{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2024-37354","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2024-06-24T13:53:25.569Z","datePublished":"2024-06-25T14:22:36.228Z","dateUpdated":"2026-08-05T11:32:30.724Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T11:32:30.724Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix crash on racing fsync and size-extending write into prealloc\n\nWe have been seeing crashes on duplicate keys in\nbtrfs_set_item_key_safe():\n\n  BTRFS critical (device vdb): slot 4 key (450 108 8192) new key (450 108 8192)\n  ------------[ cut here ]------------\n  kernel BUG at fs/btrfs/ctree.c:2620!\n  invalid opcode: 0000 [#1] PREEMPT SMP PTI\n  CPU: 0 PID: 3139 Comm: xfs_io Kdump: loaded Not tainted 6.9.0 #6\n  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-2.fc40 04/01/2014\n  RIP: 0010:btrfs_set_item_key_safe+0x11f/0x290 [btrfs]\n\nWith the following stack trace:\n\n  #0  btrfs_set_item_key_safe (fs/btrfs/ctree.c:2620:4)\n  #1  btrfs_drop_extents (fs/btrfs/file.c:411:4)\n  #2  log_one_extent (fs/btrfs/tree-log.c:4732:9)\n  #3  btrfs_log_changed_extents (fs/btrfs/tree-log.c:4955:9)\n  #4  btrfs_log_inode (fs/btrfs/tree-log.c:6626:9)\n  #5  btrfs_log_inode_parent (fs/btrfs/tree-log.c:7070:8)\n  #6  btrfs_log_dentry_safe (fs/btrfs/tree-log.c:7171:8)\n  #7  btrfs_sync_file (fs/btrfs/file.c:1933:8)\n  #8  vfs_fsync_range (fs/sync.c:188:9)\n  #9  vfs_fsync (fs/sync.c:202:9)\n  #10 do_fsync (fs/sync.c:212:9)\n  #11 __do_sys_fdatasync (fs/sync.c:225:9)\n  #12 __se_sys_fdatasync (fs/sync.c:223:1)\n  #13 __x64_sys_fdatasync (fs/sync.c:223:1)\n  #14 do_syscall_x64 (arch/x86/entry/common.c:52:14)\n  #15 do_syscall_64 (arch/x86/entry/common.c:83:7)\n  #16 entry_SYSCALL_64+0xaf/0x14c (arch/x86/entry/entry_64.S:121)\n\nSo we're logging a changed extent from fsync, which is splitting an\nextent in the log tree. But this split part already exists in the tree,\ntriggering the BUG().\n\nThis is the state of the log tree at the time of the crash, dumped with\ndrgn (https://github.com/osandov/drgn/blob/main/contrib/btrfs_tree.py)\nto get more details than btrfs_print_leaf() gives us:\n\n  >>> print_extent_buffer(prog.crashed_thread().stack_trace()[0][\"eb\"])\n  leaf 33439744 level 0 items 72 generation 9 owner 18446744073709551610\n  leaf 33439744 flags 0x100000000000000\n  fs uuid e5bd3946-400c-4223-8923-190ef1f18677\n  chunk uuid d58cb17e-6d02-494a-829a-18b7d8a399da\n          item 0 key (450 INODE_ITEM 0) itemoff 16123 itemsize 160\n                  generation 7 transid 9 size 8192 nbytes 8473563889606862198\n                  block group 0 mode 100600 links 1 uid 0 gid 0 rdev 0\n                  sequence 204 flags 0x10(PREALLOC)\n                  atime 1716417703.220000000 (2024-05-22 15:41:43)\n                  ctime 1716417704.983333333 (2024-05-22 15:41:44)\n                  mtime 1716417704.983333333 (2024-05-22 15:41:44)\n                  otime 17592186044416.000000000 (559444-03-08 01:40:16)\n          item 1 key (450 INODE_REF 256) itemoff 16110 itemsize 13\n                  index 195 namelen 3 name: 193\n          item 2 key (450 XATTR_ITEM 1640047104) itemoff 16073 itemsize 37\n                  location key (0 UNKNOWN.0 0) type XATTR\n                  transid 7 data_len 1 name_len 6\n                  name: user.a\n                  data a\n          item 3 key (450 EXTENT_DATA 0) itemoff 16020 itemsize 53\n                  generation 9 type 1 (regular)\n                  extent data disk byte 303144960 nr 12288\n                  extent data offset 0 nr 4096 ram 12288\n                  extent compression 0 (none)\n          item 4 key (450 EXTENT_DATA 4096) itemoff 15967 itemsize 53\n                  generation 9 type 2 (prealloc)\n                  prealloc data disk byte 303144960 nr 12288\n                  prealloc data offset 4096 nr 8192\n          item 5 key (450 EXTENT_DATA 8192) itemoff 15914 itemsize 53\n                  generation 9 type 2 (prealloc)\n                  prealloc data disk byte 303144960 nr 12288\n                  prealloc data offset 8192 nr 4096\n  ...\n\nSo the real problem happened earlier: notice that items 4 (4k-12k) and 5\n(8k-12k) overlap. Both are prealloc extents. Item 4 straddles i_size and\nitem 5 starts at i_size.\n\nHere is the state of \n---truncated---"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached purely through local syscalls (fallocate, fsetxattr, O_DIRECT pwrite, fdatasync) on a btrfs file, requiring a local account with write access to a btrfs filesystem. There is no network-facing consumer of this path in the default configuration.\nAC:L - The attacker drives both sides of the race — they issue the direct-I/O write that creates the in-flight ordered extent and the fsync that enters the unlocked btrfs_next_leaf() window — and can loop it while arranging the B-tree leaf layout via extents/xattrs. The commit author states these crashes were observed occurring spontaneously in production workloads, so deliberate triggering is reliable.\nPR:L - Only an ordinary unprivileged local user is needed; every operation on the path (fallocate, user.* xattr set, direct write, fdatasync) is permitted on a file the user owns, with no capability check anywhere in the call chain. Writable btrfs is the default root/home filesystem on Fedora and openSUSE and is common on containers and embedded/NAS devices.\nUI:N - The attacker performs the entire sequence itself against its own file; no victim action, mount, or administrator step is required. The crash occurs synchronously in the attacker's own fdatasync() call.\nS:U - The corruption and crash are confined to the kernel and the filesystem the attacker already has access to, with no crossing into another security authority such as a hypervisor or IOMMU domain. This is a standard in-kernel filesystem defect.\nC:H - The overlapping file extent items committed to the on-disk log tree yield wrong extent mappings and inconsistent extent back-references after log replay, a corruption class that can expose stale on-disk contents from previously freed blocks (notably for nodatasum/nodatacow prealloc files, the exact workload this code handles) and lead to blocks being reused while still referenced. Under the rule of choosing the higher value when uncertain, persistent filesystem metadata corruption is scored as High.\nI:H - The race silently commits overlapping prealloc extent items into the log tree, so after a crash the replay reinstates prealloc over ranges that were successfully written and fsync-acknowledged, loses part of prealloc extents, and leaves implicit holes — persistent, silent corruption and loss of user file data. The resulting extent-reference inconsistency can corrupt the subvolume tree beyond the attacking user's own files.\nA:H - The primary observed impact is a kernel BUG() (invalid opcode oops/panic) in btrfs_set_item_key_safe(), reproducibly triggered from an unprivileged fdatasync(). It fires with a btrfs leaf write-locked and a transaction handle held, so every other task touching that filesystem blocks indefinitely, and on systems with panic_on_oops the machine goes down entirely."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/btrfs/tree-log.c"],"versions":[{"version":"31d11b83b96faaee4bb514d375a09489117c3e8d","lessThan":"c993fd02ba471e296ca1996f13626fc917120158","status":"affected","versionType":"git"},{"version":"31d11b83b96faaee4bb514d375a09489117c3e8d","lessThan":"1ff2bd566fbcefcb892be85c493bdb92b911c428","status":"affected","versionType":"git"},{"version":"31d11b83b96faaee4bb514d375a09489117c3e8d","lessThan":"3d08c52ba1887a1ff9c179d4b6a18b427bcb2097","status":"affected","versionType":"git"},{"version":"31d11b83b96faaee4bb514d375a09489117c3e8d","lessThan":"f4e5ed974876c14d3623e04dc43d3e3281bc6011","status":"affected","versionType":"git"},{"version":"31d11b83b96faaee4bb514d375a09489117c3e8d","lessThan":"9d274c19a71b3a276949933859610721a453946b","status":"affected","versionType":"git"},{"version":"61a9f6b7fe0ca9706b49a23cecf5f9a9c802b6ce","status":"affected","versionType":"git"},{"version":"4.14.57","lessThan":"4.15","status":"affected","versionType":"semver"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/btrfs/tree-log.c"],"versions":[{"version":"4.17","status":"affected"},{"version":"0","lessThan":"4.17","status":"unaffected","versionType":"semver"},{"version":"5.15.197","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.94","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.34","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.9.5","lessThanOrEqual":"6.9.*","status":"unaffected","versionType":"semver"},{"version":"6.10","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.17","versionEndExcluding":"5.15.197"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.17","versionEndExcluding":"6.1.94"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.17","versionEndExcluding":"6.6.34"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.17","versionEndExcluding":"6.9.5"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.17","versionEndExcluding":"6.10"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.14.57"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/c993fd02ba471e296ca1996f13626fc917120158"},{"url":"https://git.kernel.org/stable/c/1ff2bd566fbcefcb892be85c493bdb92b911c428"},{"url":"https://git.kernel.org/stable/c/3d08c52ba1887a1ff9c179d4b6a18b427bcb2097"},{"url":"https://git.kernel.org/stable/c/f4e5ed974876c14d3623e04dc43d3e3281bc6011"},{"url":"https://git.kernel.org/stable/c/9d274c19a71b3a276949933859610721a453946b"}],"title":"btrfs: fix crash on racing fsync and size-extending write into prealloc","x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-06-25T15:43:24.537360Z","id":"CVE-2024-37354","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2024-06-25T15:43:32.621Z"}},{"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-02T03:50:56.095Z"},"title":"CVE Program Container","references":[{"url":"https://git.kernel.org/stable/c/1ff2bd566fbcefcb892be85c493bdb92b911c428","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/3d08c52ba1887a1ff9c179d4b6a18b427bcb2097","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/f4e5ed974876c14d3623e04dc43d3e3281bc6011","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/9d274c19a71b3a276949933859610721a453946b","tags":["x_transferred"]}]}]}}