CVE - CVE-2024-50273

CVE-ID
CVE-2024-50273	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
In the Linux kernel, the following vulnerability has been resolved: btrfs: reinitialize delayed ref list after deleting it from the list At insert_delayed_ref() if we need to update the action of an existing ref to BTRFS_DROP_DELAYED_REF, we delete the ref from its ref head's ref_add_list using list_del(), which leaves the ref's add_list member not reinitialized, as list_del() sets the next and prev members of the list to LIST_POISON1 and LIST_POISON2, respectively. If later we end up calling drop_delayed_ref() against the ref, which can happen during merging or when destroying delayed refs due to a transaction abort, we can trigger a crash since at drop_delayed_ref() we call list_empty() against the ref's add_list, which returns false since the list was not reinitialized after the list_del() and as a consequence we call list_del() again at drop_delayed_ref(). This results in an invalid list access since the next and prev members are set to poison pointers, resulting in a splat if CONFIG_LIST_HARDENED and CONFIG_DEBUG_LIST are set or invalid poison pointer dereferences otherwise. So fix this by deleting from the list with list_del_init() instead.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
MISC:https://git.kernel.org/stable/c/2cb1a73d1d44a1c11b0ee5eeced765dd80ec48e6 URL:https://git.kernel.org/stable/c/2cb1a73d1d44a1c11b0ee5eeced765dd80ec48e6 MISC:https://git.kernel.org/stable/c/2fd0948a483e9cb2d669c7199bc620a21c97673d URL:https://git.kernel.org/stable/c/2fd0948a483e9cb2d669c7199bc620a21c97673d MISC:https://git.kernel.org/stable/c/50a3933760b427759afdd23156a7280a19357a92 URL:https://git.kernel.org/stable/c/50a3933760b427759afdd23156a7280a19357a92 MISC:https://git.kernel.org/stable/c/93c5b8decc0ef39ba84f4211d2db6da0a4aefbeb URL:https://git.kernel.org/stable/c/93c5b8decc0ef39ba84f4211d2db6da0a4aefbeb MISC:https://git.kernel.org/stable/c/bf0b0c6d159767c0d1c21f793950d78486690ee0 URL:https://git.kernel.org/stable/c/bf0b0c6d159767c0d1c21f793950d78486690ee0 MISC:https://git.kernel.org/stable/c/c24fa427fc0ae827b2a3a07f13738cbf82c3f851 URL:https://git.kernel.org/stable/c/c24fa427fc0ae827b2a3a07f13738cbf82c3f851 MISC:https://git.kernel.org/stable/c/c9a75ec45f1111ef530ab186c2a7684d0a0c9245 URL:https://git.kernel.org/stable/c/c9a75ec45f1111ef530ab186c2a7684d0a0c9245 MISC:https://git.kernel.org/stable/c/f04be6d68f715c1473a8422fc0460f57b5e99931 URL:https://git.kernel.org/stable/c/f04be6d68f715c1473a8422fc0460f57b5e99931
Assigning CNA
kernel.org
Date Record Created
20241021	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20241021)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)