CVE-2024-56774

btrfs: add a sanity check for btrfs root in btrfs_search_slot()

State
Published
Severity
5.5 Medium
Published
Jan 8, 2025
Updated
May 11, 2026
Reserved
Dec 29, 2024

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

btrfs: add a sanity check for btrfs root in btrfs_search_slot()

Syzbot reports a null-ptr-deref in btrfs_search_slot().

The reproducer is using rescue=ibadroots, and the extent tree root is corrupted thus the extent tree is NULL.

When scrub tries to search the extent tree to gather the needed extent info, btrfs_search_slot() doesn't check if the target root is NULL or not, resulting the null-ptr-deref.

Add sanity check for btrfs root before using it in btrfs_search_slot().

Scores

CVSSScoreVectorSource
3.15.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HCISA-ADP

Weaknesses

Affected Products

ProductVersions
LinuxLinux
  • 42437a6386ffeaaf200731e73d723ea491f3fe7d to before c71d114ef68c95da5a82ec85a721ab31f5bd905bAffected
  • 42437a6386ffeaaf200731e73d723ea491f3fe7d to before db66fb87c21e8ae724886e6a464dcbac562a64c6Affected
  • 42437a6386ffeaaf200731e73d723ea491f3fe7d to before 757171d1369b3b47f36932d40a05a0715496dcabAffected
  • 42437a6386ffeaaf200731e73d723ea491f3fe7d to before 93992c3d9629b02dccf6849238559d5c24f2deceAffected
  • 42437a6386ffeaaf200731e73d723ea491f3fe7d to before 3ed51857a50f530ac7a1482e069dfbd1298558d4Affected
LinuxLinux
  • 5.11Affected
  • before 5.11Not affected
  • 5.15.174 through 5.15.*Not affected
  • 6.1.120 through 6.1.*Not affected
  • 6.6.64 through 6.6.*Not affected
  • 6.12.4 through 6.12.*Not affected
  • 6.13 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.