CVE-2023-54158

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

btrfs: don't free qgroup space unless specified

Boris noticed in his simple quotas testing that he was getting a leak

with Sweet Tea's change to subvol create that stopped doing a

transaction commit. This was just a side effect of that change.

In the delayed inode code we have an optimization that will free extra

reservations if we think we can pack a dir item into an already modified

leaf. Previously this wouldn't be triggered in the subvolume create

case because we'd commit the transaction, it was still possible but

much harder to trigger. It could actually be triggered if we did a

mkdir && subvol create with qgroups enabled.

This occurs because in btrfs_insert_delayed_dir_index(), which gets

called when we're adding the dir item, we do the following:

btrfs_block_rsv_release(fs_info, trans->block_rsv, bytes, NULL);

if we're able to skip reserving space.

The problem here is that trans->block_rsv points at

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References