CVE-2023-52737

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

btrfs: lock the inode in shared mode before starting fiemap

Currently fiemap does not take the inode's lock (VFS lock), it only locks

a file range in the inode's io tree. This however can lead to a deadlock

if we have a concurrent fsync on the file and fiemap code triggers a fault

when accessing the user space buffer with fiemap_fill_next_extent(). The

deadlock happens on the inode's i_mmap_lock semaphore, which is taken both

by fsync and btrfs_page_mkwrite(). This deadlock was recently reported by

syzbot and triggers a trace like the following:

task:syz-executor361 state:D stack:20264 pid:5668 ppid:5119 flags:0x00004004

Call Trace:

<TASK>

context_switch kernel/sched/core.c:5293 [inline]

__schedule+0x995/0xe20 kernel/sched/core.c:6606

schedule+0xcb/0x190 kernel/sched/core.c:6682

wait_on_state fs/btrfs/extent-io-tree.c:707 [inline]

wait_extent_bit+0x577/0x6f0 fs/btrfs/extent-io-tree.c

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References