linux-cve-announce - CVE-2024-46840: btrfs: clean up our handling of refs == 0 in snapshot delete

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2024092754-CVE-2024-46840-fc44@gregkh>
Date: Fri, 27 Sep 2024 14:40:08 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: CVE-2024-46840: btrfs: clean up our handling of refs == 0 in snapshot delete

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

btrfs: clean up our handling of refs == 0 in snapshot delete

In reada we BUG_ON(refs == 0), which could be unkind since we aren't
holding a lock on the extent leaf and thus could get a transient
incorrect answer.  In walk_down_proc we also BUG_ON(refs == 0), which
could happen if we have extent tree corruption.  Change that to return
-EUCLEAN.  In do_walk_down() we catch this case and handle it correctly,
however we return -EIO, which -EUCLEAN is a more appropriate error code.
Finally in walk_up_proc we have the same BUG_ON(refs == 0), so convert
that to proper error handling.  Also adjust the error message so we can
actually do something with the information.

The Linux kernel CVE team has assigned CVE-2024-46840 to this issue.


Affected and fixed versions
===========================

	Fixed in 4.19.322 with commit c847b28a7997
	Fixed in 5.4.284 with commit 71291aa72466
	Fixed in 5.10.226 with commit c60676b81fab
	Fixed in 5.15.167 with commit 728d4d045b62
	Fixed in 6.1.110 with commit 9cc887ac24b7
	Fixed in 6.6.51 with commit 7d1df13bf078
	Fixed in 6.10.10 with commit 03804641ec2d
	Fixed in 6.11 with commit b8ccef048354

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2024-46840
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	fs/btrfs/extent-tree.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/c847b28a799733b04574060ab9d00f215970627d
	https://git.kernel.org/stable/c/71291aa7246645ef622621934d2067400380645e
	https://git.kernel.org/stable/c/c60676b81fab456b672796830f6d8057058f029c
	https://git.kernel.org/stable/c/728d4d045b628e006b48a448f3326a7194c88d32
	https://git.kernel.org/stable/c/9cc887ac24b7a0598f4042ae9af6b9a33072f75b
	https://git.kernel.org/stable/c/7d1df13bf078ffebfedd361d714ff6cee1ff01b9
	https://git.kernel.org/stable/c/03804641ec2d0da4fa088ad21c88e703d151ce16
	https://git.kernel.org/stable/c/b8ccef048354074a548f108e51d0557d6adfd3a3