CVE-2024-46734: Vulnerability in Linux Linux

Severity: highType: vulnerabilityCVE-2024-46734

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix race between direct IO write and fsync when using same fd If we have 2 threads that are using the same file descriptor and one of them is doing direct IO writes while the other is doing fsync, we have a race where we can end up either: 1) Attempt a fsync without holding the inode's lock, triggering an assertion failures when assertions are enabled; 2) Do an invalid memory access from the fsync task because the file private points to memory allocated on stack by the direct IO task and it may be used by the fsync task after the stack was destroyed. The race happens like this: 1) A user space program opens a file descriptor with O_DIRECT; 2) The program spawns 2 threads using libpthread for example; 3) One of the threads uses the file descriptor to do direct IO writes, while the other calls fsync using the same file descriptor. 4) Call task A the thread doing direct IO writes and task B the thread doing fsyncs; 5) Task A does a direct IO write, and at btrfs_direct_write() sets the file's private to an on stack allocated private with the member 'fsync_skip_inode_lock' set to true; 6) Task B enters btrfs_sync_file() and sees that there's a private structure associated to the file which has 'fsync_skip_inode_lock' set to true, so it skips locking the inode's VFS lock; 7) Task A completes the direct IO write, and resets the file's private to NULL since it had no prior private and our private was stack allocated. Then it unlocks the inode's VFS lock; 8) Task B enters btrfs_get_ordered_extents_for_logging(), then the assertion that checks the inode's VFS lock is held fails, since task B never locked it and task A has already unlocked it. The stack trace produced is the following: assertion failed: inode_is_locked(&inode->vfs_inode), in fs/btrfs/ordered-data.c:983 ------------[ cut here ]------------ kernel BUG at fs/btrfs/ordered-data.c:983! Oops: invalid opcode: 0000 [#1] PREEMPT SMP PTI CPU: 9 PID: 5072 Comm: worker Tainted: G U OE 6.10.5-1-default #1 openSUSE Tumbleweed 69f48d427608e1c09e60ea24c6c55e2ca1b049e8 Hardware name: Acer Predator PH315-52/Covini_CFS, BIOS V1.12 07/28/2020 RIP: 0010:btrfs_get_ordered_extents_for_logging.cold+0x1f/0x42 [btrfs] Code: 50 d6 86 c0 e8 (...) RSP: 0018:ffff9e4a03dcfc78 EFLAGS: 00010246 RAX: 0000000000000054 RBX: ffff9078a9868e98 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffff907dce4a7800 RDI: ffff907dce4a7800 RBP: ffff907805518800 R08: 0000000000000000 R09: ffff9e4a03dcfb38 R10: ffff9e4a03dcfb30 R11: 0000000000000003 R12: ffff907684ae7800 R13: 0000000000000001 R14: ffff90774646b600 R15: 0000000000000000 FS: 00007f04b96006c0(0000) GS:ffff907dce480000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f32acbfc000 CR3: 00000001fd4fa005 CR4: 00000000003726f0 Call Trace: <TASK> ? __die_body.cold+0x14/0x24 ? die+0x2e/0x50 ? do_trap+0xca/0x110 ? do_error_trap+0x6a/0x90 ? btrfs_get_ordered_extents_for_logging.cold+0x1f/0x42 [btrfs bb26272d49b4cdc847cf3f7faadd459b62caee9a] ? exc_invalid_op+0x50/0x70 ? btrfs_get_ordered_extents_for_logging.cold+0x1f/0x42 [btrfs bb26272d49b4cdc847cf3f7faadd459b62caee9a] ? asm_exc_invalid_op+0x1a/0x20 ? btrfs_get_ordered_extents_for_logging.cold+0x1f/0x42 [btrfs bb26272d49b4cdc847cf3f7faadd459b62caee9a] ? btrfs_get_ordered_extents_for_logging.cold+0x1f/0x42 [btrfs bb26272d49b4cdc847cf3f7faadd459b62caee9a] btrfs_sync_file+0x21a/0x4d0 [btrfs bb26272d49b4cdc847cf3f7faadd459b62caee9a] ? __seccomp_filter+0x31d/0x4f0 __x64_sys_fdatasync+0x4f/0x90 do_syscall_64+0x82/0x160 ? do_futex+0xcb/0x190 ? __x64_sys_futex+0x10e/0x1d0 ? switch_fpu_return+0x4f/0xd0 ? syscall_exit_to_user_mode+0x72/0x220 ? do_syscall_64+0x8e/0x160 ? syscall_exit_to_user_mod ---truncated---

AI Analysis

Technical Summary

CVE-2024-46734 is a race condition vulnerability in the Linux kernel's Btrfs filesystem implementation involving concurrent use of direct IO writes and fsync operations on the same file descriptor. The flaw arises when two threads share a file descriptor opened with O_DIRECT: one thread performs direct IO writes while the other calls fsync. During direct IO writes, the kernel sets a file-private pointer to a stack-allocated structure with a flag indicating to skip locking the inode's VFS lock during fsync. The fsync thread, seeing this flag, skips acquiring the inode lock. However, the direct IO thread completes and clears the file-private pointer after unlocking the inode, causing the fsync thread to operate on invalid memory and without proper locking. This leads to assertion failures and kernel BUGs due to invalid memory access and unlocked inode operations. The vulnerability can cause system crashes (kernel panic) and potential data corruption due to improper synchronization of file writes and metadata flushing. The issue affects multiple Linux kernel versions prior to the patch and is triggered by multi-threaded applications using direct IO and fsync concurrently on Btrfs filesystems. The vulnerability was publicly disclosed on September 18, 2024, with no known exploits in the wild yet. The kernel stack trace shows the failure occurs in btrfs_get_ordered_extents_for_logging during fsync processing. This bug represents a critical kernel-level race condition that undermines filesystem integrity and stability under specific concurrent IO patterns.

Potential Impact

For European organizations, the impact of CVE-2024-46734 can be significant, especially for those relying on Linux servers with Btrfs filesystems in multi-threaded, high-performance storage environments. The vulnerability can cause kernel panics leading to system downtime, disrupting critical services and applications. Data integrity risks arise from the race condition between direct IO writes and fsync, potentially causing data loss or corruption, which is critical for sectors like finance, healthcare, and government where data accuracy is paramount. Organizations running containerized workloads or virtualized environments on Linux with Btrfs may experience instability affecting cloud services and internal infrastructure. Although exploitation requires a specific usage pattern (multi-threaded direct IO and fsync on the same fd), the widespread use of Linux in European data centers and enterprises means the risk is non-negligible. The lack of known exploits reduces immediate threat but patching is urgent to prevent future attacks or accidental crashes. The vulnerability also poses challenges for compliance with data protection regulations (e.g., GDPR) if data integrity or availability is compromised.

Mitigation Recommendations

To mitigate CVE-2024-46734, European organizations should: 1) Apply the latest Linux kernel patches that address this race condition as soon as they become available from trusted sources or Linux distributions. 2) Audit applications and workloads to identify usage of direct IO with concurrent fsync calls on the same file descriptors, and refactor or serialize such IO operations to avoid triggering the race. 3) Where possible, avoid using O_DIRECT with multi-threaded fsync on Btrfs until patched. 4) Implement monitoring for kernel panics and filesystem errors related to Btrfs to detect early signs of this issue. 5) Test kernel updates in staging environments replicating production IO patterns to ensure stability before deployment. 6) Consider alternative filesystems if immediate patching is not feasible and the workload heavily relies on direct IO and fsync concurrency. 7) Maintain robust backups and disaster recovery plans to mitigate potential data corruption consequences. 8) Engage with Linux distribution vendors for timely security advisories and patches.