CVE-2024-57806 (GCVE-0-2024-57806)
Vulnerability from cvelistv5
Published
2025-01-11 12:39
Modified
2025-05-04 10:05
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
btrfs: fix transaction atomicity bug when enabling simple quotas
Set squota incompat bit before committing the transaction that enables
the feature.
With the config CONFIG_BTRFS_ASSERT enabled, an assertion
failure occurs regarding the simple quota feature.
[5.596534] assertion failed: btrfs_fs_incompat(fs_info, SIMPLE_QUOTA), in fs/btrfs/qgroup.c:365
[5.597098] ------------[ cut here ]------------
[5.597371] kernel BUG at fs/btrfs/qgroup.c:365!
[5.597946] CPU: 1 UID: 0 PID: 268 Comm: mount Not tainted 6.13.0-rc2-00031-gf92f4749861b #146
[5.598450] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[5.599008] RIP: 0010:btrfs_read_qgroup_config+0x74d/0x7a0
[5.604303] <TASK>
[5.605230] ? btrfs_read_qgroup_config+0x74d/0x7a0
[5.605538] ? exc_invalid_op+0x56/0x70
[5.605775] ? btrfs_read_qgroup_config+0x74d/0x7a0
[5.606066] ? asm_exc_invalid_op+0x1f/0x30
[5.606441] ? btrfs_read_qgroup_config+0x74d/0x7a0
[5.606741] ? btrfs_read_qgroup_config+0x74d/0x7a0
[5.607038] ? try_to_wake_up+0x317/0x760
[5.607286] open_ctree+0xd9c/0x1710
[5.607509] btrfs_get_tree+0x58a/0x7e0
[5.608002] vfs_get_tree+0x2e/0x100
[5.608224] fc_mount+0x16/0x60
[5.608420] btrfs_get_tree+0x2f8/0x7e0
[5.608897] vfs_get_tree+0x2e/0x100
[5.609121] path_mount+0x4c8/0xbc0
[5.609538] __x64_sys_mount+0x10d/0x150
The issue can be easily reproduced using the following reproducer:
root@q:linux# cat repro.sh
set -e
mkfs.btrfs -q -f /dev/sdb
mount /dev/sdb /mnt/btrfs
btrfs quota enable -s /mnt/btrfs
umount /mnt/btrfs
mount /dev/sdb /mnt/btrfs
The issue is that when enabling quotas, at btrfs_quota_enable(), we set
BTRFS_QGROUP_STATUS_FLAG_SIMPLE_MODE at fs_info->qgroup_flags and persist
it in the quota root in the item with the key BTRFS_QGROUP_STATUS_KEY, but
we only set the incompat bit BTRFS_FEATURE_INCOMPAT_SIMPLE_QUOTA after we
commit the transaction used to enable simple quotas.
This means that if after that transaction commit we unmount the filesystem
without starting and committing any other transaction, or we have a power
failure, the next time we mount the filesystem we will find the flag
BTRFS_QGROUP_STATUS_FLAG_SIMPLE_MODE set in the item with the key
BTRFS_QGROUP_STATUS_KEY but we will not find the incompat bit
BTRFS_FEATURE_INCOMPAT_SIMPLE_QUOTA set in the superblock, triggering an
assertion failure at:
btrfs_read_qgroup_config() -> qgroup_read_enable_gen()
To fix this issue, set the BTRFS_FEATURE_INCOMPAT_SIMPLE_QUOTA flag
immediately after setting the BTRFS_QGROUP_STATUS_FLAG_SIMPLE_MODE.
This ensures that both flags are flushed to disk within the same
transaction.
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/btrfs/qgroup.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b87c9b9ba05ba6e8e2ee9ecd29a8c930b35648ed",
"status": "affected",
"version": "182940f4f4dbd932776414744c8de64333957725",
"versionType": "git"
},
{
"lessThan": "f2363e6fcc7938c5f0f6ac066fad0dd247598b51",
"status": "affected",
"version": "182940f4f4dbd932776414744c8de64333957725",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/btrfs/qgroup.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.7"
},
{
"lessThan": "6.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.13",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.8",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.13",
"versionStartIncluding": "6.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix transaction atomicity bug when enabling simple quotas\n\nSet squota incompat bit before committing the transaction that enables\nthe feature.\n\nWith the config CONFIG_BTRFS_ASSERT enabled, an assertion\nfailure occurs regarding the simple quota feature.\n\n [5.596534] assertion failed: btrfs_fs_incompat(fs_info, SIMPLE_QUOTA), in fs/btrfs/qgroup.c:365\n [5.597098] ------------[ cut here ]------------\n [5.597371] kernel BUG at fs/btrfs/qgroup.c:365!\n [5.597946] CPU: 1 UID: 0 PID: 268 Comm: mount Not tainted 6.13.0-rc2-00031-gf92f4749861b #146\n [5.598450] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014\n [5.599008] RIP: 0010:btrfs_read_qgroup_config+0x74d/0x7a0\n [5.604303] \u003cTASK\u003e\n [5.605230] ? btrfs_read_qgroup_config+0x74d/0x7a0\n [5.605538] ? exc_invalid_op+0x56/0x70\n [5.605775] ? btrfs_read_qgroup_config+0x74d/0x7a0\n [5.606066] ? asm_exc_invalid_op+0x1f/0x30\n [5.606441] ? btrfs_read_qgroup_config+0x74d/0x7a0\n [5.606741] ? btrfs_read_qgroup_config+0x74d/0x7a0\n [5.607038] ? try_to_wake_up+0x317/0x760\n [5.607286] open_ctree+0xd9c/0x1710\n [5.607509] btrfs_get_tree+0x58a/0x7e0\n [5.608002] vfs_get_tree+0x2e/0x100\n [5.608224] fc_mount+0x16/0x60\n [5.608420] btrfs_get_tree+0x2f8/0x7e0\n [5.608897] vfs_get_tree+0x2e/0x100\n [5.609121] path_mount+0x4c8/0xbc0\n [5.609538] __x64_sys_mount+0x10d/0x150\n\nThe issue can be easily reproduced using the following reproducer:\n\n root@q:linux# cat repro.sh\n set -e\n\n mkfs.btrfs -q -f /dev/sdb\n mount /dev/sdb /mnt/btrfs\n btrfs quota enable -s /mnt/btrfs\n umount /mnt/btrfs\n mount /dev/sdb /mnt/btrfs\n\nThe issue is that when enabling quotas, at btrfs_quota_enable(), we set\nBTRFS_QGROUP_STATUS_FLAG_SIMPLE_MODE at fs_info-\u003eqgroup_flags and persist\nit in the quota root in the item with the key BTRFS_QGROUP_STATUS_KEY, but\nwe only set the incompat bit BTRFS_FEATURE_INCOMPAT_SIMPLE_QUOTA after we\ncommit the transaction used to enable simple quotas.\n\nThis means that if after that transaction commit we unmount the filesystem\nwithout starting and committing any other transaction, or we have a power\nfailure, the next time we mount the filesystem we will find the flag\nBTRFS_QGROUP_STATUS_FLAG_SIMPLE_MODE set in the item with the key\nBTRFS_QGROUP_STATUS_KEY but we will not find the incompat bit\nBTRFS_FEATURE_INCOMPAT_SIMPLE_QUOTA set in the superblock, triggering an\nassertion failure at:\n\n btrfs_read_qgroup_config() -\u003e qgroup_read_enable_gen()\n\nTo fix this issue, set the BTRFS_FEATURE_INCOMPAT_SIMPLE_QUOTA flag\nimmediately after setting the BTRFS_QGROUP_STATUS_FLAG_SIMPLE_MODE.\nThis ensures that both flags are flushed to disk within the same\ntransaction."
}
],
"providerMetadata": {
"dateUpdated": "2025-05-04T10:05:14.076Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b87c9b9ba05ba6e8e2ee9ecd29a8c930b35648ed"
},
{
"url": "https://git.kernel.org/stable/c/f2363e6fcc7938c5f0f6ac066fad0dd247598b51"
}
],
"title": "btrfs: fix transaction atomicity bug when enabling simple quotas",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2024-57806",
"datePublished": "2025-01-11T12:39:52.628Z",
"dateReserved": "2025-01-11T12:32:49.322Z",
"dateUpdated": "2025-05-04T10:05:14.076Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2024-57806\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-01-11T13:15:30.597\",\"lastModified\":\"2025-01-11T13:15:30.597\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbtrfs: fix transaction atomicity bug when enabling simple quotas\\n\\nSet squota incompat bit before committing the transaction that enables\\nthe feature.\\n\\nWith the config CONFIG_BTRFS_ASSERT enabled, an assertion\\nfailure occurs regarding the simple quota feature.\\n\\n [5.596534] assertion failed: btrfs_fs_incompat(fs_info, SIMPLE_QUOTA), in fs/btrfs/qgroup.c:365\\n [5.597098] ------------[ cut here ]------------\\n [5.597371] kernel BUG at fs/btrfs/qgroup.c:365!\\n [5.597946] CPU: 1 UID: 0 PID: 268 Comm: mount Not tainted 6.13.0-rc2-00031-gf92f4749861b #146\\n [5.598450] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014\\n [5.599008] RIP: 0010:btrfs_read_qgroup_config+0x74d/0x7a0\\n [5.604303] \u003cTASK\u003e\\n [5.605230] ? btrfs_read_qgroup_config+0x74d/0x7a0\\n [5.605538] ? exc_invalid_op+0x56/0x70\\n [5.605775] ? btrfs_read_qgroup_config+0x74d/0x7a0\\n [5.606066] ? asm_exc_invalid_op+0x1f/0x30\\n [5.606441] ? btrfs_read_qgroup_config+0x74d/0x7a0\\n [5.606741] ? btrfs_read_qgroup_config+0x74d/0x7a0\\n [5.607038] ? try_to_wake_up+0x317/0x760\\n [5.607286] open_ctree+0xd9c/0x1710\\n [5.607509] btrfs_get_tree+0x58a/0x7e0\\n [5.608002] vfs_get_tree+0x2e/0x100\\n [5.608224] fc_mount+0x16/0x60\\n [5.608420] btrfs_get_tree+0x2f8/0x7e0\\n [5.608897] vfs_get_tree+0x2e/0x100\\n [5.609121] path_mount+0x4c8/0xbc0\\n [5.609538] __x64_sys_mount+0x10d/0x150\\n\\nThe issue can be easily reproduced using the following reproducer:\\n\\n root@q:linux# cat repro.sh\\n set -e\\n\\n mkfs.btrfs -q -f /dev/sdb\\n mount /dev/sdb /mnt/btrfs\\n btrfs quota enable -s /mnt/btrfs\\n umount /mnt/btrfs\\n mount /dev/sdb /mnt/btrfs\\n\\nThe issue is that when enabling quotas, at btrfs_quota_enable(), we set\\nBTRFS_QGROUP_STATUS_FLAG_SIMPLE_MODE at fs_info-\u003eqgroup_flags and persist\\nit in the quota root in the item with the key BTRFS_QGROUP_STATUS_KEY, but\\nwe only set the incompat bit BTRFS_FEATURE_INCOMPAT_SIMPLE_QUOTA after we\\ncommit the transaction used to enable simple quotas.\\n\\nThis means that if after that transaction commit we unmount the filesystem\\nwithout starting and committing any other transaction, or we have a power\\nfailure, the next time we mount the filesystem we will find the flag\\nBTRFS_QGROUP_STATUS_FLAG_SIMPLE_MODE set in the item with the key\\nBTRFS_QGROUP_STATUS_KEY but we will not find the incompat bit\\nBTRFS_FEATURE_INCOMPAT_SIMPLE_QUOTA set in the superblock, triggering an\\nassertion failure at:\\n\\n btrfs_read_qgroup_config() -\u003e qgroup_read_enable_gen()\\n\\nTo fix this issue, set the BTRFS_FEATURE_INCOMPAT_SIMPLE_QUOTA flag\\nimmediately after setting the BTRFS_QGROUP_STATUS_FLAG_SIMPLE_MODE.\\nThis ensures that both flags are flushed to disk within the same\\ntransaction.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: btrfs: se corrige el error de atomicidad de transacciones al habilitar cuotas simples. Establezca el bit de incompatibilidad de squota antes de confirmar la transacci\u00f3n que habilita la funci\u00f3n. Con la configuraci\u00f3n CONFIG_BTRFS_ASSERT habilitada, se produce un error de afirmaci\u00f3n con respecto a la funci\u00f3n de cuota simple. [5.596534] Error de afirmaci\u00f3n: btrfs_fs_incompat(fs_info, SIMPLE_QUOTA), en fs/btrfs/qgroup.c:365 [5.597098] ------------[ corte aqu\u00ed ]------------ [5.597371] \u00a1ERROR del kernel en fs/btrfs/qgroup.c:365! [5.597946] CPU: 1 UID: 0 PID: 268 Comm: montaje No contaminado 6.13.0-rc2-00031-gf92f4749861b #146 [5.598450] Nombre del hardware: PC est\u00e1ndar QEMU (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 01/04/2014 [5.599008] RIP: 0010:btrfs_read_qgroup_config+0x74d/0x7a0 [5.604303] [5.605230] ? btrfs_read_qgroup_config+0x74d/0x7a0 [5.605538] ? asm_exc_invalid_op+0x1f/0x30 [5.606441] ? btrfs_read_qgroup_config+0x74d/0x7a0 [5.606741] ? btrfs_read_qgroup_config+0x74d/0x7a0 [5.607038] ? intentar_activar+0x317/0x760 [5.607286] abrir_ctree+0xd9c/0x1710 [5.607509] btrfs_get_tree+0x58a/0x7e0 [5.608002] vfs_get_tree+0x2e/0x100 [5.608224] montaje_fc+0x16/0x60 [5.608420] btrfs_get_tree+0x2f8/0x7e0 [5.608897] vfs_get_tree+0x2e/0x100 [5.609121] montaje_ruta+0x4c8/0xbc0 [5.609538] __x64_sys_mount+0x10d/0x150 El problema se puede reproducir f\u00e1cilmente utilizando el siguiente reproductor: root@q:linux# cat repro.sh set -e mkfs.btrfs -q -f /dev/sdb mount /dev/sdb /mnt/btrfs btrfs quota enable -s /mnt/btrfs umount /mnt/btrfs mount /dev/sdb /mnt/btrfs El problema es que al habilitar cuotas, en btrfs_quota_enable(), configuramos BTRFS_QGROUP_STATUS_FLAG_SIMPLE_MODE en fs_info-\u0026gt;qgroup_flags y lo persistimos en la ra\u00edz de cuotas en el elemento con la clave BTRFS_QGROUP_STATUS_KEY, pero solo configuramos el bit de incompatibilidad BTRFS_FEATURE_INCOMPAT_SIMPLE_QUOTA despu\u00e9s de que confirmamos la transacci\u00f3n utilizada para habilitar la cuota simple. Esto significa que si despu\u00e9s de esa confirmaci\u00f3n de transacci\u00f3n desmontamos el sistema de archivos sin iniciar y confirmar ninguna otra transacci\u00f3n, o tenemos un corte de energ\u00eda, la pr\u00f3xima vez que montemos el sistema de archivos encontraremos el indicador BTRFS_QGROUP_STATUS_FLAG_SIMPLE_MODE establecido en el elemento con la clave BTRFS_QGROUP_STATUS_KEY pero no encontraremos el bit de incompatibilidad BTRFS_FEATURE_INCOMPAT_SIMPLE_QUOTA establecido en el superbloque, lo que desencadena un error de aserci\u00f3n en: btrfs_read_qgroup_config() -\u0026gt; qgroup_read_enable_gen() Para solucionar este problema, configure el indicador BTRFS_FEATURE_INCOMPAT_SIMPLE_QUOTA inmediatamente despu\u00e9s de configurar BTRFS_QGROUP_STATUS_FLAG_SIMPLE_MODE. Esto garantiza que ambos indicadores se vac\u00eden en el disco dentro de la misma transacci\u00f3n.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/b87c9b9ba05ba6e8e2ee9ecd29a8c930b35648ed\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f2363e6fcc7938c5f0f6ac066fad0dd247598b51\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…