CVE-2024-27080

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

btrfs: fix race when detecting delalloc ranges during fiemap

For fiemap we recently stopped locking the target extent range for the

whole duration of the fiemap call, in order to avoid a deadlock in a

scenario where the fiemap buffer happens to be a memory mapped range of

the same file. This use case is very unlikely to be useful in practice but

it may be triggered by fuzz testing (syzbot, etc).

This however introduced a race that makes us miss delalloc ranges for

file regions that are currently holes, so the caller of fiemap will not

be aware that there's data for some file regions. This can be quite

serious for some use cases - for example in coreutils versions before 9.0,

the cp program used fiemap to detect holes and data in the source file,

copying only regions with data (extents or delalloc) from the source file

to the destination file in order to preserve holes (see the documentation

for its --sparse command

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References