Kernel Panic Vulnerability in Linux Btrfs Package: CVE-2024-58089
Summary
CVE-2024-58089: In the Linux kernel, the following vulnerability has been resolved: btrfs: fix double accounting race when btrfs_run_delalloc_range() failed [BUG] When running btrfs with block size (4K) smaller than page size (64K, aarc... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing hardware resources and providing essential services to applications. Btrfs (B-tree file system) is a modern file system for Linux that offers advanced features such as snapshots, dynamic inode allocation, and integrated volume management. However, it has been identified that Btrfs can experience critical issues when the block size is smaller than the page size, leading to potential kernel crashes.
Vulnerability Detail
CVE-2024-58089 is a vulnerability in the Btrfs file system within the Linux kernel. It arises when Btrfs is run with a block size of 4K, which is smaller than the page size of 64K on aarch64 architecture. This mismatch can trigger a series of errors during the handling of dirty pages, leading to a kernel panic. The vulnerability is characterized by double accounting of ordered extents, which can result in a NULL pointer dereference and ultimately crash the kernel. The issue is exacerbated by the experimental nature of the configuration, making it critical for users to address it promptly.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid running Btrfs with a block size smaller than the page size. This may involve reconfiguring the file system or using a different file system that does not exhibit this issue.
Conclusion
CVE-2024-58089 is a critical vulnerability in the Linux kernel's Btrfs file system that can lead to kernel panics under specific configurations. Users are urged to update their systems to the latest patched versions to ensure stability and security. Additionally, utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for linux →
FAQ
CVE-2024-58089 is a vulnerability in the Btrfs file system of the Linux kernel that can lead to kernel crashes when certain configurations are used.
If your system is running Btrfs with a block size smaller than the page size, it may experience kernel panics, leading to system instability and potential data loss.
You should update your Linux kernel to the latest patched version to mitigate the risk associated with this vulnerability.
Yes, you can use Vulert, which allows you to monitor and alert for open-source vulnerabilities in your software using just a manifest file. You can check your application at Vulert Scanner without needing to sign up.
If left unaddressed, this vulnerability can lead to frequent system crashes, data corruption, and a significant risk to system reliability.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
