CVE-2024-48875: Vulnerability in Linux Linux

Severity: highType: vulnerabilityCVE-2024-48875

In the Linux kernel, the following vulnerability has been resolved: btrfs: don't take dev_replace rwsem on task already holding it Running fstests btrfs/011 with MKFS_OPTIONS="-O rst" to force the usage of the RAID stripe-tree, we get the following splat from lockdep: BTRFS info (device sdd): dev_replace from /dev/sdd (devid 1) to /dev/sdb started ============================================ WARNING: possible recursive locking detected 6.11.0-rc3-btrfs-for-next #599 Not tainted -------------------------------------------- btrfs/2326 is trying to acquire lock: ffff88810f215c98 (&fs_info->dev_replace.rwsem){++++}-{3:3}, at: btrfs_map_block+0x39f/0x2250 but task is already holding lock: ffff88810f215c98 (&fs_info->dev_replace.rwsem){++++}-{3:3}, at: btrfs_map_block+0x39f/0x2250 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(&fs_info->dev_replace.rwsem); lock(&fs_info->dev_replace.rwsem); *** DEADLOCK *** May be due to missing lock nesting notation 1 lock held by btrfs/2326: #0: ffff88810f215c98 (&fs_info->dev_replace.rwsem){++++}-{3:3}, at: btrfs_map_block+0x39f/0x2250 stack backtrace: CPU: 1 UID: 0 PID: 2326 Comm: btrfs Not tainted 6.11.0-rc3-btrfs-for-next #599 Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 Call Trace: <TASK> dump_stack_lvl+0x5b/0x80 __lock_acquire+0x2798/0x69d0 ? __pfx___lock_acquire+0x10/0x10 ? __pfx___lock_acquire+0x10/0x10 lock_acquire+0x19d/0x4a0 ? btrfs_map_block+0x39f/0x2250 ? __pfx_lock_acquire+0x10/0x10 ? find_held_lock+0x2d/0x110 ? lock_is_held_type+0x8f/0x100 down_read+0x8e/0x440 ? btrfs_map_block+0x39f/0x2250 ? __pfx_down_read+0x10/0x10 ? do_raw_read_unlock+0x44/0x70 ? _raw_read_unlock+0x23/0x40 btrfs_map_block+0x39f/0x2250 ? btrfs_dev_replace_by_ioctl+0xd69/0x1d00 ? btrfs_bio_counter_inc_blocked+0xd9/0x2e0 ? __kasan_slab_alloc+0x6e/0x70 ? __pfx_btrfs_map_block+0x10/0x10 ? __pfx_btrfs_bio_counter_inc_blocked+0x10/0x10 ? kmem_cache_alloc_noprof+0x1f2/0x300 ? mempool_alloc_noprof+0xed/0x2b0 btrfs_submit_chunk+0x28d/0x17e0 ? __pfx_btrfs_submit_chunk+0x10/0x10 ? bvec_alloc+0xd7/0x1b0 ? bio_add_folio+0x171/0x270 ? __pfx_bio_add_folio+0x10/0x10 ? __kasan_check_read+0x20/0x20 btrfs_submit_bio+0x37/0x80 read_extent_buffer_pages+0x3df/0x6c0 btrfs_read_extent_buffer+0x13e/0x5f0 read_tree_block+0x81/0xe0 read_block_for_search+0x4bd/0x7a0 ? __pfx_read_block_for_search+0x10/0x10 btrfs_search_slot+0x78d/0x2720 ? __pfx_btrfs_search_slot+0x10/0x10 ? lock_is_held_type+0x8f/0x100 ? kasan_save_track+0x14/0x30 ? __kasan_slab_alloc+0x6e/0x70 ? kmem_cache_alloc_noprof+0x1f2/0x300 btrfs_get_raid_extent_offset+0x181/0x820 ? __pfx_lock_acquire+0x10/0x10 ? __pfx_btrfs_get_raid_extent_offset+0x10/0x10 ? down_read+0x194/0x440 ? __pfx_down_read+0x10/0x10 ? do_raw_read_unlock+0x44/0x70 ? _raw_read_unlock+0x23/0x40 btrfs_map_block+0x5b5/0x2250 ? __pfx_btrfs_map_block+0x10/0x10 scrub_submit_initial_read+0x8fe/0x11b0 ? __pfx_scrub_submit_initial_read+0x10/0x10 submit_initial_group_read+0x161/0x3a0 ? lock_release+0x20e/0x710 ? __pfx_submit_initial_group_read+0x10/0x10 ? __pfx_lock_release+0x10/0x10 scrub_simple_mirror.isra.0+0x3eb/0x580 scrub_stripe+0xe4d/0x1440 ? lock_release+0x20e/0x710 ? __pfx_scrub_stripe+0x10/0x10 ? __pfx_lock_release+0x10/0x10 ? do_raw_read_unlock+0x44/0x70 ? _raw_read_unlock+0x23/0x40 scrub_chunk+0x257/0x4a0 scrub_enumerate_chunks+0x64c/0xf70 ? __mutex_unlock_slowpath+0x147/0x5f0 ? __pfx_scrub_enumerate_chunks+0x10/0x10 ? bit_wait_timeout+0xb0/0x170 ? __up_read+0x189/0x700 ? scrub_workers_get+0x231/0x300 ? up_write+0x490/0x4f0 btrfs_scrub_dev+0x52e/0xcd0 ? create_pending_snapshots+0x230/0x250 ? __pfx_btrfs_scrub_dev+0x10/0x10 btrfs_dev_replace_by_ioctl+0xd69/0x1d00 ? lock_acquire+0x19d/0x4a0 ? __pfx_btrfs_dev_replace_by_ioctl+0x10/0x10 ? ---truncated---

AI Analysis

Technical Summary

CVE-2024-48875 is a vulnerability identified in the Linux kernel's Btrfs filesystem implementation. The core issue involves improper handling of recursive locking on the dev_replace read-write semaphore (rwsem) within the Btrfs code. Specifically, when performing device replacement operations with Btrfs, the kernel attempts to acquire the dev_replace rwsem lock twice recursively on the same task without proper lock nesting notation or safeguards. This results in a deadlock condition, as the same lock is requested while already held, causing the kernel to halt the affected process. The vulnerability was discovered during testing with the Btrfs RAID stripe-tree option enabled, which triggers the problematic code path. The detailed kernel stack trace shows the deadlock arises during calls to btrfs_map_block and related functions involved in device replacement and block mapping. This flaw can cause system instability or denial of service (DoS) by freezing kernel threads responsible for filesystem operations. The vulnerability affects Linux kernel versions containing the faulty Btrfs dev_replace locking logic prior to the patch. No known exploits are currently reported in the wild, and no CVSS score has been assigned yet. The issue is primarily a concurrency bug leading to deadlock rather than a memory corruption or privilege escalation flaw. However, the impact on availability can be significant for systems relying on Btrfs with device replacement features in active use.

Potential Impact

For European organizations, the impact of CVE-2024-48875 centers on potential denial of service conditions affecting Linux servers and systems using the Btrfs filesystem, especially those employing device replacement or RAID configurations. Organizations with critical infrastructure, cloud services, or data centers running Linux with Btrfs may experience service interruptions or degraded performance due to kernel deadlocks. This can affect availability of applications, data access, and system reliability. Industries such as telecommunications, finance, healthcare, and public sector entities that rely on Linux-based storage solutions could face operational disruptions. Additionally, organizations using Btrfs for backup or archival storage may risk data unavailability during device replacement operations. While the vulnerability does not directly expose confidentiality or integrity risks, the availability impact can lead to cascading effects on business continuity and service level agreements. The lack of known exploits reduces immediate risk, but the vulnerability should be addressed proactively to prevent potential exploitation or accidental triggering in production environments.

Mitigation Recommendations

To mitigate CVE-2024-48875, European organizations should: 1) Apply the latest Linux kernel updates that include the patch fixing the dev_replace rwsem recursive locking issue. Monitor kernel release notes and security advisories for the patched versions. 2) Avoid performing device replacement operations on Btrfs filesystems in production environments until patched kernels are deployed. 3) Implement robust testing and staging environments to validate kernel updates before production rollout, ensuring no regressions or new issues arise. 4) Monitor system logs and kernel messages for signs of deadlocks or lockdep warnings related to Btrfs dev_replace operations. 5) Consider alternative filesystems or storage configurations if device replacement is a critical operation and immediate patching is not feasible. 6) Employ kernel crash dump and diagnostic tools to capture detailed information if deadlocks occur, aiding in incident response and root cause analysis. 7) Coordinate with Linux distribution vendors and support channels to receive timely patches and guidance. These steps go beyond generic advice by focusing on operational practices around device replacement and kernel update management specific to this concurrency vulnerability.