Critical Vulnerability in Linux Kernel: Btrfs COW Fixup Crash
Summary
DEBIAN-CVE-2024-57976: In the Linux kernel, the following vulnerability has been resolved: btrfs: do proper folio cleanup when cow_file_range() failed [BUG] When testing with COW fixup marked as BUG_ON() (this is involved with the new pin_user... Affects linux versions < 6.12.37-1. Fixed in 6.12.37-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of a Linux operating system, responsible for managing hardware resources and providing essential services to applications. It supports a wide range of functionalities, including process management, memory management, and file systems. Btrfs is a modern file system for Linux that offers advanced features such as snapshots, dynamic inode allocation, and built-in RAID capabilities. However, a vulnerability has been identified in the Btrfs implementation, specifically related to the Copy-On-Write (COW) mechanism, which can lead to kernel crashes under certain conditions.
Vulnerability Detail
In the Linux kernel, a vulnerability has been discovered in the Btrfs file system that can cause a kernel crash due to improper handling of the COW mechanism during file operations. The issue arises when the function cow_file_range() fails, leading to a situation where the kernel attempts to access dirty pages that should have been cleaned up. This results in a BUG_ON() assertion failure, which can crash the kernel. The root cause is related to the error handling in the extent reservation process, specifically when the system runs out of space (ENOSPC) during a write operation. This vulnerability has been present since the introduction of Btrfs and poses a significant risk to system stability.
How To Fix
Minimum fixed version
6.12.37-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is recommended to apply the patch as soon as it is available to mitigate the risk of system crashes.
Conclusion
The identified vulnerability in the Linux kernel's Btrfs file system poses a serious risk of kernel crashes due to improper handling of the COW mechanism. Users are strongly encouraged to update their systems to the patched versions to ensure stability and prevent potential data loss.
See every vulnerability recorded for linux →
FAQ
The vulnerability can lead to kernel crashes, resulting in system instability and potential data loss.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
The vulnerability affects all versions of the Linux kernel prior to the fixed versions 6.12.37-1 for Debian 13 and Debian 14.
While there are no specific workarounds available, it is crucial to monitor your system for any signs of instability and apply the patch as soon as it is released.
If you experience a crash, it is advisable to reboot your system and ensure that you update to the patched kernel version as soon as possible.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
