CVE-2024-42111 in Linux
Summary
by MITRE • 07/30/2024
In the Linux kernel, the following vulnerability has been resolved:
btrfs: always do the basic checks for btrfs_qgroup_inherit structure
[BUG]
Syzbot reports the following regression detected by KASAN:
BUG: KASAN: slab-out-of-bounds in btrfs_qgroup_inherit+0x42e/0x2e20 fs/btrfs/qgroup.c:3277 Read of size 8 at addr ffff88814628ca50 by task syz-executor318/5171
CPU: 0 PID: 5171 Comm: syz-executor318 Not tainted 6.10.0-rc2-syzkaller-00010-g2ab795141095 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024 Call Trace: __dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114 print_address_description mm/kasan/report.c:377 [inline]
print_report+0x169/0x550 mm/kasan/report.c:488 kasan_report+0x143/0x180 mm/kasan/report.c:601 btrfs_qgroup_inherit+0x42e/0x2e20 fs/btrfs/qgroup.c:3277 create_pending_snapshot+0x1359/0x29b0 fs/btrfs/transaction.c:1854 create_pending_snapshots+0x195/0x1d0 fs/btrfs/transaction.c:1922 btrfs_commit_transaction+0xf20/0x3740 fs/btrfs/transaction.c:2382 create_snapshot+0x6a1/0x9e0 fs/btrfs/ioctl.c:875 btrfs_mksubvol+0x58f/0x710 fs/btrfs/ioctl.c:1029 btrfs_mksnapshot+0xb5/0xf0 fs/btrfs/ioctl.c:1075 __btrfs_ioctl_snap_create+0x387/0x4b0 fs/btrfs/ioctl.c:1340 btrfs_ioctl_snap_create_v2+0x1f2/0x3a0 fs/btrfs/ioctl.c:1422 btrfs_ioctl+0x99e/0xc60 vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:907 [inline]
__se_sys_ioctl+0xfc/0x170 fs/ioctl.c:893 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fcbf1992509 RSP: 002b:00007fcbf1928218 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007fcbf1a1f618 RCX: 00007fcbf1992509 RDX: 0000000020000280 RSI: 0000000050009417 RDI: 0000000000000003 RBP: 00007fcbf1a1f610 R08: 00007ffea1298e97 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007fcbf19eb660 R13: 00000000200002b8 R14: 00007fcbf19e60c0 R15: 0030656c69662f2e
And it also pinned it down to commit b5357cb268c4 ("btrfs: qgroup: do not check qgroup inherit if qgroup is disabled").
[CAUSE]
That offending commit skips the whole qgroup inherit check if qgroup is not enabled.
But that also skips the very basic checks like num_ref_copies/num_excl_copies and the structure size checks.
Meaning if a qgroup enable/disable race is happening at the background, and we pass a btrfs_qgroup_inherit structure when the qgroup is disabled, the check would be completely skipped.
Then at the time of transaction commitment, qgroup is re-enabled and btrfs_qgroup_inherit() is going to use the incorrect structure and causing the above KASAN error.
[FIX]
Make btrfs_qgroup_check_inherit() only skip the source qgroup checks. So that even if invalid btrfs_qgroup_inherit structure is passed in, we can still reject invalid ones no matter if qgroup is enabled or not.
Furthermore we do already have an extra safety inside btrfs_qgroup_inherit(), which would just ignore invalid qgroup sources, so even if we only skip the qgroup source check we're still safe.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/26/2025
The vulnerability described in CVE-2024-42111 affects the Linux kernel's btrfs file system implementation and represents a critical flaw in the qgroup inheritance mechanism. This issue manifests as a slab-out-of-bounds error detected by KASAN, a kernel memory debugger that identifies memory access violations. The bug occurs during the processing of btrfs_qgroup_inherit structures, which are used to manage quota groups in btrfs file systems. When a qgroup inheritance operation is performed, the system attempts to validate the structure but fails to perform basic checks when qgroups are disabled, leading to memory corruption.
The root cause of this vulnerability lies in commit b5357cb268c4, which introduced an optimization to skip qgroup inheritance checks when qgroups are disabled. This optimization, however, inadvertently removes essential validation of basic structure parameters such as num_ref_copies and num_excl_copies, along with structure size validation. This design flaw creates a race condition scenario where a malicious actor or system process could trigger a qgroup enable/disable race condition, causing the system to process an invalid btrfs_qgroup_inherit structure while qgroups are disabled. When the transaction is later committed and qgroups are re-enabled, the system attempts to process this malformed structure, resulting in the KASAN memory access violation.
The technical impact of this vulnerability extends beyond simple memory corruption, as it represents a potential path for privilege escalation and system instability. The flaw is classified under CWE-129, which deals with insufficient bounds checking, and aligns with ATT&CK technique T1068, which involves exploiting vulnerabilities to gain elevated privileges. When exploited, this vulnerability can lead to system crashes, data corruption, or potentially unauthorized access to system resources. The vulnerability is particularly concerning because it occurs during critical file system operations such as snapshot creation, where the kernel's qgroup management system is actively involved.
The fix implemented addresses the core issue by modifying the btrfs_qgroup_check_inherit() function to only skip source qgroup checks while maintaining validation of basic structure parameters. This ensures that even when qgroups are disabled, the system performs essential safety checks on the btrfs_qgroup_inherit structure itself. The solution maintains backward compatibility while adding the necessary validation to prevent the memory corruption scenario. This approach follows the principle of least privilege and defense in depth, ensuring that invalid structures are rejected regardless of the qgroup enablement state. The fix also leverages existing safety mechanisms within btrfs_qgroup_inherit() that already ignore invalid qgroup sources, providing additional protection layers. System administrators should apply the patched kernel version immediately to mitigate this vulnerability, as it represents a significant risk to system stability and security in environments utilizing btrfs file systems.