CVE-2024-47741

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

btrfs: fix race setting file private on concurrent lseek using same fd

When doing concurrent lseek(2) system calls against the same file

descriptor, using multiple threads belonging to the same process, we have

a short time window where a race happens and can result in a memory leak.

The race happens like this:

1) A program opens a file descriptor for a file and then spawns two

threads (with the pthreads library for example), lets call them

task A and task B;

2) Task A calls lseek with SEEK_DATA or SEEK_HOLE and ends up at

file.c:find_desired_extent() while holding a read lock on the inode;

3) At the start of find_desired_extent(), it extracts the file's

private_data pointer into a local variable named 'private', which has

a value of NULL;

4) Task B also calls lseek with SEEK_DATA or SEEK_HOLE, locks the inode

in shared mode and enters file.c:find_desired_extent(), where it also

extracts fil

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References