CVE-2023-52737: Vulnerability in Linux Linux

Severity: mediumType: vulnerabilityCVE-2023-52737

In the Linux kernel, the following vulnerability has been resolved: btrfs: lock the inode in shared mode before starting fiemap Currently fiemap does not take the inode's lock (VFS lock), it only locks a file range in the inode's io tree. This however can lead to a deadlock if we have a concurrent fsync on the file and fiemap code triggers a fault when accessing the user space buffer with fiemap_fill_next_extent(). The deadlock happens on the inode's i_mmap_lock semaphore, which is taken both by fsync and btrfs_page_mkwrite(). This deadlock was recently reported by syzbot and triggers a trace like the following: task:syz-executor361 state:D stack:20264 pid:5668 ppid:5119 flags:0x00004004 Call Trace: <TASK> context_switch kernel/sched/core.c:5293 [inline] __schedule+0x995/0xe20 kernel/sched/core.c:6606 schedule+0xcb/0x190 kernel/sched/core.c:6682 wait_on_state fs/btrfs/extent-io-tree.c:707 [inline] wait_extent_bit+0x577/0x6f0 fs/btrfs/extent-io-tree.c:751 lock_extent+0x1c2/0x280 fs/btrfs/extent-io-tree.c:1742 find_lock_delalloc_range+0x4e6/0x9c0 fs/btrfs/extent_io.c:488 writepage_delalloc+0x1ef/0x540 fs/btrfs/extent_io.c:1863 __extent_writepage+0x736/0x14e0 fs/btrfs/extent_io.c:2174 extent_write_cache_pages+0x983/0x1220 fs/btrfs/extent_io.c:3091 extent_writepages+0x219/0x540 fs/btrfs/extent_io.c:3211 do_writepages+0x3c3/0x680 mm/page-writeback.c:2581 filemap_fdatawrite_wbc+0x11e/0x170 mm/filemap.c:388 __filemap_fdatawrite_range mm/filemap.c:421 [inline] filemap_fdatawrite_range+0x175/0x200 mm/filemap.c:439 btrfs_fdatawrite_range fs/btrfs/file.c:3850 [inline] start_ordered_ops fs/btrfs/file.c:1737 [inline] btrfs_sync_file+0x4ff/0x1190 fs/btrfs/file.c:1839 generic_write_sync include/linux/fs.h:2885 [inline] btrfs_do_write_iter+0xcd3/0x1280 fs/btrfs/file.c:1684 call_write_iter include/linux/fs.h:2189 [inline] new_sync_write fs/read_write.c:491 [inline] vfs_write+0x7dc/0xc50 fs/read_write.c:584 ksys_write+0x177/0x2a0 fs/read_write.c:637 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7f7d4054e9b9 RSP: 002b:00007f7d404fa2f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00007f7d405d87a0 RCX: 00007f7d4054e9b9 RDX: 0000000000000090 RSI: 0000000020000000 RDI: 0000000000000006 RBP: 00007f7d405a51d0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 61635f65646f6e69 R13: 65646f7475616f6e R14: 7261637369646f6e R15: 00007f7d405d87a8 </TASK> INFO: task syz-executor361:5697 blocked for more than 145 seconds. Not tainted 6.2.0-rc3-syzkaller-00376-g7c6984405241 #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor361 state:D stack:21216 pid:5697 ppid:5119 flags:0x00004004 Call Trace: <TASK> context_switch kernel/sched/core.c:5293 [inline] __schedule+0x995/0xe20 kernel/sched/core.c:6606 schedule+0xcb/0x190 kernel/sched/core.c:6682 rwsem_down_read_slowpath+0x5f9/0x930 kernel/locking/rwsem.c:1095 __down_read_common+0x54/0x2a0 kernel/locking/rwsem.c:1260 btrfs_page_mkwrite+0x417/0xc80 fs/btrfs/inode.c:8526 do_page_mkwrite+0x19e/0x5e0 mm/memory.c:2947 wp_page_shared+0x15e/0x380 mm/memory.c:3295 handle_pte_fault mm/memory.c:4949 [inline] __handle_mm_fault mm/memory.c:5073 [inline] handle_mm_fault+0x1b79/0x26b0 mm/memory.c:5219 do_user_addr_fault+0x69b/0xcb0 arch/x86/mm/fault.c:1428 handle_page_fault arch/x86/mm/fault.c:1519 [inline] exc_page_fault+0x7a/0x110 arch/x86/mm/fault.c:1575 asm_exc_page_fault+0x22/0x30 arch/x86/include/asm/idtentry.h:570 RIP: 0010:copy_user_short_string+0xd/0x40 arch/x86/lib/copy_user_64.S:233 Code: 74 0a 89 (...) RSP: 0018:ffffc9000570f330 EFLAGS: 000502 ---truncated---

AI Analysis

Technical Summary

CVE-2023-52737 is a concurrency vulnerability in the Linux kernel's Btrfs filesystem implementation related to inode locking during the fiemap operation. The fiemap ioctl is used to retrieve file extent mappings, but in this case, the fiemap code does not acquire the inode's VFS lock in shared mode before starting, only locking a file range in the inode's io tree. This improper locking can lead to a deadlock scenario when fiemap runs concurrently with an fsync operation on the same file. Specifically, the deadlock occurs on the inode's i_mmap_lock semaphore, which is taken by both fsync and the btrfs_page_mkwrite() function. The deadlock is triggered when fiemap_fill_next_extent() faults while accessing the user space buffer, causing the kernel tasks to block indefinitely. This issue was identified by syzbot, a kernel fuzzing tool, and results in kernel tasks being stuck in an uninterruptible sleep state, effectively causing a denial of service (DoS) condition on the affected system. The vulnerability affects Linux kernel versions that include the vulnerable Btrfs code and can be triggered by local users or processes performing concurrent file operations involving fiemap and fsync on Btrfs filesystems. There is no indication of remote exploitation or privilege escalation, but the deadlock can cause system instability or service outages. The vulnerability has been publicly disclosed but does not yet have a CVSS score or known exploits in the wild. The fix involves acquiring the inode lock in shared mode before starting fiemap to prevent the deadlock condition.

Potential Impact

For European organizations, the primary impact of CVE-2023-52737 is the potential for denial of service on Linux systems using the Btrfs filesystem. Many enterprises, cloud providers, and data centers in Europe deploy Linux servers for critical infrastructure, web hosting, and storage solutions. A deadlock in the kernel can cause affected services to hang or crash, leading to downtime and potential disruption of business operations. While this vulnerability does not appear to allow privilege escalation or data corruption, the loss of availability can affect service-level agreements (SLAs), especially for sectors relying on high uptime such as finance, healthcare, and telecommunications. Additionally, organizations using Btrfs for storage in virtualized or containerized environments may experience cascading effects if host systems become unresponsive. The lack of remote exploitability limits the threat to local or insider attackers, but insider threats or compromised accounts could trigger the deadlock. Overall, the impact is moderate but significant for environments with heavy file I/O on Btrfs volumes.

Mitigation Recommendations

European organizations should apply the following specific mitigations: 1) Update Linux kernels to versions where this vulnerability is patched as soon as vendor patches become available. Monitor Linux distribution security advisories for updates to Btrfs and kernel packages. 2) Temporarily avoid running concurrent fiemap and fsync operations on Btrfs filesystems if possible, especially in automated scripts or applications that perform heavy file extent mapping and syncing. 3) Implement monitoring for hung tasks or kernel deadlocks using tools like systemd's watchdog, kernel hung task timeout messages, or custom scripts to detect symptoms early. 4) Limit local user permissions to prevent untrusted users from triggering fiemap/ioctl operations on critical filesystems. 5) For environments using Btrfs extensively, consider fallback or alternative filesystems until patches are applied to reduce risk. 6) Engage with Linux kernel maintainers or vendors for backported patches if using long-term support kernels. These mitigations go beyond generic advice by focusing on operational practices and monitoring tailored to this concurrency deadlock issue.