Bug 2219271 (CVE-2023-4389) - CVE-2023-4389 kernel: btrfs: double free in btrfs_get_root_ref()
Summary: CVE-2023-4389 kernel: btrfs: double free in btrfs_get_root_ref()
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2023-4389
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Nobody
QA Contact:
URL:
Whiteboard:
Depends On: 2219285 2219286
Blocks: 2219643
TreeView+ depends on / blocked
 
Reported: 2023-07-03 07:06 UTC by Dhananjay Arunesh
Modified: 2023-09-23 18:37 UTC (History)
48 users (show)

Fixed In Version: Kernel 5.18-rc3
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in btrfs_get_root_ref in fs/btrfs/disk-io.c in the btrfs filesystem in the Linux Kernel due to a double decrement of the reference count. This issue may allow a local attacker with user privilege to crash the system or may lead to leaked internal kernel information.
Clone Of:
Environment:
Last Closed: 2023-08-16 22:21:08 UTC
Embargoed:


Attachments (Terms of Use)

Description Dhananjay Arunesh 2023-07-03 07:06:32 UTC
An error due to a double decrement of reference count was found in btrfs_get_root_ref in fs/btrfs/disk-io.c in btrfs filesystem in the Linux Kernel. In this flaw a local attacker with user privilege may lead to a system crash or may leak internal kernel information.    

In btrfs_get_root_ref(), when btrfs_insert_fs_root() fails, btrfs_put_root() will be called to possibly free the memory area of the variable root. However, this variable is then used again in error handling code after "goto fail", when ret is not -EEXIST.

References:
https://patchwork.kernel.org/project/linux-btrfs/patch/20220324134454.15192-1-baijiaju1990@gmail.com/

Comment 7 Product Security DevOps Team 2023-08-16 22:21:05 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2023-4389


Note You need to log in before you can comment on or make changes to this bug.