Critical Vulnerability in Linux Kernel: Btrfs Reconfiguration Flaw
Summary
DEBIAN-CVE-2024-50118: In the Linux kernel, the following vulnerability has been resolved: btrfs: reject ro->rw reconfiguration if there are hard ro requirements [BUG] Syzbot reports the following crash: BTRFS info (device loop0 state MCS): di... Affects linux versions < 6.11.6-1. Fixed in 6.11.6-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware and software interaction. It supports various filesystems, including Btrfs, which is known for its advanced features like snapshots and dynamic volume management. However, a recent vulnerability has been identified in the Btrfs filesystem that compromises its integrity during read-only to read-write reconfiguration.
Vulnerability Detail
In the Linux kernel, a vulnerability exists within the Btrfs filesystem that allows for improper handling of read-only (RO) and read-write (RW) mount configurations. This flaw can lead to a general protection fault and potential system crashes when mounting different subvolumes with conflicting RO/RW flags. The issue arises from the failure to enforce hard read-only requirements during the reconfiguration process, which can result in NULL pointer dereferences and subsequent system instability.
How To Fix
Minimum fixed version
6.11.6-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is recommended to avoid mounting subvolumes with conflicting RO/RW flags until the patch is applied.
Conclusion
The identified vulnerability in the Linux kernel's Btrfs filesystem poses significant risks, including system crashes and data integrity issues. Users are strongly advised to update to the patched version to mitigate these risks. Monitoring tools like Vulert can assist in identifying vulnerabilities in your applications without requiring extensive setup.
See every vulnerability recorded for linux →
FAQ
The vulnerability can lead to system crashes and data corruption when mounting Btrfs filesystems with conflicting read-only and read-write configurations.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, avoid using conflicting RO/RW mount options to minimize the risk of triggering the vulnerability.
Yes, the vulnerability affects specific versions of the Linux kernel prior to the patch version 6.11.6-1.
Detailed information can be found in the official Debian CVE report at https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2024-50118.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
