Bug 2219271 (CVE-2023-4389)

Summary:	CVE-2023-4389 kernel: btrfs: double free in btrfs_get_root_ref()
Product:	[Other] Security Response	Reporter:	Dhananjay Arunesh <darunesh>
Component:	vulnerability	Assignee:	Nobody <nobody>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	acaringi, allarkin, bhu, chwhite, crwood, dbohanno, ddepaula, debarbos, dfreiber, dvlasenk, ezulian, hkrzesin, jarod, jburrell, jdenham, jfaracco, jferlan, jforbes, jlelli, joe.lawrence, jshortt, jstancek, jwyatt, kcarcia, kernel-mgr, ldoskova, lgoncalv, lleshchi, lzampier, nmurray, ptalbert, qzhao, rkeshri, rogbas, rrobaina, rvrbovsk, rysulliv, scweaver, security-response-team, tglozar, tyberry, vkumar, walters, wcosta, williams, wmealing, ycote, ymankad
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	Kernel 5.18-rc3	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in btrfs_get_root_ref in fs/btrfs/disk-io.c in the btrfs filesystem in the Linux Kernel due to a double decrement of the reference count. This issue may allow a local attacker with user privilege to crash the system or may lead to leaked internal kernel information.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2023-08-16 22:21:08 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2219285, 2219286
Bug Blocks:	2219643

Description Dhananjay Arunesh 2023-07-03 07:06:32 UTC

An error due to a double decrement of reference count was found in btrfs_get_root_ref in fs/btrfs/disk-io.c in btrfs filesystem in the Linux Kernel. In this flaw a local attacker with user privilege may lead to a system crash or may leak internal kernel information.    

In btrfs_get_root_ref(), when btrfs_insert_fs_root() fails, btrfs_put_root() will be called to possibly free the memory area of the variable root. However, this variable is then used again in error handling code after "goto fail", when ret is not -EEXIST.

References:
https://patchwork.kernel.org/project/linux-btrfs/patch/20220324134454.15192-1-baijiaju1990@gmail.com/

Comment 7 Product Security DevOps Team 2023-08-16 22:21:05 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2023-4389