CVE-2024-49869

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

btrfs: send: fix buffer overflow detection when copying path to cache entry

Starting with commit c0247d289e73 ("btrfs: send: annotate struct

name_cache_entry with __counted_by()") we annotated the variable length

array "name" from the name_cache_entry structure with __counted_by() to

improve overflow detection. However that alone was not correct, because

the length of that array does not match the "name_len" field - it matches

that plus 1 to include the NUL string terminator, so that makes a

fortified kernel think there's an overflow and report a splat like this:

strcpy: detected buffer overflow: 20 byte write of buffer size 19

WARNING: CPU: 3 PID: 3310 at __fortify_report+0x45/0x50

CPU: 3 UID: 0 PID: 3310 Comm: btrfs Not tainted 6.11.0-prnet #1

Hardware name: CompuLab Ltd. sbc-ihsw/Intense-PC2 (IPC2), BIOS IPC2_3.330.7 X64 03/15/2018

RIP: 0010:__fortify_report+0x45/0x50

Code: 48 8b 34 (...)

RSP: 0018

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References