292b4https://git.kernel.org/stable/c/cd9253c23aedd61eb5ff11f37a36247cd46faf86https://git.kernel.org/stable/c/d116a0b0e02f395cedfb8c725bd67480aa7c428chttps://lists.debian.org/debian-lts-announce/2025/01/msg00001.html
2024-09-18
Published