Bug 2181342 (CVE-2023-1611)

Summary: CVE-2023-1611 Kernel: race between quota disable and quota assign ioctls in fs/btrfs/ioctl.c
Product: [Other] Security Response Reporter: Rohit Keshri <rkeshri>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED WONTFIX QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: acaringi, allarkin, bhu, chwhite, crwood, dbohanno, ddepaula, debarbos, dfreiber, dvlasenk, ezulian, hkrzesin, jarod, jburrell, jdenham, jfaracco, jferlan, jforbes, jlelli, joe.lawrence, jshortt, jstancek, jwyatt, kcarcia, kernel-mgr, ldoskova, lgoncalv, lleshchi, lzampier, nmurray, ptalbert, qzhao, rogbas, rrobaina, rvrbovsk, rysulliv, scweaver, tyberry, vkumar, walters, wcosta, williams, wmealing, ycote
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Fixed In Version: kernel 5.10.177, kernel 5.15.106, kernel 6.1.23, kernel 6.2.10 Doc Type: If docs needed, set a value
Doc Text:
A use-after-free flaw was found in btrfs_search_slot in fs/btrfs/ctree.c in btrfs in the Linux Kernel. This flaw allows an attacker to crash the system and possibly cause a kernel information lea
Story Points: ---
Clone Of: Environment:
Last Closed: 2023-03-23 22:17:17 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 2181346    
Bug Blocks: 2181257    

Description Rohit Keshri 2023-03-23 18:18:46 UTC
A slab-use-after-free read flaw was found in btrfs_search_slot in fs/btrfs/ctree.c

The quota assigned ioctl can currently run in parallel with a quota disable ioctl call. The assign ioctl uses the quota root, while the disable ioctl frees that root, and therefore we can have a use-after-free triggered in the assign ioctl.


Comment 2 Rohit Keshri 2023-03-23 18:46:48 UTC
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 2181346]

Comment 4 Product Security DevOps Team 2023-03-23 22:17:14 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):