CVE-2024-47741 (GCVE-0-2024-47741)

Vulnerability from cvelistv5 – Published: 2024-10-21 12:14 – Updated: 2026-05-11 20:39
VLAI
Title
btrfs: fix race setting file private on concurrent lseek using same fd
Summary
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix race setting file private on concurrent lseek using same fd When doing concurrent lseek(2) system calls against the same file descriptor, using multiple threads belonging to the same process, we have a short time window where a race happens and can result in a memory leak. The race happens like this: 1) A program opens a file descriptor for a file and then spawns two threads (with the pthreads library for example), lets call them task A and task B; 2) Task A calls lseek with SEEK_DATA or SEEK_HOLE and ends up at file.c:find_desired_extent() while holding a read lock on the inode; 3) At the start of find_desired_extent(), it extracts the file's private_data pointer into a local variable named 'private', which has a value of NULL; 4) Task B also calls lseek with SEEK_DATA or SEEK_HOLE, locks the inode in shared mode and enters file.c:find_desired_extent(), where it also extracts file->private_data into its local variable 'private', which has a NULL value; 5) Because it saw a NULL file private, task A allocates a private structure and assigns to the file structure; 6) Task B also saw a NULL file private so it also allocates its own file private and then assigns it to the same file structure, since both tasks are using the same file descriptor. At this point we leak the private structure allocated by task A. Besides the memory leak, there's also the detail that both tasks end up using the same cached state record in the private structure (struct btrfs_file_private::llseek_cached_state), which can result in a use-after-free problem since one task can free it while the other is still using it (only one task took a reference count on it). Also, sharing the cached state is not a good idea since it could result in incorrect results in the future - right now it should not be a problem because it end ups being used only in extent-io-tree.c:count_range_bits() where we do range validation before using the cached state. Fix this by protecting the private assignment and check of a file while holding the inode's spinlock and keep track of the task that allocated the private, so that it's used only by that task in order to prevent user-after-free issues with the cached state record as well as potentially using it incorrectly in the future.
Severity
No CVSS data available.
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 3c32c7212f1639471ec0197ff1179b8ef2e0f3d3 , < f56a6d9c267ec7fa558ede7755551c047b1034cd (git)
Affected: 3c32c7212f1639471ec0197ff1179b8ef2e0f3d3 , < a412ca489ac27b9d0e603499315b7139c948130d (git)
Affected: 3c32c7212f1639471ec0197ff1179b8ef2e0f3d3 , < 33d1310d4496e904123dab9c28b2d8d2c1800f97 (git)
Affected: 3c32c7212f1639471ec0197ff1179b8ef2e0f3d3 , < 7ee85f5515e86a4e2a2f51969795920733912bad (git)
Create a notification for this product.
Linux Linux Affected: 6.2
Unaffected: 0 , < 6.2 (semver)
Unaffected: 6.6.54 , ≤ 6.6.* (semver)
Unaffected: 6.10.13 , ≤ 6.10.* (semver)
Unaffected: 6.11.2 , ≤ 6.11.* (semver)
Unaffected: 6.12 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-47741",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-21T12:59:11.632637Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-21T13:04:14.475Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/btrfs/btrfs_inode.h",
            "fs/btrfs/ctree.h",
            "fs/btrfs/file.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f56a6d9c267ec7fa558ede7755551c047b1034cd",
              "status": "affected",
              "version": "3c32c7212f1639471ec0197ff1179b8ef2e0f3d3",
              "versionType": "git"
            },
            {
              "lessThan": "a412ca489ac27b9d0e603499315b7139c948130d",
              "status": "affected",
              "version": "3c32c7212f1639471ec0197ff1179b8ef2e0f3d3",
              "versionType": "git"
            },
            {
              "lessThan": "33d1310d4496e904123dab9c28b2d8d2c1800f97",
              "status": "affected",
              "version": "3c32c7212f1639471ec0197ff1179b8ef2e0f3d3",
              "versionType": "git"
            },
            {
              "lessThan": "7ee85f5515e86a4e2a2f51969795920733912bad",
              "status": "affected",
              "version": "3c32c7212f1639471ec0197ff1179b8ef2e0f3d3",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/btrfs/btrfs_inode.h",
            "fs/btrfs/ctree.h",
            "fs/btrfs/file.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.2"
            },
            {
              "lessThan": "6.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.54",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.54",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.13",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.2",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix race setting file private on concurrent lseek using same fd\n\nWhen doing concurrent lseek(2) system calls against the same file\ndescriptor, using multiple threads belonging to the same process, we have\na short time window where a race happens and can result in a memory leak.\n\nThe race happens like this:\n\n1) A program opens a file descriptor for a file and then spawns two\n   threads (with the pthreads library for example), lets call them\n   task A and task B;\n\n2) Task A calls lseek with SEEK_DATA or SEEK_HOLE and ends up at\n   file.c:find_desired_extent() while holding a read lock on the inode;\n\n3) At the start of find_desired_extent(), it extracts the file\u0027s\n   private_data pointer into a local variable named \u0027private\u0027, which has\n   a value of NULL;\n\n4) Task B also calls lseek with SEEK_DATA or SEEK_HOLE, locks the inode\n   in shared mode and enters file.c:find_desired_extent(), where it also\n   extracts file-\u003eprivate_data into its local variable \u0027private\u0027, which\n   has a NULL value;\n\n5) Because it saw a NULL file private, task A allocates a private\n   structure and assigns to the file structure;\n\n6) Task B also saw a NULL file private so it also allocates its own file\n   private and then assigns it to the same file structure, since both\n   tasks are using the same file descriptor.\n\n   At this point we leak the private structure allocated by task A.\n\nBesides the memory leak, there\u0027s also the detail that both tasks end up\nusing the same cached state record in the private structure (struct\nbtrfs_file_private::llseek_cached_state), which can result in a\nuse-after-free problem since one task can free it while the other is\nstill using it (only one task took a reference count on it). Also, sharing\nthe cached state is not a good idea since it could result in incorrect\nresults in the future - right now it should not be a problem because it\nend ups being used only in extent-io-tree.c:count_range_bits() where we do\nrange validation before using the cached state.\n\nFix this by protecting the private assignment and check of a file while\nholding the inode\u0027s spinlock and keep track of the task that allocated\nthe private, so that it\u0027s used only by that task in order to prevent\nuser-after-free issues with the cached state record as well as potentially\nusing it incorrectly in the future."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T20:39:51.387Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f56a6d9c267ec7fa558ede7755551c047b1034cd"
        },
        {
          "url": "https://git.kernel.org/stable/c/a412ca489ac27b9d0e603499315b7139c948130d"
        },
        {
          "url": "https://git.kernel.org/stable/c/33d1310d4496e904123dab9c28b2d8d2c1800f97"
        },
        {
          "url": "https://git.kernel.org/stable/c/7ee85f5515e86a4e2a2f51969795920733912bad"
        }
      ],
      "title": "btrfs: fix race setting file private on concurrent lseek using same fd",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-47741",
    "datePublished": "2024-10-21T12:14:09.836Z",
    "dateReserved": "2024-09-30T16:00:12.959Z",
    "dateUpdated": "2026-05-11T20:39:51.387Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-47741",
      "date": "2026-07-22",
      "epss": "0.00163",
      "percentile": "0.05947"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-47741\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-10-21T13:15:04.207\",\"lastModified\":\"2026-06-17T07:57:39.990\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbtrfs: fix race setting file private on concurrent lseek using same fd\\n\\nWhen doing concurrent lseek(2) system calls against the same file\\ndescriptor, using multiple threads belonging to the same process, we have\\na short time window where a race happens and can result in a memory leak.\\n\\nThe race happens like this:\\n\\n1) A program opens a file descriptor for a file and then spawns two\\n   threads (with the pthreads library for example), lets call them\\n   task A and task B;\\n\\n2) Task A calls lseek with SEEK_DATA or SEEK_HOLE and ends up at\\n   file.c:find_desired_extent() while holding a read lock on the inode;\\n\\n3) At the start of find_desired_extent(), it extracts the file\u0027s\\n   private_data pointer into a local variable named \u0027private\u0027, which has\\n   a value of NULL;\\n\\n4) Task B also calls lseek with SEEK_DATA or SEEK_HOLE, locks the inode\\n   in shared mode and enters file.c:find_desired_extent(), where it also\\n   extracts file-\u003eprivate_data into its local variable \u0027private\u0027, which\\n   has a NULL value;\\n\\n5) Because it saw a NULL file private, task A allocates a private\\n   structure and assigns to the file structure;\\n\\n6) Task B also saw a NULL file private so it also allocates its own file\\n   private and then assigns it to the same file structure, since both\\n   tasks are using the same file descriptor.\\n\\n   At this point we leak the private structure allocated by task A.\\n\\nBesides the memory leak, there\u0027s also the detail that both tasks end up\\nusing the same cached state record in the private structure (struct\\nbtrfs_file_private::llseek_cached_state), which can result in a\\nuse-after-free problem since one task can free it while the other is\\nstill using it (only one task took a reference count on it). Also, sharing\\nthe cached state is not a good idea since it could result in incorrect\\nresults in the future - right now it should not be a problem because it\\nend ups being used only in extent-io-tree.c:count_range_bits() where we do\\nrange validation before using the cached state.\\n\\nFix this by protecting the private assignment and check of a file while\\nholding the inode\u0027s spinlock and keep track of the task that allocated\\nthe private, so that it\u0027s used only by that task in order to prevent\\nuser-after-free issues with the cached state record as well as potentially\\nusing it incorrectly in the future.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: btrfs: arreglo de ejecuci\u00f3n que establece el archivo privado en lseek concurrente usando el mismo fd Al realizar llamadas al sistema lseek(2) concurrentes contra el mismo descriptor de archivo, usando m\u00faltiples subprocesos que pertenecen al mismo proceso, tenemos una ventana de tiempo corta donde ocurre una ejecuci\u00f3n y puede resultar en una p\u00e9rdida de memoria. La ejecuci\u00f3n ocurre as\u00ed: 1) Un programa abre un descriptor de archivo para un archivo y luego genera dos subprocesos (con la librer\u00eda pthreads por ejemplo), llam\u00e9moslos tarea A y tarea B; 2) La tarea A llama a lseek con SEEK_DATA o SEEK_HOLE y termina en file.c:find_desired_extent() mientras mantiene un bloqueo de lectura en el inodo; 3) Al comienzo de find_desired_extent(), extrae el puntero private_data del archivo en una variable local llamada \u0027private\u0027, que tiene un valor de NULL; 4) La tarea B tambi\u00e9n llama a lseek con SEEK_DATA o SEEK_HOLE, bloquea el inodo en modo compartido e ingresa a file.c:find_desired_extent(), donde tambi\u00e9n extrae file-\u0026gt;private_data en su variable local \u0027private\u0027, que tiene un valor NULL; 5) Debido a que vio un archivo privado NULL, la tarea A asigna una estructura privada y la asigna a la estructura de archivo; 6) La tarea B tambi\u00e9n vio un archivo privado NULL, por lo que tambi\u00e9n asigna su propio archivo privado y luego lo asigna a la misma estructura de archivo, ya que ambas tareas est\u00e1n usando el mismo descriptor de archivo. En este punto filtramos la estructura privada asignada por la tarea A. Adem\u00e1s de la fuga de memoria, tambi\u00e9n est\u00e1 el detalle de que ambas tareas terminan usando el mismo registro de estado en cach\u00e9 en la estructura privada (struct btrfs_file_private::llseek_cached_state), lo que puede resultar en un problema de use after free, ya que una tarea puede liberarlo mientras la otra todav\u00eda lo est\u00e1 usando (solo una tarea tom\u00f3 un recuento de referencia en \u00e9l). Adem\u00e1s, compartir el estado en cach\u00e9 no es una buena idea, ya que podr\u00eda resultar en resultados incorrectos en el futuro; en este momento no deber\u00eda ser un problema porque termina siendo utilizado solo en extended-io-tree.c:count_range_bits() donde realizamos la validaci\u00f3n de rango antes de usar el estado en cach\u00e9. Solucione esto protegiendo la asignaci\u00f3n privada y la verificaci\u00f3n de un archivo mientras mantiene el spinlock del inodo y realice un seguimiento de la tarea que asign\u00f3 el privado, de modo que solo lo use esa tarea para evitar problemas de use after free con el registro de estado en cach\u00e9, as\u00ed como potencialmente usarlo incorrectamente en el futuro.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/btrfs/btrfs_inode.h\",\"fs/btrfs/ctree.h\",\"fs/btrfs/file.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3c32c7212f1639471ec0197ff1179b8ef2e0f3d3\",\"lessThan\":\"f56a6d9c267ec7fa558ede7755551c047b1034cd\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3c32c7212f1639471ec0197ff1179b8ef2e0f3d3\",\"lessThan\":\"a412ca489ac27b9d0e603499315b7139c948130d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3c32c7212f1639471ec0197ff1179b8ef2e0f3d3\",\"lessThan\":\"33d1310d4496e904123dab9c28b2d8d2c1800f97\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3c32c7212f1639471ec0197ff1179b8ef2e0f3d3\",\"lessThan\":\"7ee85f5515e86a4e2a2f51969795920733912bad\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/btrfs/btrfs_inode.h\",\"fs/btrfs/ctree.h\",\"fs/btrfs/file.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.2\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.2\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.54\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.10.13\",\"lessThanOrEqual\":\"6.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.11.2\",\"lessThanOrEqual\":\"6.11.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.0,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.0,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-10-21T12:59:11.632637Z\",\"id\":\"CVE-2024-47741\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-362\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.54\",\"matchCriteriaId\":\"D448821D-C085-4CAF-88FA-2DDE7BE21976\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.10.13\",\"matchCriteriaId\":\"CE94BB8D-B0AB-4563-9ED7-A12122B56EBE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.11\",\"versionEndExcluding\":\"6.11.2\",\"matchCriteriaId\":\"AB755D26-97F4-43B6-8604-CD076811E181\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/33d1310d4496e904123dab9c28b2d8d2c1800f97\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7ee85f5515e86a4e2a2f51969795920733912bad\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a412ca489ac27b9d0e603499315b7139c948130d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f56a6d9c267ec7fa558ede7755551c047b1034cd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2025-11-21T14:22:05+00:00",
      "cve": "CVE-2024-47741",
      "id": "CVE-2024-47741",
      "initial_release_date": "2024-10-21T00:00:00+00:00",
      "product_status:known_affected": "42",
      "product_status:known_not_affected": "156",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: btrfs: fix race setting file private on concurrent lseek using same fd",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-47741.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-47741\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-10-21T12:59:11.632637Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-10-21T12:59:14.702Z\"}}], \"cna\": {\"title\": \"btrfs: fix race setting file private on concurrent lseek using same fd\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"3c32c7212f1639471ec0197ff1179b8ef2e0f3d3\", \"lessThan\": \"f56a6d9c267ec7fa558ede7755551c047b1034cd\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"3c32c7212f1639471ec0197ff1179b8ef2e0f3d3\", \"lessThan\": \"a412ca489ac27b9d0e603499315b7139c948130d\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"3c32c7212f1639471ec0197ff1179b8ef2e0f3d3\", \"lessThan\": \"33d1310d4496e904123dab9c28b2d8d2c1800f97\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"3c32c7212f1639471ec0197ff1179b8ef2e0f3d3\", \"lessThan\": \"7ee85f5515e86a4e2a2f51969795920733912bad\", \"versionType\": \"git\"}], \"programFiles\": [\"fs/btrfs/btrfs_inode.h\", \"fs/btrfs/ctree.h\", \"fs/btrfs/file.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.2\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.2\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.6.54\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10.13\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.10.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11.2\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.11.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"fs/btrfs/btrfs_inode.h\", \"fs/btrfs/ctree.h\", \"fs/btrfs/file.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/f56a6d9c267ec7fa558ede7755551c047b1034cd\"}, {\"url\": \"https://git.kernel.org/stable/c/a412ca489ac27b9d0e603499315b7139c948130d\"}, {\"url\": \"https://git.kernel.org/stable/c/33d1310d4496e904123dab9c28b2d8d2c1800f97\"}, {\"url\": \"https://git.kernel.org/stable/c/7ee85f5515e86a4e2a2f51969795920733912bad\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbtrfs: fix race setting file private on concurrent lseek using same fd\\n\\nWhen doing concurrent lseek(2) system calls against the same file\\ndescriptor, using multiple threads belonging to the same process, we have\\na short time window where a race happens and can result in a memory leak.\\n\\nThe race happens like this:\\n\\n1) A program opens a file descriptor for a file and then spawns two\\n   threads (with the pthreads library for example), lets call them\\n   task A and task B;\\n\\n2) Task A calls lseek with SEEK_DATA or SEEK_HOLE and ends up at\\n   file.c:find_desired_extent() while holding a read lock on the inode;\\n\\n3) At the start of find_desired_extent(), it extracts the file\u0027s\\n   private_data pointer into a local variable named \u0027private\u0027, which has\\n   a value of NULL;\\n\\n4) Task B also calls lseek with SEEK_DATA or SEEK_HOLE, locks the inode\\n   in shared mode and enters file.c:find_desired_extent(), where it also\\n   extracts file-\u003eprivate_data into its local variable \u0027private\u0027, which\\n   has a NULL value;\\n\\n5) Because it saw a NULL file private, task A allocates a private\\n   structure and assigns to the file structure;\\n\\n6) Task B also saw a NULL file private so it also allocates its own file\\n   private and then assigns it to the same file structure, since both\\n   tasks are using the same file descriptor.\\n\\n   At this point we leak the private structure allocated by task A.\\n\\nBesides the memory leak, there\u0027s also the detail that both tasks end up\\nusing the same cached state record in the private structure (struct\\nbtrfs_file_private::llseek_cached_state), which can result in a\\nuse-after-free problem since one task can free it while the other is\\nstill using it (only one task took a reference count on it). Also, sharing\\nthe cached state is not a good idea since it could result in incorrect\\nresults in the future - right now it should not be a problem because it\\nend ups being used only in extent-io-tree.c:count_range_bits() where we do\\nrange validation before using the cached state.\\n\\nFix this by protecting the private assignment and check of a file while\\nholding the inode\u0027s spinlock and keep track of the task that allocated\\nthe private, so that it\u0027s used only by that task in order to prevent\\nuser-after-free issues with the cached state record as well as potentially\\nusing it incorrectly in the future.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.54\", \"versionStartIncluding\": \"6.2\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10.13\", \"versionStartIncluding\": \"6.2\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11.2\", \"versionStartIncluding\": \"6.2\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12\", \"versionStartIncluding\": \"6.2\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-11T20:39:51.387Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-47741\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-11T20:39:51.387Z\", \"dateReserved\": \"2024-09-30T16:00:12.959Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-10-21T12:14:09.836Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.