CVE-2023-53243

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

btrfs: add handling for RAID1C23/DUP to btrfs_reduce_alloc_profile

Callers of `btrfs_reduce_alloc_profile` expect it to return exactly

one allocation profile flag, and failing to do so may ultimately

result in a WARN_ON and remount-ro when allocating new blocks, like

the below transaction abort on 6.1.

`btrfs_reduce_alloc_profile` has two ways of determining the profile,

first it checks if a conversion balance is currently running and

uses the profile we're converting to. If no balance is currently

running, it returns the max-redundancy profile which at least one

block in the selected block group has.

This works by simply checking each known allocation profile bit in

redundancy order. However, `btrfs_reduce_alloc_profile` has not been

updated as new flags have been added - first with the `DUP` profile

and later with the RAID1C34 profiles.

Because of the way it checks, if we have blocks with different

profiles and

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References