CVE-2024-35798

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-35798
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix race in read_extent_buffer_pages() There are reports from tree-checker that detects corrupted nodes, without any obvious pattern so possibly an overwrite in memory. After some debugging it turns out there's a race when reading an extent buffer the uptodate status can be missed. To prevent concurrent reads for the same extent buffer, read_extent_buffer_pages() performs these checks: /* (1) */ if (test_bit(EXTENT_BUFFER_UPTODATE, &eb->bflags)) return 0; /* (2) */ if (test_and_set_bit(EXTENT_BUFFER_READING, &eb->bflags)) goto done; At this point, it seems safe to start the actual read operation. Once that completes, end_bbio_meta_read() does /* (3) */ set_extent_buffer_uptodate(eb); /* (4) */ clear_bit(EXTENT_BUFFER_READING, &eb->bflags); Normally, this is enough to ensure only one read happens, and all other callers wait for it to finish before returning. Unfortunately, there is a racey interleaving: Thread A | Thread B | Thread C ---------+----------+--------- (1) | | | (1) | (2) | | (3) | | (4) | | | (2) | | | (1) When this happens, thread B kicks of an unnecessary read. Worse, thread C will see UPTODATE set and return immediately, while the read from thread B is still in progress. This race could result in tree-checker errors like this as the extent buffer is concurrently modified: BTRFS critical (device dm-0): corrupted node, root=256 block=8550954455682405139 owner mismatch, have 11858205567642294356 expect [256, 18446744073709551360] Fix it by testing UPTODATE again after setting the READING bit, and if it's been set, skip the unnecessary read. [ minor update of changelog ]

4.7 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.0 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/0427c8ef8bbb7f304de42ef51d69c960e165e052 Patch
https://git.kernel.org/stable/c/2885d54af2c2e1d910e20d5c8045bae40e02fbc1 Patch
https://git.kernel.org/stable/c/3a25878a3378adce5d846300c9570f15aa7f7a80 Patch
https://git.kernel.org/stable/c/ef1e68236b9153c27cb7cf29ead0c532870d4215 Patch
https://git.kernel.org/stable/c/0427c8ef8bbb7f304de42ef51d69c960e165e052 Patch
https://git.kernel.org/stable/c/2885d54af2c2e1d910e20d5c8045bae40e02fbc1 Patch
https://git.kernel.org/stable/c/3a25878a3378adce5d846300c9570f15aa7f7a80 Patch
https://git.kernel.org/stable/c/ef1e68236b9153c27cb7cf29ead0c532870d4215 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*
History

19 Sep 2025, 15:13

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 4.7
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*
First Time Linux
Linux linux Kernel
CWE CWE-362
References () https://git.kernel.org/stable/c/0427c8ef8bbb7f304de42ef51d69c960e165e052 - () https://git.kernel.org/stable/c/0427c8ef8bbb7f304de42ef51d69c960e165e052 - Patch
References () https://git.kernel.org/stable/c/2885d54af2c2e1d910e20d5c8045bae40e02fbc1 - () https://git.kernel.org/stable/c/2885d54af2c2e1d910e20d5c8045bae40e02fbc1 - Patch
References () https://git.kernel.org/stable/c/3a25878a3378adce5d846300c9570f15aa7f7a80 - () https://git.kernel.org/stable/c/3a25878a3378adce5d846300c9570f15aa7f7a80 - Patch
References () https://git.kernel.org/stable/c/ef1e68236b9153c27cb7cf29ead0c532870d4215 - () https://git.kernel.org/stable/c/ef1e68236b9153c27cb7cf29ead0c532870d4215 - Patch

21 Nov 2024, 09:20

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/0427c8ef8bbb7f304de42ef51d69c960e165e052 - () https://git.kernel.org/stable/c/0427c8ef8bbb7f304de42ef51d69c960e165e052 -
References () https://git.kernel.org/stable/c/2885d54af2c2e1d910e20d5c8045bae40e02fbc1 - () https://git.kernel.org/stable/c/2885d54af2c2e1d910e20d5c8045bae40e02fbc1 -
References () https://git.kernel.org/stable/c/3a25878a3378adce5d846300c9570f15aa7f7a80 - () https://git.kernel.org/stable/c/3a25878a3378adce5d846300c9570f15aa7f7a80 -
References () https://git.kernel.org/stable/c/ef1e68236b9153c27cb7cf29ead0c532870d4215 - () https://git.kernel.org/stable/c/ef1e68236b9153c27cb7cf29ead0c532870d4215 -
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: btrfs: corrige la ejecución en read_extent_buffer_pages() Hay informes de tree-checker que detecta nodos corruptos, sin ningún patrón obvio por lo que posiblemente se sobrescriba en la memoria. Después de un poco de depuración, resulta que hay una ejecución cuando al leer un búfer de extensión se puede perder el estado de actualización. Para evitar lecturas simultáneas para el mismo búfer de extensión, read_extent_buffer_pages() realiza estas comprobaciones: /* (1) */ if (test_bit(EXTENT_BUFFER_UPTODATE, &eb->bflags)) return 0; /* (2) */ if (test_and_set_bit(EXTENT_BUFFER_READING, &eb->bflags)) ir a listo; En este punto, parece seguro iniciar la operación de lectura real. Una vez que se completa, end_bbio_meta_read() hace /* (3) */ set_extent_buffer_uptodate(eb); /* (4) */ clear_bit(EXTENT_BUFFER_READING, &eb->bflags); Normalmente, esto es suficiente para garantizar que solo se realice una lectura y que todos los demás llamantes esperen a que finalice antes de regresar. Desafortunadamente, hay un entrelazado racial: Hilo A | Hilo B | Rosca C ---------+----------+----------------- (1) | | | (1) | (2) | | (3) | | (4) | | | (2) | | | (1) Cuando esto sucede, el hilo B inicia una lectura innecesaria. Peor aún, el subproceso C verá la ACTUALIZACIÓN configurada y regresará inmediatamente, mientras la lectura del subproceso B aún está en progreso. Esta ejecución podría dar como resultado errores del comprobador de árbol como este, ya que el búfer de extensión se modifica simultáneamente: BTRFS crítico (dispositivo dm-0): nodo dañado, raíz=256 bloque=8550954455682405139 el propietario no coincide, tiene 11858205567642294356 expect [256, 18446744073709551360] Arreglarlo probando UPTODATE nuevamente después de configurar el bit de LECTURA y, si se ha configurado, omita la lectura innecesaria. [actualización menor del registro de cambios]

17 May 2024, 14:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-05-17 14:15

Updated : 2025-09-19 15:13

NVD link : CVE-2024-35798

Mitre link : CVE-2024-35798

CVE.ORG link : CVE-2024-35798

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')