Vulnerability in btrfs: do not BUG_ON in link_to_fixup_dir
Summary
GSD-2021-1000625: btrfs: do not BUG_ON in link_to_fixup_dir. Affects Kernel versions < 0ed102453aa1cd12fefde8f6b60b9519b0b1f003. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The btrfs package is a file system for Linux that provides advanced features such as snapshots, pooling, and integrated device management. It is widely used in various Linux distributions. However, a vulnerability has been discovered in the package that can lead to a denial of service (DoS) attack or potential security risks.
Vulnerability Detail
The vulnerability in btrfs occurs in the link_to_fixup_dir function. This function contains a BUG_ON statement, which triggers a kernel panic and crashes the system if certain conditions are met. An attacker can exploit this vulnerability by creating a specially crafted file system image that triggers the BUG_ON statement, causing a DoS attack or potentially executing arbitrary code with kernel privileges. This vulnerability was fixed in Linux Kernel version v5.4.124 by commit 0ed102453aa1cd12fefde8f6b60b9519b0b1f003.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the Linux Kernel to the fixed version to ensure the system's security.
Conclusion
The vulnerability in btrfs can lead to a denial of service attack or potential execution of arbitrary code with kernel privileges. It is crucial to update the Linux Kernel to version v5.4.124 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
btrfs is a file system for Linux that provides advanced features such as snapshots, pooling, and integrated device management.
This vulnerability can lead to a denial of service (DoS) attack or potential execution of arbitrary code with kernel privileges.
To fix this vulnerability, update the Linux Kernel to version v5.4.124 or later.
No, there is no known workaround. Updating the Linux Kernel is the recommended solution.
For more information, refer to the vulnerability details in the Open Source Vulnerability database (https://github.com/cloudsecurityalliance/gsd-database/blob/main/2021/1000xxx/GSD-2021-1000625.json).
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
