In the Linux kernel, the following vulnerability has been resolved:
btrfs: fix memory ordering between normal and ordered work functions
Ordered work functions aren't guaranteed to be handled by the same thread which executed the normal work functions. The only way execution between normal/ordered functions is synchronized is via the WORK_DONE_BIT, unfortunately the used bitops don't guarantee any ordering whatsoever.
This manifested as seemingly inexplicable crashes on ARM64, where async_chunk::inode is seen as non-null in async_cow_submit which causes submit_compressed_extents to be called and crash occurs because async_chunk::inode suddenly became NULL. The call trace was similar to:
pc : submit_compressed_extents+0x38/0x3d0 lr : async_cow_submit+0x50/0xd0 sp : ffff800015d4bc20
<registers omitted for brevity>
Call trace: submit_compressed_extents+0x38/0x3d0 async_cow_submit+0x50/0xd0 run_ordered_work+0xc8/0x280 btrfs_work_helper+0x98/0x250 process_one_work+0x1f0/0x4ac worker_thread+0x188/0x504 kthread+0x110/0x114 ret_from_fork+0x10/0x18
Fix this by adding respective barrier calls which ensure that all accesses preceding setting of WORK_DONE_BIT are strictly ordered before setting the flag. At the same time add a read barrier after reading of WORK_DONE_BIT in run_ordered_work which ensures all subsequent loads would be strictly ordered after reading the bit. This in turn ensures are all accesses before WORK_DONE_BIT are going to be strictly ordered before any access that can occur in ordered_func.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernel-tools-debuginfoUpgrade bpftool-debuginfoUpgrade perfUpgrade python-perf-debuginfoUpgrade perf-debuginfoUpgrade python-perfUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-headersUpgrade kernel-develUpgrade kernel-tools-develUpgrade kernel-livepatch-4.14.256-197.484Upgrade kernel-toolsUpgrade kernel-debuginfoUpgrade kernelUpgrade bpftoolUpgrade kernel-livepatch-5.10.82-83.359Upgrade kernel-debuginfo-common-x86_64 | Aug 19, 2024 | Apr 10, 2024 |
| Debian | — | Upgrade linux | Jul 30, 2024 | Apr 10, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Apr 10, 2024 |
| Suse | — | Upgrade dtb-allwinnerUpgrade kernel-debug-vdsoUpgrade kernel-rt-vdsoUpgrade dlm-kmp-rtUpgrade kernel-preempt-develUpgrade kernel-docs-htmlUpgrade kernel-default-baseUpgrade gfs2-kmp-azureUpgrade gfs2-kmp-defaultUpgrade dtb-caviumUpgrade kernel-kvmsmall-vdsoUpgrade dtb-alteraUpgrade kernel-default-manUpgrade kernel-source-vanillaUpgrade reiserfs-kmp-64kbUpgrade kernel-preemptUpgrade kernel-azure-baseUpgrade kselftests-kmp-azureUpgrade kernel-source-rtUpgrade kernel-rt_debug-develUpgrade kernel-obs-buildUpgrade kernel-default-base-rebuildUpgrade kernel-64kb-extraUpgrade kernel-defaultUpgrade kernel-docsUpgrade dlm-kmp-defaultUpgrade kselftests-kmp-rtUpgrade kernel-azureUpgrade kernel-syms-azureUpgrade dtb-broadcomUpgrade kernel-syms-rtUpgrade dtb-rockchipUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-azure-develUpgrade ocfs2-kmp-defaultUpgrade kernel-azure-livepatch-develUpgrade dtb-qcomUpgrade dtb-nvidiaUpgrade kernel-rt-extraUpgrade cluster-md-kmp-64kbUpgrade dtb-sprdUpgrade kernel-azure-vdsoUpgrade kernel-default-vdsoUpgrade kernel-rt-optionalUpgrade kernel-rt-livepatch-develUpgrade reiserfs-kmp-azureUpgrade ocfs2-kmp-64kbUpgrade kernel-azure-optionalUpgrade kernel-rtUpgrade kernel-default-optionalUpgrade reiserfs-kmp-defaultUpgrade ocfs2-kmp-azureUpgrade kernel-devel-azureUpgrade kernel-zfcpdumpUpgrade dtb-apmUpgrade dtb-amlogicUpgrade kernel-symsUpgrade dtb-renesasUpgrade kernel-devel-rtUpgrade dtb-exynosUpgrade kernel-default-develUpgrade kernel-64kbUpgrade dtb-marvellUpgrade kernel-rt_debugUpgrade kernel-obs-qaUpgrade kernel-kvmsmall-livepatch-develUpgrade dtb-armUpgrade cluster-md-kmp-defaultUpgrade kernel-rt-livepatchUpgrade cluster-md-kmp-rtUpgrade dtb-freescaleUpgrade dtb-mediatekUpgrade gfs2-kmp-64kbUpgrade kernel-azure-extraUpgrade kernel-debugUpgrade kernel-kvmsmallUpgrade kernel-macrosUpgrade kernel-kvmsmall-develUpgrade kernel-debug-develUpgrade kernel-rt-develUpgrade kernel-default-livepatch-develUpgrade dtb-xilinxUpgrade kernel-rt_debug-vdsoUpgrade dtb-amdUpgrade kernel-default-extraUpgrade kernel-develUpgrade ocfs2-kmp-rtUpgrade kernel-64kb-develUpgrade dtb-amazonUpgrade dlm-kmp-64kbUpgrade dtb-appleUpgrade reiserfs-kmp-rtUpgrade dtb-socionextUpgrade kernel-source-azureUpgrade kernel-default-livepatchUpgrade kernel-64kb-livepatch-develUpgrade kernel-debug-livepatch-develUpgrade dlm-kmp-azureUpgrade kernel-64kb-optionalUpgrade kselftests-kmp-64kbUpgrade dtb-hisiliconUpgrade kselftests-kmp-defaultUpgrade kernel-sourceUpgrade dtb-lgUpgrade cluster-md-kmp-azureUpgrade gfs2-kmp-rt | Aug 9, 2024 | Apr 10, 2024 |
| Ubuntu | — | Upgrade linux-gkeopUpgrade linux-aws-hweUpgrade linux-gcpUpgrade linux-oracle-5.4Upgrade linux-hwe-5.4Upgrade linux-fipsUpgrade linux-kvmUpgrade linux-aws-fipsUpgrade linux-oracleUpgrade linux-ibmUpgrade linux-raspi-5.4Upgrade linux-bluefieldUpgrade linux-gcp-fipsUpgrade linux-awsUpgrade linux-aws-5.4Upgrade linux-azureUpgrade linux-ibm-5.4Upgrade linux-azure-fipsUpgrade linux-gcp-5.4Upgrade linux-hweUpgrade linux-azure-4.15Upgrade linuxUpgrade linux-azure-5.4Upgrade linux-gcp-4.15Upgrade linux-raspi | Nov 19, 2024 | Apr 10, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Apr 10, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub