PT-2023-9423 · Linux+4 · Linux Kernel+4

Syzbot

·

Published

2023-01-16

·

Updated

2025-09-29

·

CVE-2023-52896

CVSS v3.1

4.7

Medium

VectorAV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)
Description The vulnerability is related to a race condition between the quota rescan and disable functions in the btrfs component of the Linux kernel, leading to a NULL pointer dereference. This occurs when one task is trying to start the quota rescan worker while another task is trying to disable quotas. The steps involved in this race condition are:
  1. Quotas are enabled;
  2. One task calls the quota rescan ioctl, entering btrfs qgroup rescan(), which calls qgroup rescan init() and then joins and commits a transaction;
  3. Another task calls the quota disable ioctl, entering btrfs quota disable(), which clears the quota enabled flag and calls btrfs qgroup wait for completion(), then starts a transaction and locks fs info->qgroup ioctl lock;
  4. The first task queues the rescan worker;
  5. The rescan worker starts and checks if it should stop, resulting in no iterations because the quota enabled flag was cleared;
  6. The second task sets fs info->quota root to NULL;
  7. The rescan worker attempts to start a transaction using fs info->quota root, leading to a NULL pointer dereference in btrfs start transaction(). This results in a general protection fault and a stack trace indicating the NULL pointer dereference.
Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

NULL Pointer Dereference

Found an issue in the description? Have something to add? Feel free to write us 👾

Weakness Enumeration

Related Identifiers

ALSA-2025_16880
ALT-PU-2023-8448
BDU:2024-07447
CVE-2023-52896
OESA-2024-2106
OPENSUSE-SU-2024_3190-1
OPENSUSE-SU-2024_3209-1
OPENSUSE-SU-2024_3408-1
OPENSUSE-SU-2024_3483-1
SUSE-SU-2024:3190-1
SUSE-SU-2024:3209-1
SUSE-SU-2024:3227-1
SUSE-SU-2024:3408-1
SUSE-SU-2024:3483-1

Affected Products

Alt Linux
Astra Linux
Linux Kernel
Red Os
Suse