Описание
In the Linux kernel, the following vulnerability has been resolved:
btrfs: abort transaction on failure to update inode for hole punching and reflinking
If we fail to update the inode we error out without aborting the
transaction, which can result in a persistent inconsistency if after
the failure the transaction is committed, as we have dropped file
extent items from a range and either punched a hole or insert a new file
extent item for that range (for reflinks).
So add the missing transaction abort.
A flaw was found in the Linux kernel's Btrfs file system. When operations such as hole punching or file cloning encounter an error while updating file metadata, the kernel does not abort the active transaction. A local user could trigger these operations, potentially causing partially updated file structures to be written to disk and resulting in persistent file system corruption.
Отчет
A moderate security impact flaw in the Linux kernel's Btrfs file system affects the kernel packages shipped in Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 10, and Red Hat In-Vehicle OS 2. When hole punching or reflinking (file cloning) operations fail while updating a file's inode metadata, the kernel errors out without aborting the active transaction. If that transaction is subsequently committed, file extent items that were already dropped from the affected range, or replaced by a new file extent in the case of reflinks, become inconsistent with the inode metadata, which can result in persistent file system corruption. A local user with write access to files on a mounted Btrfs file system can trigger the vulnerable operations, but exploiting the flaw also requires that the inode update itself fail, for example under memory pressure or I/O errors, followed by a successful transaction commit, which makes reliable exploitation complex and unlikely. The kernel versions shipped in Red Hat Enterprise Linux 8 and 9, and the Red Hat Enterprise Linux CoreOS kernels used by OpenShift Container Platform, are not affected because the vulnerable code is not present in those versions. Because triggering the flaw depends on such an uncommon error path, the fix for the affected Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 10, and Red Hat In-Vehicle OS streams is being deferred to a future update; the residual risk is persistent Btrfs file system corruption, with potential data loss or reduced availability of the file system, if the flaw is triggered.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 6 | kernel | Out of support scope | ||
| Red Hat Enterprise Linux 7 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 7 | kernel-rt | Fix deferred | ||
| Red Hat Enterprise Linux 8 | kernel | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 9 | kernel | Not affected | ||
| Red Hat Enterprise Linux 9 | kernel-rt | Not affected | ||
| Red Hat OpenShift Container Platform 4 | openshift/ose-rhel-coreos-8 | Not affected | ||
| Red Hat OpenShift Container Platform 4 | openshift/ose-rhel-coreos-9 | Not affected |
Показывать по
Дополнительная информация
Статус:
EPSS
5.5 Medium
CVSS3
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: btrfs: abort transaction on failure to update inode for hole punching and reflinking If we fail to update the inode we error out without aborting the transaction, which can result in a persistent inconsistency if after the failure the transaction is committed, as we have dropped file extent items from a range and either punched a hole or insert a new file extent item for that range (for reflinks). So add the missing transaction abort.
In the Linux kernel, the following vulnerability has been resolved: btrfs: abort transaction on failure to update inode for hole punching and reflinking If we fail to update the inode we error out without aborting the transaction, which can result in a persistent inconsistency if after the failure the transaction is committed, as we have dropped file extent items from a range and either punched a hole or insert a new file extent item for that range (for reflinks). So add the missing transaction abort.
btrfs: abort transaction on failure to update inode for hole punching and reflinking
In the Linux kernel, the following vulnerability has been resolved: b ...
In the Linux kernel, the following vulnerability has been resolved: btrfs: abort transaction on failure to update inode for hole punching and reflinking If we fail to update the inode we error out without aborting the transaction, which can result in a persistent inconsistency if after the failure the transaction is committed, as we have dropped file extent items from a range and either punched a hole or insert a new file extent item for that range (for reflinks). So add the missing transaction abort.
EPSS
5.5 Medium
CVSS3