CVE-2024-56759
Published: 06 January 2025
Description
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix use-after-free when COWing tree bock and tracing is enabled When a COWing a tree block, at btrfs_cow_block(), and we have the tracepoint trace_btrfs_cow_block() enabled and preemption is also enabled (CONFIG_PREEMPT=y), we can trigger a use-after-free in the COWed extent buffer while inside the tracepoint code. This is because in some paths that call btrfs_cow_block(), such as btrfs_search_slot(), we are holding the last reference on the extent buffer @buf so btrfs_force_cow_block() drops the last reference on the @buf extent buffer when it calls free_extent_buffer_stale(buf), which schedules the release of the extent buffer with RCU. This means that if we are on a kernel with preemption, the current task may be preempted before calling trace_btrfs_cow_block() and the extent buffer already released by the time trace_btrfs_cow_block() is called, resulting in a use-after-free. Fix this by moving the trace_btrfs_cow_block() from btrfs_cow_block() to btrfs_force_cow_block() before the COWed extent buffer is freed. This also has a side effect of invoking the tracepoint in the tree defrag code, at defrag.c:btrfs_realloc_node(), since btrfs_force_cow_block() is called there, but this is fine and it was actually missing there.
Security Summary
CVE-2024-56759 is a use-after-free vulnerability in the Linux kernel's BTRFS filesystem. It occurs during copy-on-write (COW) operations on tree blocks in btrfs_cow_block() when the trace_btrfs_cow_block() tracepoint is enabled and kernel preemption is active (CONFIG_PREEMPT=y). In affected paths like btrfs_search_slot(), the code holds the last reference to the extent buffer, which btrfs_force_cow_block() releases via free_extent_buffer_stale(), scheduling deferred release through RCU. Preemption can then allow another task to free the buffer before the tracepoint accesses it, leading to the use-after-free (CWE-416). The vulnerability carries a CVSS v3.1 base score of 7.8.
A local attacker with low privileges (PR:L) can exploit this with low complexity (AC:L) and no user interaction (UI:N), achieving high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H) in an unprivileged scope (S:U). Exploitation requires conditions including BTRFS usage, enabled tracing, and preemption, potentially allowing memory corruption, denial of service, or code execution via the freed extent buffer.
Mitigation involves applying upstream patches from the Linux kernel stable repository, such as commits 44f52bbe96df (and others listed in references). The fix relocates the trace_btrfs_cow_block() call to btrfs_force_cow_block() before the extent buffer is freed, preventing the race; this also adds tracing to the tree defrag path in btrfs_realloc_node() without adverse effects. Security practitioners should update affected kernels and review tracepoint configurations in BTRFS environments.
Details
- CWE(s)