CVE-2023-53672
btrfs: output extra debug info if we failed to find an inline backref
Using Linux by Linux?
Get instant alerts when new vulnerabilities affect Linux - before attackers find them.
Description
In the Linux kernel, the following vulnerability has been resolved: btrfs: output extra debug info if we failed to find an inline backref [BUG] Syzbot reported several warning triggered inside lookup_inline_extent_backref(). [CAUSE] As usual, the reproducer doesn't reliably trigger locally here, but at least we know the WARN_ON() is triggered when an inline backref can not be found, and it can only be triggered when @insert is true. (I.e. inserting a new inline backref, which means the backref should already exist) [ENHANCEMENT] After the WARN_ON(), dump all the parameters and the extent tree leaf to help debug.
Affected
Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.
Remediation
No guide yetNo remediation guidance has been written for this CVE yet. What the record does show:
Patch and advisory references
- https://git.kernel.org/stable/c/376b41524b71e494514720bd6114325b0a2ed19c
- https://git.kernel.org/stable/c/400e08a16604b534fdd82c5a288fa150d04f5f79
- https://git.kernel.org/stable/c/7afbfde45d665953b4d5a42a721e15bf0315d89b
- https://git.kernel.org/stable/c/b7c3cf2f6c42e6688b1c37215a0b1663f982f915
- https://git.kernel.org/stable/c/6994f806c6d1ae8b59344d3700358547f3b3fe1d
References (8)
CVSS
- Attack Vector
- LOCAL
- Complexity
- LOW
- Privileges
- LOW
- User Interaction
- NONE
- Scope
- UNCHANGED
- Confidentiality
- NONE
- Integrity
- NONE
- Availability
- HIGH
Quick Info
Get alerted
Stop reading CVE feeds looking for your own stack
Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.