Bug 1781674 (CVE-2019-19448)

Summary:	CVE-2019-19448 kernel: mounting a crafted btrfs filesystem image, performing some operations, and then making a syncfs system call can lead to a use-after-free in try_merge_free_space in fs/btrfs/free-space-cache.c
Product:	[Other] Security Response	Reporter:	Marian Rehak <mrehak>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	acaringi, airlied, bdettelb, bhu, blc, brdeoliv, bskeggs, dhoward, dvlasenk, esammons, fhrbata, hdegoede, hkrzesin, iboverma, ichavero, itamar, jarodwilson, jeremy, jforbes, jlelli, john.j5live, jonathan, josef, jross, jshortt, jstancek, jwboyer, kernel-maint, kernel-mgr, lgoncalv, linville, masami256, mchehab, mcressma, mjg59, mlangsdo, nmurray, qzhao, rt-maint, rvrbovsk, steved, williams, wmealing
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in the Linux kernel's implementation of BTRFS free space management, where the kernel does not correctly manage the lifetime of internal data structures used. An attacker could use this flaw to corrupt memory or escalate privileges.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-10-25 22:14:25 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1781675, 1804053, 1804054, 1804055
Bug Blocks:	1781677

Description Marian Rehak 2019-12-10 11:34:30 UTC

A flaw was found in the Linux kernels BTRFS implementation where a local privileged attacker can mount a crafted BRTFS disk or image, modify files from the mount point then sync() the disk image.  During the syncfs procedure, the kernel will attempt to consolidate free space and will cause a use-after-free while rebalancing an in-memory red-black tree.

This could lead to memory corruption, kernel panic and possibly privilege escalation.


External Reference:

https://github.com/bobfuzzer/CVE/tree/master/CVE-2019-19448

Comment 1 Marian Rehak 2019-12-10 11:34:51 UTC

Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1781675]

Comment 3 Wade Mealing 2020-02-18 04:59:10 UTC

This flaw is rated as a moderate as it requires above normal user privileges to mount and unmount a BTRFS filesystem in a server environment.

Comment 5 Wade Mealing 2020-02-18 05:12:06 UTC

Mitigation:


If the system requires this filesystem to work correctly, this mitigation may not be suitable.

As the BTRFS module will be auto-loaded when required, autoloading can be prevented by disabling the module, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services.

Comment 7 Justin M. Forbes 2020-10-08 19:08:35 UTC

This was fixed for Fedora with the 5.7.17 stable kernel updates.