Critical NULL Pointer Dereference in Linux Kernel's Btrfs - CVE-2024-40962
Summary
DEBIAN-CVE-2024-40962: In the Linux kernel, the following vulnerability has been resolved: btrfs: zoned: allocate dummy checksums for zoned NODATASUM writes Shin'ichiro reported that when he's running fstests' test-case btrfs/167 on emulated z... Affects linux versions < 6.9.7-1. Fixed in 6.9.7-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, managing hardware and system resources. It supports various filesystems, including Btrfs, which is designed for high performance and advanced features like snapshots and dynamic volume management. However, a recent vulnerability has been identified in the Btrfs subsystem, specifically affecting zoned devices during NODATASUM writes, leading to potential system crashes.
Vulnerability Detail
In the Linux kernel, a vulnerability has been discovered in the Btrfs filesystem that can lead to a NULL pointer dereference. This issue arises when running specific test cases on emulated zoned devices, causing a general protection fault. The vulnerability is triggered when the system attempts to allocate dummy checksums for zoned NODATASUM writes, which can result in a crash and potential data loss. The root cause is a missing checksums list on the ordered_extent during NOCOW writes, which is expected behavior in zoned emulation mode.
How To Fix
Minimum fixed version
6.9.7-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is recommended to apply the patch as soon as it is available to mitigate risks.
Conclusion
The CVE-2024-40962 vulnerability in the Linux kernel's Btrfs filesystem poses a significant risk to systems using affected versions. It is essential to apply the patch promptly to prevent potential crashes and data loss. Regular monitoring with tools like Vulert can help maintain awareness of vulnerabilities in your software.
See every vulnerability recorded for linux →
FAQ
CVE-2024-40962 is a vulnerability in the Linux kernel's Btrfs filesystem that can lead to a NULL pointer dereference, potentially causing system crashes.
If your system uses the affected version of the Linux kernel with Btrfs, it may experience crashes or data loss when performing specific write operations on zoned devices.
The vulnerability affects Linux kernel versions prior to 6.9.7-1 on Debian 13 and 14.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
While there are no specific workarounds available, it is crucial to plan for an update as soon as possible to mitigate the risks associated with this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
