Critical Vulnerability in Linux Kernel: RST Lookup Error Handling
Summary
DEBIAN-CVE-2024-41067: In the Linux kernel, the following vulnerability has been resolved: btrfs: scrub: handle RST lookup error correctly [BUG] When running btrfs/060 with forced RST feature, it would crash the following ASSERT() inside scrub... Affects linux versions < 6.9.11-1. Fixed in 6.9.11-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, responsible for managing hardware and system resources. It provides essential services for all other parts of the operating system. The kernel is highly complex and is continuously updated to improve performance and security. However, vulnerabilities can arise, such as the one identified in this report, which affects the btrfs file system's scrub functionality.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the btrfs file system related to the handling of RST (Read Scrub Target) lookup errors. When running the btrfs scrub with the forced RST feature, the system could crash due to an assertion failure triggered by an empty bio allocation. This occurs when the btrfs_map_block function fails, leading to an incorrect sector number being processed. The vulnerability can result in system instability and potential data loss during scrub operations.
How To Fix
Minimum fixed version
6.9.11-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is recommended to apply the patch as soon as it becomes available.
Conclusion
The identified vulnerability in the Linux kernel's btrfs file system poses significant risks, including system crashes and potential data loss. Users are advised to update their systems to the latest patched version to mitigate these risks. Monitoring tools like Vulert can assist in identifying vulnerabilities in open-source software.
See every vulnerability recorded for linux →
FAQ
The vulnerability is related to the btrfs file system's scrub functionality, specifically in how it handles RST lookup errors, which can lead to system crashes.
You can use Vulert, which monitors open-source vulnerabilities in your software. By utilizing the manifest file like package-lock.json, you can check for vulnerabilities without needing to access the code.
If exploited, this vulnerability can cause system crashes and may lead to data loss during scrub operations on the btrfs file system.
Yes, a patch is available in version 6.9.11-1 of the Linux package. Users are encouraged to update to this version or later.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
