CVE-2024-50217
📋 TL;DR
A use-after-free vulnerability in the Linux kernel's btrfs filesystem allows an attacker to potentially crash the system or execute arbitrary code. This affects systems using btrfs filesystems with multiple device images sharing the same filesystem ID but different device UUIDs. Attackers with local access can trigger this vulnerability through specific mounting sequences.
💻 Affected Systems
- Linux kernel
📦 What is this software?
Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →⚠️ Risk & Real-World Impact
Worst Case
Kernel panic leading to denial of service, or potential privilege escalation to kernel-level code execution.
Likely Case
System crash or kernel panic causing denial of service.
If Mitigated
No impact if patched or if btrfs multi-device configurations are not used.
🎯 Exploit Status
Requires specific mounting sequence of btrfs devices and local access with mount privileges.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Patches available in stable kernel branches via commits 47a83f8df39545f3f552bb6a1b6d9c30e37621dd and aec8e6bf839101784f3ef037dcdb9432c3f32343
Vendor Advisory: http://www.openwall.com/lists/oss-security/2025/04/10/4
Restart Required: Yes
Instructions:
1. Update Linux kernel to version containing the fix. 2. Check with your distribution for specific kernel updates. 3. Reboot system after kernel update.
🔧 Temporary Workarounds
Avoid problematic btrfs mounting sequences
linuxAvoid mounting btrfs filesystems from multiple images with same fsid but different dev_uuids in the specific sequence described in the vulnerability.
Disable btrfs multi-device support
linuxIf not needed, avoid using btrfs with multiple device configurations.
🧯 If You Can't Patch
- Restrict mount privileges to trusted users only
- Monitor for unusual btrfs mounting patterns or system crashes
🔍 How to Verify
Check if Vulnerable:
Check kernel version and if using btrfs with multi-device configurations. Vulnerable if using unpatched kernel with btrfs.Check Version:
uname -rVerify Fix Applied:
Verify kernel version includes the fix commits or check with 'uname -r' after updating.📡 Detection & Monitoring
Log Indicators:
- Kernel panic logs
- btrfs mount errors
- system crashes during filesystem operations
SIEM Query:
Search for kernel panic events or btrfs-related errors in system logs🔗 References
- https://git.kernel.org/stable/c/47a83f8df39545f3f552bb6a1b6d9c30e37621dd
- https://git.kernel.org/stable/c/aec8e6bf839101784f3ef037dcdb9432c3f32343
- http://www.openwall.com/lists/oss-security/2025/04/10/4
- http://www.openwall.com/lists/oss-security/2025/04/10/5
- http://www.openwall.com/lists/oss-security/2025/04/10/6
