CVE-2024-56581

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: btrfs: ref-verify: fix use-after-free after invalid ref action At btrfs_ref_tree_mod() after we successfully inserted the new ref entry (local variable 'ref') into the respective block entry's rbtree (local variable 'be'), if we find an unexpected action of BTRFS_DROP_DELAYED_REF, we error out and free the ref entry without removing it from the block entry's rbtree. Then in the error path of btrfs_ref_tree_mod() we call btrfs_free_ref_cache(), which iterates over all block entries and then calls free_block_entry() for each...

Affected product and versions

Product

Linux Linux, linux kernel

Affected versions

>= fd708b81d972a0714b02a60eb4792fdbf15868c4 < dfb9fe7de61f34cc241ab3900bdde93341096e0e, >= fd708b81d972a0714b02a60eb4792fdbf15868c4 < 6fd018aa168e472ce35be32296d109db6adb87ea, >= fd708b81d972a0714b02a60eb4792fdbf15868c4 < d2b85ce0561fde894e28fa01bd5d32820d585006, >= fd708b81d972a0714b02a60eb4792fdbf15868c4 < 6370db28af9a8ae3bbdfe97f8a48f8f995e144cf, >= fd708b81d972a0714b02a60eb4792fdbf15868c4 < 4275ac2741941c9c7c2293619fdbacb9f70ba85b, >= fd708b81d972a0714b02a60eb4792fdbf15868c4 < a6f9e7a0bf1185c9070c0de03bb85eafb9abd650, >= fd708b81d972a0714b02a60eb4792fdbf15868c4 < 7c4e39f9d2af4abaf82ca0e315d1fd340456620f, >= 4.15, >= 4.15 < 5.4.287, >= 5.5 < 5.10.231, >= 5.11 < 5.15.174, >= 5.16 < 6.1.120, >= 6.2 < 6.6.64, >= 6.7 < 6.12.4, 6.13

Fixed versions

5.4.287, 5.10.231, 5.15.174, 6.1.120, 6.6.64, 6.12.4

Technical data

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-416