Critical Race Condition in Linux Kernel's Fiemap Functionality - Debian Linux Package
Summary
DEBIAN-CVE-2024-27080: In the Linux kernel, the following vulnerability has been resolved: btrfs: fix race when detecting delalloc ranges during fiemap For fiemap we recently stopped locking the target extent range for the whole duration of th... Affects linux versions < 6.8.9-1. Fixed in 6.8.9-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing system resources and facilitating communication between hardware and software. It provides essential services such as process management, memory management, and device control. The vulnerability in question affects the btrfs file system's fiemap functionality, which is used to retrieve information about the extents of a file, particularly in relation to sparse files. This vulnerability can lead to data loss under specific conditions.
Vulnerability Detail
In the Linux kernel, a race condition was introduced in the btrfs file system's fiemap functionality. This occurs when the fiemap function is called without the FIEMAP_FLAG_SYNC flag for a file that has delalloc (delayed allocation) in a range that is currently a hole. The race condition allows the delalloc data to be flushed while the fiemap is iterating over the file extent items, leading to a situation where the fiemap does not report the presence of delalloc data. Consequently, this can result in data loss when tools like the cp command, which rely on fiemap to copy only regions with data, are used on files with delalloc in holes.
How To Fix
Minimum fixed version
6.8.9-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned to mitigate the effects of this vulnerability without applying the patch. Users are advised to avoid using the cp command with files that may have delalloc in holes until the patch is applied.
Conclusion
The vulnerability identified in the Linux kernel's btrfs file system can lead to significant data loss due to a race condition in the fiemap functionality. Users are urged to update their systems to the patched version to mitigate this risk. For those unable to immediately apply the patch, caution is advised when using file copying tools.
See every vulnerability recorded for linux →
FAQ
The vulnerability is a race condition in the btrfs file system's fiemap functionality, which can lead to data loss when copying files.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Check your application against this vulnerability using the Vulert playground at Vulert Scanner.
If exploited, this vulnerability can result in data loss when using file copying tools that rely on the fiemap functionality.
Yes, a patch is available in the form of an updated package version (6.8.9-1) for Debian Linux.
It is advisable to avoid using the cp command on files that may have delalloc in holes until the patch is applied.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
