btrfs: take commit root semaphore when iterating in mark_block_group_to_copy()
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 6.6.160, 6.12.112, 6.18.54, 7.2.8
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
In the Linux kernel, the following vulnerability has been resolved: btrfs: take commit root semaphore when iterating in mark_block_group_to_copy() mark_block_group_to_copy() iterates over the commit root with skip_locking=true. A concurrent transaction commit can swap and free the commit root during iteration, causing use-after-free when accessing extent buffers. Fix it by using path->need_commit_sem to protect the commit root search.
Timeline
- CVE published
- Record last updated
Affected versions
- Linux Linux
From 78ce9fc269af6e69c1399ab910ba6bc81c934f67 · fixed in 93a025166495c63ba5b8ac721c7040d5312e8335; From 78ce9fc269af6e69c1399ab910ba6bc81c934f67 · fixed in 8e2007b263ea250251ec3021a0a197da990ee1a8; From 78ce9fc269af6e69c1399ab910ba6bc81c934f67 · fixed in 709f6a5e986535005110c6c69b322f63631cb200; From 78ce9fc269af6e69c1399ab910ba6bc81c934f67 · fixed in c32490c6d3f3a9f2d177d57c7eb8bbc347561d08; From 78ce9fc269af6e69c1399ab910ba6bc81c934f67 · fixed in 0594e3423f4ba3137c734371169491f9a98e9af4
- Linux Linux
5.12
- KernelLinux
From 5.12.0 · fixed in 6.6.160; From 6.7.0 · fixed in 6.12.112; From 6.13.0 · fixed in 6.18.54; From 6.19.0 · fixed in 7.2.8