Btrfs Scrub RST Lookup Error in Linux Kernel - CVE-2024-41067
Summary
CVE-2024-41067: In the Linux kernel, the following vulnerability has been resolved: btrfs: scrub: handle RST lookup error correctly [BUG] When running btrfs/060 with forced RST feature, it would crash the following ASSERT() inside scrub... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interaction. It supports various file systems, including Btrfs, which is known for its advanced features like snapshots and dynamic volume management. The vulnerability in question affects the Btrfs scrub functionality, which is responsible for checking the integrity of data and repairing any inconsistencies. This vulnerability can lead to system crashes when certain conditions are met, particularly when using the forced RST feature.
Vulnerability Detail
The vulnerability arises from improper handling of read sector mapping during the Btrfs scrub process. Specifically, when the scrub function attempts to read data, it calls btrfs_map_block() after allocating a new bio structure. If btrfs_map_block() fails, the newly allocated bio remains empty, leading to an assertion failure in scrub_read_endio(). This can cause the system to crash, resulting in potential data loss or corruption. The root cause of the RST lookup failure still needs to be addressed, making this a critical issue for users relying on Btrfs for data integrity.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the forced RST feature in Btrfs until the kernel is updated. This can be done by modifying the scrub command to exclude the RST option, thereby preventing the conditions that trigger the vulnerability.
Conclusion
CVE-2024-41067 is a significant vulnerability in the Linux kernel affecting the Btrfs file system's scrub functionality. It can lead to system crashes and potential data loss. Users are advised to update their kernel to mitigate this risk and consider using Vulert for ongoing vulnerability monitoring.
See every vulnerability recorded for linux →
FAQ
CVE-2024-41067 is a vulnerability in the Linux kernel affecting the Btrfs file system's scrub functionality, which can lead to system crashes under certain conditions.
If your system uses Btrfs with the forced RST feature, it may crash during scrub operations, potentially leading to data loss or corruption.
You should update your Linux kernel to a version that includes the fix for CVE-2024-41067. Check your distribution's package manager for available updates.
Yes, you can use Vulert, which monitors open-source vulnerabilities in your software. You can check if your application is affected by CVE-2024-41067 using the Vulert playground without needing to sign up.
Vulert is a tool that monitors and alerts for open-source vulnerabilities in software using a manifest file like package-lock.json. It provides real-time alerts and insights into vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
