CVE-2024-56582 in Linux
Summary
by MITRE • 12/27/2024
In the Linux kernel, the following vulnerability has been resolved:
btrfs: fix use-after-free in btrfs_encoded_read_endio()
Shinichiro reported the following use-after free that sometimes is happening in our CI system when running fstests' btrfs/284 on a TCMU runner device:
BUG: KASAN: slab-use-after-free in lock_release+0x708/0x780 Read of size 8 at addr ffff888106a83f18 by task kworker/u80:6/219
CPU: 8 UID: 0 PID: 219 Comm: kworker/u80:6 Not tainted 6.12.0-rc6-kts+ #15 Hardware name: Supermicro Super Server/X11SPi-TF, BIOS 3.3 02/21/2020 Workqueue: btrfs-endio btrfs_end_bio_work [btrfs]
Call Trace: dump_stack_lvl+0x6e/0xa0 ? lock_release+0x708/0x780 print_report+0x174/0x505 ? lock_release+0x708/0x780 ? __virt_addr_valid+0x224/0x410 ? lock_release+0x708/0x780 kasan_report+0xda/0x1b0 ? lock_release+0x708/0x780 ? __wake_up+0x44/0x60 lock_release+0x708/0x780 ? __pfx_lock_release+0x10/0x10 ? __pfx_do_raw_spin_lock+0x10/0x10 ? lock_is_held_type+0x9a/0x110 _raw_spin_unlock_irqrestore+0x1f/0x60 __wake_up+0x44/0x60 btrfs_encoded_read_endio+0x14b/0x190 [btrfs]
btrfs_check_read_bio+0x8d9/0x1360 [btrfs]
? lock_release+0x1b0/0x780 ? trace_lock_acquire+0x12f/0x1a0 ? __pfx_btrfs_check_read_bio+0x10/0x10 [btrfs]
? process_one_work+0x7e3/0x1460 ? lock_acquire+0x31/0xc0 ? process_one_work+0x7e3/0x1460 process_one_work+0x85c/0x1460 ? __pfx_process_one_work+0x10/0x10 ? assign_work+0x16c/0x240 worker_thread+0x5e6/0xfc0 ? __pfx_worker_thread+0x10/0x10 kthread+0x2c3/0x3a0 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x31/0x70 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30
Allocated by task 3661: kasan_save_stack+0x30/0x50 kasan_save_track+0x14/0x30 __kasan_kmalloc+0xaa/0xb0 btrfs_encoded_read_regular_fill_pages+0x16c/0x6d0 [btrfs]
send_extent_data+0xf0f/0x24a0 [btrfs]
process_extent+0x48a/0x1830 [btrfs]
changed_cb+0x178b/0x2ea0 [btrfs]
btrfs_ioctl_send+0x3bf9/0x5c20 [btrfs]
_btrfs_ioctl_send+0x117/0x330 [btrfs]
btrfs_ioctl+0x184a/0x60a0 [btrfs]
__x64_sys_ioctl+0x12e/0x1a0 do_syscall_64+0x95/0x180 entry_SYSCALL_64_after_hwframe+0x76/0x7e
Freed by task 3661: kasan_save_stack+0x30/0x50 kasan_save_track+0x14/0x30 kasan_save_free_info+0x3b/0x70 __kasan_slab_free+0x4f/0x70 kfree+0x143/0x490 btrfs_encoded_read_regular_fill_pages+0x531/0x6d0 [btrfs]
send_extent_data+0xf0f/0x24a0 [btrfs]
process_extent+0x48a/0x1830 [btrfs]
changed_cb+0x178b/0x2ea0 [btrfs]
btrfs_ioctl_send+0x3bf9/0x5c20 [btrfs]
_btrfs_ioctl_send+0x117/0x330 [btrfs]
btrfs_ioctl+0x184a/0x60a0 [btrfs]
__x64_sys_ioctl+0x12e/0x1a0 do_syscall_64+0x95/0x180 entry_SYSCALL_64_after_hwframe+0x76/0x7e
The buggy address belongs to the object at ffff888106a83f00 which belongs to the cache kmalloc-rnd-07-96 of size 96 The buggy address is located 24 bytes inside of freed 96-byte region [ffff888106a83f00, ffff888106a83f60)
The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888106a83800 pfn:0x106a83 flags: 0x17ffffc0000000(node=0|zone=2|lastcpupid=0x1fffff) page_type: f5(slab) raw: 0017ffffc0000000 ffff888100053680 ffffea0004917200 0000000000000004 raw: ffff888106a83800 0000000080200019 00000001f5000000 0000000000000000 page dumped because: kasan: bad access detected
Memory state around the buggy address: ffff888106a83e00: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc ffff888106a83e80: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc >ffff888106a83f00: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc ^ ffff888106a83f80: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc ffff888106a84000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ==================================================================
Further analyzing the trace and ---truncated---
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 12/23/2025
The vulnerability identified as CVE-2024-56582 represents a use-after-free condition in the Linux kernel's Btrfs filesystem implementation, specifically within the btrfs_encoded_read_endio function. This flaw occurs during the processing of encoded read operations and manifests as a kernel memory corruption issue that can lead to system instability or potential exploitation. The vulnerability was detected through continuous integration testing using fstests' btrfs/284 test case running on a TCMU runner device, indicating the issue arises in specific I/O handling scenarios involving Btrfs send operations. The kernel address sanitizer (KASAN) trace shows the bug originates from a read operation of size 8 at address ffff888106a83f18, which corresponds to a memory region that was previously freed during the execution of btrfs_encoded_read_regular_fill_pages function. The memory allocation and deallocation traces clearly demonstrate the classic use-after-free pattern where a kernel object is freed and then subsequently accessed, with the freed memory block belonging to the kmalloc-rnd-07-96 cache of size 96 bytes.
The technical root cause stems from improper memory management within the Btrfs filesystem's I/O completion handling mechanism. During the btrfs_ioctl_send operation, which is used to send filesystem changes to another location, the system allocates memory for handling encoded read operations through btrfs_encoded_read_regular_fill_pages. This allocation occurs in the context of send_extent_data and process_extent functions, but the memory is freed prematurely during the same execution path in btrfs_encoded_read_regular_fill_pages before the completion handler btrfs_encoded_read_endio has finished processing. The memory layout shows the freed region [ffff888106a83f00, ffff888106a83f60) with the buggy address located 24 bytes into this freed memory, confirming that the access occurs on memory that has already been returned to the kernel's memory allocator. The worker thread kworker/u80:6 processes the btrfs_end_bio_work workqueue item, which eventually calls the corrupted function, indicating this is a race condition or memory management error in asynchronous I/O processing. This issue is classified as a CWE-416 Use After Free vulnerability under the Common Weakness Enumeration framework, representing a critical security concern in kernel space memory management.
The operational impact of this vulnerability extends beyond simple system crashes, as it represents a potential vector for privilege escalation or denial of service attacks within kernel space. When the use-after-free condition occurs, it can lead to unpredictable behavior including kernel panics, system hangs, or more concerning scenarios where attackers might exploit the memory corruption to gain elevated privileges. The vulnerability specifically affects systems running Linux kernels with Btrfs filesystem support, particularly those utilizing TCMU (Target/Client Multipath Unified) devices for storage operations. The fact that this issue was reproduced in CI testing with fstests suggests that it can be triggered through normal filesystem operations, making it particularly dangerous in production environments where Btrfs send operations are common. The memory state analysis reveals that the freed page has a reference count of 1 and is marked as a slab page, indicating that the kernel's memory management system has already processed the deallocation, yet the subsequent access attempts to use the memory as if it were still valid. This type of vulnerability is particularly concerning because it occurs in the kernel's I/O subsystem where memory corruption can lead to system-wide instability.
Mitigation strategies for this vulnerability require immediate kernel updates to the patched version that resolves the use-after-free condition in the btrfs_encoded_read_endio function. System administrators should prioritize applying the relevant kernel security patches as soon as they become available through their distribution channels. In environments where immediate patching is not feasible, operational mitigations include disabling Btrfs send operations when possible, monitoring for kernel oops or KASAN reports, and ensuring robust system monitoring for early detection of memory corruption symptoms. The fix implemented in the kernel typically involves ensuring proper reference counting or synchronization mechanisms are in place during the memory allocation and deallocation lifecycle, preventing the premature freeing of memory objects that are still in use by completion handlers. Organizations should also conduct vulnerability assessments to identify systems running affected kernel versions and prioritize patching based on risk exposure. From an ATT&CK framework perspective, this vulnerability aligns with T1068 (Exploitation for Privilege Escalation) and T1499 (Endpoint Denial of Service) tactics, as it could potentially be leveraged for both privilege escalation and system availability attacks. Regular security audits and kernel hardening practices should be implemented to reduce the attack surface and prevent similar memory corruption vulnerabilities from being exploited in the future.