Look up another CVE · open CVE-2024-58089 in the interactive tracker
CVE-2024-58089
btrfs: fix double accounting race when btrfs_run_delalloc_range() failed
Published 2025-03-12 (19 months ago) by the Linux kernel CNA. Subsystem fs/btrfs. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2024-58089 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | vulnerable | 6.1.190-1 | No fix published anywhere yet, neither in Debian nor upstream for the series bookworm tracks. Watch the Debian tracker page for this CVE. Advisories for bookworm have historically landed a median of 23 days after publication. |
| Debian 13trixie | fixed | 6.12.17-1 | Update the kernel and reboot. Fixed in 6.12.17-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 6.12.17-1 | Update the kernel and reboot. Fixed in 6.12.17-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 6.12.17-1 | Update the kernel and reboot. Fixed in 6.12.17-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
[BUG] When running btrfs with block size (4K) smaller than page size (64K, aarch64), there is a very high chance to crash the kernel at generic/750, with the following messages: (before the call traces, there are 3 extra debug messages added) BTRFS warning (device dm-3): read-write for sector size 4096 with page size 65536 is experimental BTRFS info (device dm-3): checking UUID tree hrtimer: interrupt took 5451385 ns BTRFS error (device dm-3): cow_file_range failed, root=4957 inode=257 start=1605632 len=69632: -28 BTRFS error (device dm-3): run_delalloc_nocow failed, root=4957 inode=257 start=1605632 len=69632: -28 BTRFS error (device dm-3): failed to run delalloc range, root=4957 ino=257 folio=1572864 submit_bitmap=8-15 start=1605632 len=69632: -28 ------------[ cut here ]------------ WARNING: CPU: 2 PID: 3020984 at ordered-data.c:360 can_finish_ordered_extent+0x370/0x3b8 [btrfs] CPU: 2 UID: 0 PID: 3020984 Comm: kworker/u24:1 Tainted: G OE 6.13.0-rc1-custom+ #89 Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE Hardware name: QEMU KVM Virtual Machine, BIOS unknown 2/2/2022 Workqueue: events_unbound btrfs_async_reclaim_data_space [btrfs] pc : can_finish_ordered_extent+0x370/0x3b8 [btrfs] lr : can_finish_ordered_extent+0x1ec/0x3b8 [btrfs] Call trace: can_finish_ordered_extent+0x370/0x3b8 [btrfs] (P) can_finish_ordered_extent+0x1ec/0x3b8 [btrfs] (L) btrfs_mark_ordered_io_finished+0x130/0x2b8 [btrfs] extent_writepage+0x10c/0x3b8 [btrfs] extent_write_cache_pages+0x21c/0x4e8 [btrfs] btrfs_writepages+0x94/0x160 [btrfs] do_writepages+0x74/0x190 filemap_fdatawrite_wbc+0x74/0xa0 start_delalloc_inodes+0x17c/0x3b0 [btrfs] btrfs_start_delalloc_roots+0x17c/0x288 [btrfs] shrink_delalloc+0x11c/0x280 [btrfs] flush_space+0x288/0x328 [btrfs] btrfs_async_reclaim_data_space+0x180/0x228 [btrfs] process_one_work+0x228/0x680 worker_thread+0x1bc/0x360 kthread+0x100/0x118 ret_from_fork+0x10/0x20 ---[ end trace 0000000000000000 ]--- BTRFS critical (device dm-3): bad ordered extent accounting, root=4957 ino=257 OE offset=1605632 OE len=16384 to_dec=16384 left=0 BTRFS critical (device dm-3): bad ordered extent accounting, root=4957 ino=257 OE offset=1622016 OE len=12288 to_dec=12288 left=0 Unable to handle kernel NULL pointer dereference at virtual address 0000000000000008 BTRFS critical (device dm-3): bad ordered extent accounting, root=4957 ino=257 OE offset=1634304 OE len=8192 to_dec=4096 left=0 CPU: 1 UID: 0 PID: 3286940 Comm: kworker/u24:3 Tainted: G W OE 6.13.0-rc1-custom+ #89 Hardware name: QEMU KVM Virtual Machine, BIOS unknown 2/2/2022 Workqueue: btrfs_work_helper [btrfs] (btrfs-endio-write) pstate: 404000c5 (nZcv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : process_one_work+0x110/0x680 lr : worker_thread+0x1bc/0x360 Call trace: process_one_work+0x110/0x680 (P) worker_thread+0x1bc/0x360 (L) worker_thread+0x1bc/0x360 kthread+0x100/0x118 ret_from_fork+0x10/0x20 Code: f84086a1 f9000fe1 53041c21 b9003361 (f9400661) ---[ end trace 0000000000000000 ]--- Kernel panic - not syncing: Oops: Fatal exception SMP: stopping secondary CPUs SMP: failed to stop secondary CPUs 2-3 Dumping ftrace buffer: (ftrace buffer empty) Kernel Offset: 0x275bb9540000 from 0xffff800080000000 PHYS_OFFSET: 0xffff8fbba0000000 CPU features: 0x100,00000070,00801250,8201720b [CAUSE] The above warning is triggered immediately after the delalloc range failure, this happens in the following sequence: - Range [1568K, 1636K) is dirty 1536K 1568K 1600K 1636K 1664K | |/////////|////////| | Where 1536K, 1600K and 1664K are page boundaries (64K page size) - Enter extent_writepage() for page 1536K - Enter run_delalloc_nocow() with locke ---truncated---
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
fs/btrfs/extent_io.c
fs/btrfs/inode.c
- What this is
- BTRFS FILE SYSTEMMAINTAINERS section matched on fs/btrfs/ · linux-btrfs@vger.kernel.org · Maintained
- Kernel module
- btrfs
Check it on the machine
grep -w CONFIG_BTRFS_FS /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
lsmod | grep -w btrfsPrints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.
Show whether Debian builds this, per release
Debian builds this as a loadable module. Every release below compiles it as a module on every flavour, so whether the code is in the running kernel depends on whether that module is loaded.
- bookworm, trixie, forky, sidm
- m
- a loadable module on every flavour - check lsmod, can be blacklisted
- Build switch
- CONFIG_BTRFS_FS
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2025-03-12 (19 months ago)source
- CVSS
- 7.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.23%, higher than 12.9% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- fs/btrfs
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 5.0 | 6.12.17 | 21333148b5c9 |
| 5.0 | 6.13.5 | 0283ee1912c8 |
| 5.0 | 6.14 | 72dad8e377af |
| 4.19.73 | 0 | 0 |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- The vulnerable path is reached through ordinary filesystem syscalls (buffered write/fallocate on a mounted btrfs) with writeback executed by a kernel worker; no network or remote peer data is involved.
- AC:LAttack complexity, low
- The attacker controls both sides of the race — they fill the filesystem to force the `btrfs_reserve_extent()` ENOSPC failure and issue the concurrent dirtying/writeback that leaves the ordered extent still in the io tree — and the upstream reproducer (generic/750) crashes with "very high chance"; subpage btrfs needs no kernel CONFIG, only a 4K-sector filesystem on a 64K/16K-page kernel, and the compressed-writeback variant exists on all page sizes.
- PR:LPrivileges required, low
- Any unprivileged local user with write access to a btrfs filesystem (e.g. /home, /var/tmp) can create prealloc extents, drive the filesystem to ENOSPC, and dirty pages; no capabilities and no mount privileges are required.
- UI:NUser interaction, none
- Exploitation needs only the attacker's own writes on an already-mounted filesystem; writeback is initiated by the kernel (shrink_delalloc/reclaim worker) with no victim action.
- S:UScope, unchanged
- The corruption is confined to kernel memory and the btrfs filesystem within the same security authority; no VM, IOMMU, or sandbox boundary is crossed.
- C:HConfidentiality impact, high
- The double `btrfs_remove_ordered_extent()`/`btrfs_put_ordered_extent()` frees the ordered-extent slab object while its embedded `btrfs_work` remains linked, giving a use-after-free on a sprayable kmem_cache object, and the duplicated extent/metadata accounting can hand the same on-disk extent to two files, exposing other users' data.
- I:HIntegrity impact, high
- The bug yields workqueue and rb-tree list corruption (re-INIT of a linked node plus double `list_add_tail`, `rb_erase` on a cleared node) and a UAF write primitive, plus doubled delalloc metadata release and `nr_ordered_extents` underflow that corrupt on-disk space accounting.
- A:HAvailability impact, high
- The upstream report shows a WARNING followed by a NULL pointer dereference in `process_one_work` and "Kernel panic - not syncing: Oops: Fatal exception"; the reachable `BUG_ON(list_empty(&root->ordered_root))` gives a second guaranteed-crash path.