Deadlock Vulnerability in Linux Kernel Btrfs: Fiemap and Fsync Interaction
Summary
CVE-2023-52737: In the Linux kernel, the following vulnerability has been resolved: btrfs: lock the inode in shared mode before starting fiemap Currently fiemap does not take the inode's lock (VFS lock), it only locks a file range in th... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of a Linux operating system, managing hardware resources and providing essential services for software applications. Btrfs, or B-tree file system, is a modern file system for Linux that offers advanced features such as snapshots, dynamic inode allocation, and built-in RAID capabilities. However, it is susceptible to a deadlock vulnerability when the fiemap function is called concurrently with fsync, potentially leading to system hangs and degraded performance.
Vulnerability Detail
The vulnerability arises from the fiemap function not acquiring the inode's lock (VFS lock) before initiating its operations. This oversight can lead to a deadlock scenario when a concurrent fsync operation is executed on the same file. Specifically, the deadlock occurs on the inode's i_mmap_lock semaphore, which is held by both fsync and the btrfs_page_mkwrite function. This situation can cause tasks to be blocked for extended periods, as evidenced by reports from syzbot, which highlighted instances where tasks were blocked for over 145 seconds, severely impacting system stability and responsiveness.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds available to mitigate this vulnerability without applying the kernel update. Users are advised to monitor their systems for any signs of deadlock and to avoid concurrent fsync and fiemap operations if possible until the update is applied.
Conclusion
The deadlock vulnerability in the Linux kernel's Btrfs file system poses a significant risk to system stability when using the fiemap function concurrently with fsync. Users are strongly encouraged to update their kernels to mitigate this issue and ensure optimal performance. Regular monitoring and updates are essential for maintaining system security.
See every vulnerability recorded for linux →
FAQ
The vulnerability can lead to deadlocks, causing tasks to be blocked for extended periods, which may result in system hangs and degraded performance.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability affects multiple versions of the Linux kernel across Debian 11, 12, and 13, specifically prior to the fixed versions 6.1.15-1.
The best prevention method is to update the Linux kernel to the latest version that includes the fix for this vulnerability.
If you encounter a deadlock, you may need to reboot your system. It is crucial to apply the kernel update as soon as possible to prevent future occurrences.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
