PT-2024-8241 · Linux+4 · Linux Kernel+4

Filipe Manana

·

Published

2024-09-17

·

Updated

2025-04-01

·

CVE-2024-47741

CVSS v3.1

7.0

High

VectorAV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.6.58
Description: The issue is related to a race condition in the btrfs file system, specifically in the find desired extent() function. When multiple threads access the same file descriptor concurrently, a memory leak can occur due to the allocation of private structures by each thread. This can lead to a use-after-free problem, as one thread may free the structure while another is still using it. The issue arises from the shared use of the same cached state record in the private structure, which can result in incorrect results. The problem is fixed by protecting the private assignment and check of a file while holding the inode's spinlock and keeping track of the task that allocated the private.
Recommendations: For Linux kernel versions prior to 6.6.58, update to version 6.6.58 or later to resolve the issue. As a temporary workaround, consider restricting concurrent access to the same file descriptor to minimize the risk of exploitation. Additionally, avoid using the lseek system call with SEEK DATA or SEEK HOLE flags on the same file descriptor from multiple threads.

Exploit

Fix

Use After Free

Memory Leak

Race Condition

Found an issue in the description? Have something to add? Feel free to write us 👾

Weakness Enumeration

Related Identifiers

AZL-50853
BDU:2024-09794
CVE-2024-47741
MGASA-2024-0344
MGASA-2024-0345
OESA-2024-2296
OPENSUSE-SU-2024:14500-1
OPENSUSE-SU-2024_3984-1
OPENSUSE-SU-2024_3986-1
OPENSUSE-SU-2025:14705-1
SUSE-SU-2024:3984-1
SUSE-SU-2024:3986-1
SUSE-SU-2024:4318-1
SUSE-SU-2024:4387-1
SUSE-SU-2025:20163-1
SUSE-SU-2025:20164-1
SUSE-SU-2025:20246-1
SUSE-SU-2025:20247-1
USN-7276-1
USN-7277-1
USN-7301-1
USN-7303-1
USN-7303-2
USN-7303-3
USN-7304-1
USN-7310-1
USN-7311-1
USN-7384-1
USN-7384-2
USN-7385-1
USN-7386-1
USN-7403-1

Affected Products

Linuxmint
Linux Kernel
Red Os
Suse
Ubuntu