CVE-2023-53187

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

btrfs: fix use-after-free of new block group that became unused

If a task creates a new block group and that block group becomes unused

before we finish its creation, at btrfs_create_pending_block_groups(),

then when btrfs_mark_bg_unused() is called against the block group, we

assume that the block group is currently in the list of block groups to

reclaim, and we move it out of the list of new block groups and into the

list of unused block groups. This has two consequences:

1) We move it out of the list of new block groups associated to the

current transaction. So the block group creation is not finished and

if we attempt to delete the bg because it's unused, we will not find

the block group item in the extent tree (or the new block group tree),

its device extent items in the device tree etc, resulting in the

deletion to fail due to the missing items;

2) We don't increment the reference count on the

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References