CVE-2024-50217

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> btrfs: fix use-after-free of block device file in __btrfs_free_extra_devids()<br /> <br /> Mounting btrfs from two images (which have the same one fsid and two<br /> different dev_uuids) in certain executing order may trigger an UAF for<br /> variable &amp;#39;device-&gt;bdev_file&amp;#39; in __btrfs_free_extra_devids(). And<br /> following are the details:<br /> <br /> 1. Attach image_1 to loop0, attach image_2 to loop1, and scan btrfs<br /> devices by ioctl(BTRFS_IOC_SCAN_DEV):<br /> <br /> / btrfs_device_1 → loop0<br /> fs_device<br /> \ btrfs_device_2 → loop1<br /> 2. mount /dev/loop0 /mnt<br /> btrfs_open_devices<br /> btrfs_device_1-&gt;bdev_file = btrfs_get_bdev_and_sb(loop0)<br /> btrfs_device_2-&gt;bdev_file = btrfs_get_bdev_and_sb(loop1)<br /> btrfs_fill_super<br /> open_ctree<br /> fail: btrfs_close_devices // -ENOMEM<br /> btrfs_close_bdev(btrfs_device_1)<br /> fput(btrfs_device_1-&gt;bdev_file)<br /> // btrfs_device_1-&gt;bdev_file is freed<br /> btrfs_close_bdev(btrfs_device_2)<br /> fput(btrfs_device_2-&gt;bdev_file)<br /> <br /> 3. mount /dev/loop1 /mnt<br /> btrfs_open_devices<br /> btrfs_get_bdev_and_sb(&amp;bdev_file)<br /> // EIO, btrfs_device_1-&gt;bdev_file is not assigned,<br /> // which points to a freed memory area<br /> btrfs_device_2-&gt;bdev_file = btrfs_get_bdev_and_sb(loop1)<br /> btrfs_fill_super<br /> open_ctree<br /> btrfs_free_extra_devids<br /> if (btrfs_device_1-&gt;bdev_file)<br /> fput(btrfs_device_1-&gt;bdev_file) // UAF !<br /> <br /> Fix it by setting &amp;#39;device-&gt;bdev_file&amp;#39; as &amp;#39;NULL&amp;#39; after closing the<br /> btrfs_device in btrfs_close_one_device().