CVE-2024-35956

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

btrfs: qgroup: fix qgroup prealloc rsv leak in subvolume operations

Create subvolume, create snapshot and delete subvolume all use

btrfs_subvolume_reserve_metadata() to reserve metadata for the changes

done to the parent subvolume's fs tree, which cannot be mediated in the

normal way via start_transaction. When quota groups (squota or qgroups)

are enabled, this reserves qgroup metadata of type PREALLOC. Once the

operation is associated to a transaction, we convert PREALLOC to

PERTRANS, which gets cleared in bulk at the end of the transaction.

However, the error paths of these three operations were not implementing

this lifecycle correctly. They unconditionally converted the PREALLOC to

PERTRANS in a generic cleanup step regardless of errors or whether the

operation was fully associated to a transaction or not. This resulted in

error paths occasionally converting this rsv to PERTRANS without calling

record_root_in_tr

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References