CVE-2023-53538
Description
A tree modification logging error was found in the Linux kernel's Btrfs filesystem in the node balancing logic. A local user can trigger this issue during filesystem operations that cause internal B-tree rebalancing, where the code fails to log certain move operations in the tree modification log. This causes tree history replay to reference uninitialized memory containing garbage data, leading to invalid extent lookups, kernel panics, and denial of service.
Statement
Btrfs maintains a tree modification log to support historical tree queries, which are used by features like logical inode resolution and backref walking. When internal B-tree nodes need rebalancing, the filesystem may shift elements between sibling nodes through operations like balance_node_right and push_node_left. These operations should log their modifications so the tree can be rewound to earlier states. However, there's a subtle interaction: balance_node_right logs a MOVE operation, then push_node_left copies elements and shifts others—but deliberately skips logging the second move to avoid double-logging the copied elements. Unfortunately, this leaves out a critical move operation. When the tree mod log gets replayed (rewound), it reconstructs the historical tree state by reversing logged operations. The missing move operation causes the replay to memmove data from never-initialized memory regions, filling slots with garbage, often all zeros. If a search then uses one of these corrupted slots, it tries to read extent buffers at bogus addresses like offset 0, triggering panics in the extent mapping code. This race is quite rare and depends on specific timing during concurrent tree operations.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | 5.5 | N/A |
| Attack Vector | Local | Local | N/A |
| Attack Complexity | Low | Low | N/A |
| Privileges Required | Low | Low | N/A |
| User Interaction | None | None | N/A |
| Scope | Unchanged | Unchanged | N/A |
| Confidentiality | None | None | N/A |
| Integrity Impact | None | None | N/A |
| Availability Impact | High | High | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
NVD: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Memory; Read Application Data
When reusing a resource such as memory or a program variable, the original contents of that resource may not be cleared before it is sent to an untrusted party.
Availability
Technical Impact: DoS: Crash, Exit, or Restart
The uninitialized resource may contain values that cause program flow to change in ways that the programmer did not intend.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
