CVE-2024-35949

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

btrfs: make sure that WRITTEN is set on all metadata blocks

We previously would call btrfs_check_leaf() if we had the check

integrity code enabled, which meant that we could only run the extended

leaf checks if we had WRITTEN set on the header flags.

This leaves a gap in our checking, because we could end up with

corruption on disk where WRITTEN isn't set on the leaf, and then the

extended leaf checks don't get run which we rely on to validate all of

the item pointers to make sure we don't access memory outside of the

extent buffer.

However, since 732fab95abe2 ("btrfs: check-integrity: remove

CONFIG_BTRFS_FS_CHECK_INTEGRITY option") we no longer call

btrfs_check_leaf() from btrfs_mark_buffer_dirty(), which means we only

ever call it on blocks that are being written out, and thus have WRITTEN

set, or that are being read in, which should have WRITTEN set.

Add checks to make sure we have WRITTEN set appropriately, an

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References