CVE-2024-46734

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

btrfs: fix race between direct IO write and fsync when using same fd

If we have 2 threads that are using the same file descriptor and one of

them is doing direct IO writes while the other is doing fsync, we have a

race where we can end up either:

1) Attempt a fsync without holding the inode's lock, triggering an

assertion failures when assertions are enabled;

2) Do an invalid memory access from the fsync task because the file private

points to memory allocated on stack by the direct IO task and it may be

used by the fsync task after the stack was destroyed.

The race happens like this:

1) A user space program opens a file descriptor with O_DIRECT;

2) The program spawns 2 threads using libpthread for example;

3) One of the threads uses the file descriptor to do direct IO writes,

while the other calls fsync using the same file descriptor.

4) Call task A the thread doing direct IO writes and task B the

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References