CVE-2024-56758

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

btrfs: check folio mapping after unlock in relocate_one_folio()

When we call btrfs_read_folio() to bring a folio uptodate, we unlock the

folio. The result of that is that a different thread can modify the

mapping (like remove it with invalidate) before we call folio_lock().

This results in an invalid page and we need to try again.

In particular, if we are relocating concurrently with aborting a

transaction, this can result in a crash like the following:

BUG: kernel NULL pointer dereference, address: 0000000000000000

PGD 0 P4D 0

Oops: 0000 [#1] SMP

CPU: 76 PID: 1411631 Comm: kworker/u322:5

Workqueue: events_unbound btrfs_reclaim_bgs_work

RIP: 0010:set_page_extent_mapped+0x20/0xb0

RSP: 0018:ffffc900516a7be8 EFLAGS: 00010246

RAX: ffffea009e851d08 RBX: ffffea009e0b1880 RCX: 0000000000000000

RDX: 0000000000000000 RSI: ffffc900516a7b90 RDI: ffffea009e0b1880

RBP: 0000000003573000 R08: 0000000000000001

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References