Critical Kernel Vulnerability in Linux Package: Btrfs Double Accounting Race Condition
Summary
DEBIAN-CVE-2024-58089: In the Linux kernel, the following vulnerability has been resolved: btrfs: fix double accounting race when btrfs_run_delalloc_range() failed [BUG] When running btrfs with block size (4K) smaller than page size (64K, aarc... Affects linux versions < 6.12.17-1. Fixed in 6.12.17-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux package is a core component of the Debian operating system, providing essential functionalities for managing hardware and system resources. It includes the kernel, which is responsible for communication between software and hardware. The package supports various file systems, including Btrfs, which is designed for high-performance storage management. However, it is susceptible to vulnerabilities that can lead to system crashes and data corruption, particularly when certain configurations are used.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the Btrfs file system that involves a double accounting race condition when the function btrfs_run_delalloc_range() fails. This issue arises when Btrfs is run with a block size smaller than the page size, leading to a high probability of kernel crashes. The vulnerability can trigger critical errors, including kernel panics and NULL pointer dereferences, resulting in system instability and potential data loss.
How To Fix
Minimum fixed version
6.12.17-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using Btrfs with a block size smaller than the page size. Adjusting the configuration to ensure that the block size is equal to or greater than the page size may help mitigate the risk of encountering this vulnerability.
Conclusion
The identified vulnerability in the Linux package poses significant risks to system stability and data integrity, particularly for users of the Btrfs file system. It is crucial to apply the recommended updates or implement workarounds to mitigate potential impacts. Regular monitoring for vulnerabilities using tools like Vulert can help maintain system security.
See every vulnerability recorded for linux →
FAQ
The vulnerability can lead to kernel crashes, system instability, and potential data loss, particularly in systems using Btrfs with incompatible block and page sizes.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If an immediate update is not possible, consider using the workaround of adjusting the block size to avoid triggering the vulnerability.
Yes, the vulnerability is particularly relevant for systems running on aarch64 architecture where the block size is smaller than the page size.
Detailed information can be found in the Debian CVE database at https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2024-58089.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
