GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-50217 (GCVE-0-2024-50217)

Vulnerability from cvelistv5 – Published: 2024-11-09 10:14 – Updated: 2026-08-05 11:42
VLAI
Title
btrfs: fix use-after-free of block device file in __btrfs_free_extra_devids()
Summary
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix use-after-free of block device file in __btrfs_free_extra_devids() Mounting btrfs from two images (which have the same one fsid and two different dev_uuids) in certain executing order may trigger an UAF for variable 'device->bdev_file' in __btrfs_free_extra_devids(). And following are the details: 1. Attach image_1 to loop0, attach image_2 to loop1, and scan btrfs devices by ioctl(BTRFS_IOC_SCAN_DEV): / btrfs_device_1 → loop0 fs_device \ btrfs_device_2 → loop1 2. mount /dev/loop0 /mnt btrfs_open_devices btrfs_device_1->bdev_file = btrfs_get_bdev_and_sb(loop0) btrfs_device_2->bdev_file = btrfs_get_bdev_and_sb(loop1) btrfs_fill_super open_ctree fail: btrfs_close_devices // -ENOMEM btrfs_close_bdev(btrfs_device_1) fput(btrfs_device_1->bdev_file) // btrfs_device_1->bdev_file is freed btrfs_close_bdev(btrfs_device_2) fput(btrfs_device_2->bdev_file) 3. mount /dev/loop1 /mnt btrfs_open_devices btrfs_get_bdev_and_sb(&bdev_file) // EIO, btrfs_device_1->bdev_file is not assigned, // which points to a freed memory area btrfs_device_2->bdev_file = btrfs_get_bdev_and_sb(loop1) btrfs_fill_super open_ctree btrfs_free_extra_devids if (btrfs_device_1->bdev_file) fput(btrfs_device_1->bdev_file) // UAF ! Fix it by setting 'device->bdev_file' as 'NULL' after closing the btrfs_device in btrfs_close_one_device().
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-12-11 14:25 UTC
CWE
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 142388194191a3edc9ba01cfcfd8b691e0971fb2 , < 47a83f8df39545f3f552bb6a1b6d9c30e37621dd (git)
Affected: 142388194191a3edc9ba01cfcfd8b691e0971fb2 , < aec8e6bf839101784f3ef037dcdb9432c3f32343 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.8
Unaffected: 0 , < 4.8 (semver)
Unaffected: 6.11.7 , ≤ 6.11.* (semver)
Unaffected: 6.12 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-50217",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-11T14:25:44.077787Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-12-11T14:58:32.841Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-04-11T00:11:26.593Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2025/04/10/4"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2025/04/10/5"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2025/04/10/6"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/btrfs/volumes.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "47a83f8df39545f3f552bb6a1b6d9c30e37621dd",
              "status": "affected",
              "version": "142388194191a3edc9ba01cfcfd8b691e0971fb2",
              "versionType": "git"
            },
            {
              "lessThan": "aec8e6bf839101784f3ef037dcdb9432c3f32343",
              "status": "affected",
              "version": "142388194191a3edc9ba01cfcfd8b691e0971fb2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/btrfs/volumes.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.8"
            },
            {
              "lessThan": "4.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.7",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix use-after-free of block device file in __btrfs_free_extra_devids()\n\nMounting btrfs from two images (which have the same one fsid and two\ndifferent dev_uuids) in certain executing order may trigger an UAF for\nvariable \u0027device-\u003ebdev_file\u0027 in __btrfs_free_extra_devids(). And\nfollowing are the details:\n\n1. Attach image_1 to loop0, attach image_2 to loop1, and scan btrfs\n   devices by ioctl(BTRFS_IOC_SCAN_DEV):\n\n             /  btrfs_device_1 \u2192 loop0\n   fs_device\n             \\  btrfs_device_2 \u2192 loop1\n2. mount /dev/loop0 /mnt\n   btrfs_open_devices\n    btrfs_device_1-\u003ebdev_file = btrfs_get_bdev_and_sb(loop0)\n    btrfs_device_2-\u003ebdev_file = btrfs_get_bdev_and_sb(loop1)\n   btrfs_fill_super\n    open_ctree\n     fail: btrfs_close_devices // -ENOMEM\n\t    btrfs_close_bdev(btrfs_device_1)\n             fput(btrfs_device_1-\u003ebdev_file)\n\t      // btrfs_device_1-\u003ebdev_file is freed\n\t    btrfs_close_bdev(btrfs_device_2)\n             fput(btrfs_device_2-\u003ebdev_file)\n\n3. mount /dev/loop1 /mnt\n   btrfs_open_devices\n    btrfs_get_bdev_and_sb(\u0026bdev_file)\n     // EIO, btrfs_device_1-\u003ebdev_file is not assigned,\n     // which points to a freed memory area\n    btrfs_device_2-\u003ebdev_file = btrfs_get_bdev_and_sb(loop1)\n   btrfs_fill_super\n    open_ctree\n     btrfs_free_extra_devids\n      if (btrfs_device_1-\u003ebdev_file)\n       fput(btrfs_device_1-\u003ebdev_file) // UAF !\n\nFix it by setting \u0027device-\u003ebdev_file\u0027 as \u0027NULL\u0027 after closing the\nbtrfs_device in btrfs_close_one_device()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached only through local block-device operations \u2014 `mount(2)` of a btrfs volume plus device registration via `BTRFS_IOC_SCAN_DEV`/`device=` \u2014 on a locally attached device or loop-mounted image. No network or remote-peer data is involved.\nAC:L - The attacker fully controls both filesystem images and the order of the two mounts; the first mount\u0027s `open_ctree()` failure can be forced deterministically by corrupting the superblock/chunk tree rather than relying on the ENOMEM fault injection in the report, and no race must be won. Heap grooming of the `filp` slab between the two mounts is entirely under attacker control.\nPR:N - The attacker supplies only the malicious images (USB stick, disk image file, or loop-backed file) and needs no account or privilege on the target system; the privileged mount is performed by the victim or by an automounter such as udisks2 on the attacker\u0027s behalf.\nUI:R - Exploitation requires the victim (or an automount daemon acting for a logged-in user) to mount the attacker\u0027s crafted btrfs images, twice in sequence, since btrfs lacks `FS_USERNS_MOUNT` and cannot be mounted directly by an unprivileged attacker.\nS:U - The corruption and its consequences are confined to the kernel of the same system; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The stray `fput()` on a freed `struct file` in a `SLAB_TYPESAFE_BY_RCU` cache causes a live file\u0027s refcount to be dropped, yielding a reusable use-after-free object that can be leveraged for arbitrary kernel memory disclosure.\nI:H - The same reference-count underflow gives a premature-free UAF on `struct file`, a well-established primitive for heap spraying, arbitrary write, and control-flow hijack leading to privilege escalation.\nA:H - Even without full exploitation the `fput()` on freed memory corrupts the slab and reliably produces a KASAN splat, refcount BUG, or kernel panic, taking the system down."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:42:34.683Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/47a83f8df39545f3f552bb6a1b6d9c30e37621dd"
        },
        {
          "url": "https://git.kernel.org/stable/c/aec8e6bf839101784f3ef037dcdb9432c3f32343"
        }
      ],
      "title": "btrfs: fix use-after-free of block device file in __btrfs_free_extra_devids()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-50217",
    "datePublished": "2024-11-09T10:14:28.798Z",
    "dateReserved": "2024-10-21T19:36:19.972Z",
    "dateUpdated": "2026-08-05T11:42:34.683Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-50217",
      "date": "2026-09-16",
      "epss": "0.00276",
      "percentile": "0.20077"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"4.8\", \"versionEndExcluding\": \"6.11.7\", \"matchCriteriaId\": \"92BAD6E0-7814-4F5F-9840-E742D79C4A05\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"7F361E1D-580F-4A2D-A509-7615F73167A1\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.12:rc2:*:*:*:*:*:*\", \"matchCriteriaId\": \"925478D0-3E3D-4E6F-ACD5-09F28D5DF82C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.12:rc3:*:*:*:*:*:*\", \"matchCriteriaId\": \"3C95E234-D335-4B6C-96BF-E2CEBD8654ED\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.12:rc4:*:*:*:*:*:*\", \"matchCriteriaId\": \"E0F717D8-3014-4F84-8086-0124B2111379\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.12:rc5:*:*:*:*:*:*\", \"matchCriteriaId\": \"24DBE6C7-2AAE-4818-AED2-E131F153D2FA\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbtrfs: fix use-after-free of block device file in __btrfs_free_extra_devids()\\n\\nMounting btrfs from two images (which have the same one fsid and two\\ndifferent dev_uuids) in certain executing order may trigger an UAF for\\nvariable \u0027device-\u003ebdev_file\u0027 in __btrfs_free_extra_devids(). And\\nfollowing are the details:\\n\\n1. Attach image_1 to loop0, attach image_2 to loop1, and scan btrfs\\n   devices by ioctl(BTRFS_IOC_SCAN_DEV):\\n\\n             /  btrfs_device_1 \\u2192 loop0\\n   fs_device\\n             \\\\  btrfs_device_2 \\u2192 loop1\\n2. mount /dev/loop0 /mnt\\n   btrfs_open_devices\\n    btrfs_device_1-\u003ebdev_file = btrfs_get_bdev_and_sb(loop0)\\n    btrfs_device_2-\u003ebdev_file = btrfs_get_bdev_and_sb(loop1)\\n   btrfs_fill_super\\n    open_ctree\\n     fail: btrfs_close_devices // -ENOMEM\\n\\t    btrfs_close_bdev(btrfs_device_1)\\n             fput(btrfs_device_1-\u003ebdev_file)\\n\\t      // btrfs_device_1-\u003ebdev_file is freed\\n\\t    btrfs_close_bdev(btrfs_device_2)\\n             fput(btrfs_device_2-\u003ebdev_file)\\n\\n3. mount /dev/loop1 /mnt\\n   btrfs_open_devices\\n    btrfs_get_bdev_and_sb(\u0026bdev_file)\\n     // EIO, btrfs_device_1-\u003ebdev_file is not assigned,\\n     // which points to a freed memory area\\n    btrfs_device_2-\u003ebdev_file = btrfs_get_bdev_and_sb(loop1)\\n   btrfs_fill_super\\n    open_ctree\\n     btrfs_free_extra_devids\\n      if (btrfs_device_1-\u003ebdev_file)\\n       fput(btrfs_device_1-\u003ebdev_file) // UAF !\\n\\nFix it by setting \u0027device-\u003ebdev_file\u0027 as \u0027NULL\u0027 after closing the\\nbtrfs_device in btrfs_close_one_device().\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: btrfs: se corrige el use-after-free del archivo del dispositivo de bloque en __btrfs_free_extra_devids(). Montar btrfs desde dos im\\u00e1genes (que tienen el mismo fsid y dos dev_uuids diferentes) en cierto orden de ejecuci\\u00f3n puede activar un UAF para la variable \u0027device-\u0026gt;bdev_file\u0027 en __btrfs_free_extra_devids(). Y a continuaci\\u00f3n se muestran los detalles: 1. Adjunte image_1 a loop0, adjunte image_2 a loop1 y escanee los dispositivos btrfs con ioctl(BTRFS_IOC_SCAN_DEV): / btrfs_device_1 ? loop0 fs_device \\\\ btrfs_device_2 ? loop1 2. monte /dev/loop0 /mnt btrfs_open_devices btrfs_device_1-\u0026gt;bdev_file = btrfs_get_bdev_and_sb(loop0) btrfs_device_2-\u0026gt;bdev_file = btrfs_get_bdev_and_sb(loop1) btrfs_fill_super open_ctree fail: btrfs_close_devices // -ENOMEM btrfs_close_bdev(btrfs_device_1) fput(btrfs_device_1-\u0026gt;bdev_file) // btrfs_device_1-\u0026gt;bdev_file se libera btrfs_close_bdev(btrfs_device_2) fput(btrfs_device_2-\u0026gt;bdev_file) 3. mount /dev/loop1 /mnt btrfs_open_devices btrfs_get_bdev_and_sb(\u0026amp;bdev_file) // EIO, btrfs_device_1-\u0026gt;bdev_file no est\\u00e1 asignado, // lo que apunta a un \\u00e1rea de memoria liberada btrfs_device_2-\u0026gt;bdev_file = btrfs_get_bdev_and_sb(loop1) btrfs_fill_super open_ctree btrfs_free_extra_devids if (btrfs_device_1-\u0026gt;bdev_file) fput(btrfs_device_1-\u0026gt;bdev_file) // UAF! Arr\\u00e9glelo configurando \u0027device-\u0026gt;bdev_file\u0027 como \u0027NULL\u0027 despu\\u00e9s de cerrar btrfs_device en btrfs_close_one_device().\"}]",
      "id": "CVE-2024-50217",
      "lastModified": "2024-12-11T15:15:13.550",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 5.9}, {\"source\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 5.9}]}",
      "published": "2024-11-09T11:15:07.103",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/47a83f8df39545f3f552bb6a1b6d9c30e37621dd\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/aec8e6bf839101784f3ef037dcdb9432c3f32343\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-416\"}]}, {\"source\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-416\"}]}]"
    },
    "microsoft_vex": {
      "current_release_date": "2026-06-28T01:56:06.000Z",
      "cve": "CVE-2024-50217",
      "id": "msrc_CVE-2024-50217",
      "initial_release_date": "2024-11-02T00:00:00.000Z",
      "product_status:known_affected": "19",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "btrfs: fix use-after-free of block device file in __btrfs_free_extra_devids()",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-50217.json",
      "version": "16"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-50217\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-11-09T11:15:07.103\",\"lastModified\":\"2026-08-04T11:21:33.953\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbtrfs: fix use-after-free of block device file in __btrfs_free_extra_devids()\\n\\nMounting btrfs from two images (which have the same one fsid and two\\ndifferent dev_uuids) in certain executing order may trigger an UAF for\\nvariable \u0027device-\u003ebdev_file\u0027 in __btrfs_free_extra_devids(). And\\nfollowing are the details:\\n\\n1. Attach image_1 to loop0, attach image_2 to loop1, and scan btrfs\\n   devices by ioctl(BTRFS_IOC_SCAN_DEV):\\n\\n             /  btrfs_device_1 \u2192 loop0\\n   fs_device\\n             \\\\  btrfs_device_2 \u2192 loop1\\n2. mount /dev/loop0 /mnt\\n   btrfs_open_devices\\n    btrfs_device_1-\u003ebdev_file = btrfs_get_bdev_and_sb(loop0)\\n    btrfs_device_2-\u003ebdev_file = btrfs_get_bdev_and_sb(loop1)\\n   btrfs_fill_super\\n    open_ctree\\n     fail: btrfs_close_devices // -ENOMEM\\n\\t    btrfs_close_bdev(btrfs_device_1)\\n             fput(btrfs_device_1-\u003ebdev_file)\\n\\t      // btrfs_device_1-\u003ebdev_file is freed\\n\\t    btrfs_close_bdev(btrfs_device_2)\\n             fput(btrfs_device_2-\u003ebdev_file)\\n\\n3. mount /dev/loop1 /mnt\\n   btrfs_open_devices\\n    btrfs_get_bdev_and_sb(\u0026bdev_file)\\n     // EIO, btrfs_device_1-\u003ebdev_file is not assigned,\\n     // which points to a freed memory area\\n    btrfs_device_2-\u003ebdev_file = btrfs_get_bdev_and_sb(loop1)\\n   btrfs_fill_super\\n    open_ctree\\n     btrfs_free_extra_devids\\n      if (btrfs_device_1-\u003ebdev_file)\\n       fput(btrfs_device_1-\u003ebdev_file) // UAF !\\n\\nFix it by setting \u0027device-\u003ebdev_file\u0027 as \u0027NULL\u0027 after closing the\\nbtrfs_device in btrfs_close_one_device().\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: btrfs: se corrige el use-after-free del archivo del dispositivo de bloque en __btrfs_free_extra_devids(). Montar btrfs desde dos im\u00e1genes (que tienen el mismo fsid y dos dev_uuids diferentes) en cierto orden de ejecuci\u00f3n puede activar un UAF para la variable \u0027device-\u0026gt;bdev_file\u0027 en __btrfs_free_extra_devids(). Y a continuaci\u00f3n se muestran los detalles: 1. Adjunte image_1 a loop0, adjunte image_2 a loop1 y escanee los dispositivos btrfs con ioctl(BTRFS_IOC_SCAN_DEV): / btrfs_device_1 ? loop0 fs_device \\\\ btrfs_device_2 ? loop1 2. monte /dev/loop0 /mnt btrfs_open_devices btrfs_device_1-\u0026gt;bdev_file = btrfs_get_bdev_and_sb(loop0) btrfs_device_2-\u0026gt;bdev_file = btrfs_get_bdev_and_sb(loop1) btrfs_fill_super open_ctree fail: btrfs_close_devices // -ENOMEM btrfs_close_bdev(btrfs_device_1) fput(btrfs_device_1-\u0026gt;bdev_file) // btrfs_device_1-\u0026gt;bdev_file se libera btrfs_close_bdev(btrfs_device_2) fput(btrfs_device_2-\u0026gt;bdev_file) 3. mount /dev/loop1 /mnt btrfs_open_devices btrfs_get_bdev_and_sb(\u0026amp;bdev_file) // EIO, btrfs_device_1-\u0026gt;bdev_file no est\u00e1 asignado, // lo que apunta a un \u00e1rea de memoria liberada btrfs_device_2-\u0026gt;bdev_file = btrfs_get_bdev_and_sb(loop1) btrfs_fill_super open_ctree btrfs_free_extra_devids if (btrfs_device_1-\u0026gt;bdev_file) fput(btrfs_device_1-\u0026gt;bdev_file) // UAF! Arr\u00e9glelo configurando \u0027device-\u0026gt;bdev_file\u0027 como \u0027NULL\u0027 despu\u00e9s de cerrar btrfs_device en btrfs_close_one_device().\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/btrfs/volumes.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"142388194191a3edc9ba01cfcfd8b691e0971fb2\",\"lessThan\":\"47a83f8df39545f3f552bb6a1b6d9c30e37621dd\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"142388194191a3edc9ba01cfcfd8b691e0971fb2\",\"lessThan\":\"aec8e6bf839101784f3ef037dcdb9432c3f32343\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/btrfs/volumes.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.8\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.8\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.11.7\",\"lessThanOrEqual\":\"6.11.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-12-11T14:25:44.077787Z\",\"id\":\"CVE-2024-50217\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.8\",\"versionEndExcluding\":\"6.11.7\",\"matchCriteriaId\":\"92BAD6E0-7814-4F5F-9840-E742D79C4A05\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"7F361E1D-580F-4A2D-A509-7615F73167A1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"925478D0-3E3D-4E6F-ACD5-09F28D5DF82C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"3C95E234-D335-4B6C-96BF-E2CEBD8654ED\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"E0F717D8-3014-4F84-8086-0124B2111379\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"24DBE6C7-2AAE-4818-AED2-E131F153D2FA\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/47a83f8df39545f3f552bb6a1b6d9c30e37621dd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/aec8e6bf839101784f3ef037dcdb9432c3f32343\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2025/04/10/4\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.openwall.com/lists/oss-security/2025/04/10/5\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.openwall.com/lists/oss-security/2025/04/10/6\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-14T12:24:12+00:00",
      "cve": "CVE-2024-50217",
      "id": "CVE-2024-50217",
      "initial_release_date": "2024-11-09T00:00:00+00:00",
      "product_status:known_affected": "42",
      "product_status:known_not_affected": "156",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: btrfs: fix use-after-free of block device file in __btrfs_free_extra_devids()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-50217.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-29T01:42:42Z",
      "cve": "CVE-2024-50217",
      "id": "CVE-2024-50217",
      "initial_release_date": "2025-09-22T23:32:33Z",
      "product_status:known_not_affected": "607",
      "product_status:recommended": "6",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-50217",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-50217.json",
      "version": "13"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"http://www.openwall.com/lists/oss-security/2025/04/10/4\"}, {\"url\": \"http://www.openwall.com/lists/oss-security/2025/04/10/5\"}, {\"url\": \"http://www.openwall.com/lists/oss-security/2025/04/10/6\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-04-11T00:11:26.593Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.8, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-50217\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-12-11T14:25:44.077787Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-416\", \"description\": \"CWE-416 Use After Free\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-12-11T14:25:45.668Z\"}}], \"cna\": {\"title\": \"btrfs: fix use-after-free of block device file in __btrfs_free_extra_devids()\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The vulnerability is reached only through local block-device operations \\u2014 `mount(2)` of a btrfs volume plus device registration via `BTRFS_IOC_SCAN_DEV`/`device=` \\u2014 on a locally attached device or loop-mounted image. No network or remote-peer data is involved.\\nAC:L - The attacker fully controls both filesystem images and the order of the two mounts; the first mount\u0027s `open_ctree()` failure can be forced deterministically by corrupting the superblock/chunk tree rather than relying on the ENOMEM fault injection in the report, and no race must be won. Heap grooming of the `filp` slab between the two mounts is entirely under attacker control.\\nPR:N - The attacker supplies only the malicious images (USB stick, disk image file, or loop-backed file) and needs no account or privilege on the target system; the privileged mount is performed by the victim or by an automounter such as udisks2 on the attacker\u0027s behalf.\\nUI:R - Exploitation requires the victim (or an automount daemon acting for a logged-in user) to mount the attacker\u0027s crafted btrfs images, twice in sequence, since btrfs lacks `FS_USERNS_MOUNT` and cannot be mounted directly by an unprivileged attacker.\\nS:U - The corruption and its consequences are confined to the kernel of the same system; no VM, IOMMU, or sandbox boundary is crossed.\\nC:H - The stray `fput()` on a freed `struct file` in a `SLAB_TYPESAFE_BY_RCU` cache causes a live file\u0027s refcount to be dropped, yielding a reusable use-after-free object that can be leveraged for arbitrary kernel memory disclosure.\\nI:H - The same reference-count underflow gives a premature-free UAF on `struct file`, a well-established primitive for heap spraying, arbitrary write, and control-flow hijack leading to privilege escalation.\\nA:H - Even without full exploitation the `fput()` on freed memory corrupts the slab and reliably produces a KASAN splat, refcount BUG, or kernel panic, taking the system down.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"142388194191a3edc9ba01cfcfd8b691e0971fb2\", \"lessThan\": \"47a83f8df39545f3f552bb6a1b6d9c30e37621dd\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"142388194191a3edc9ba01cfcfd8b691e0971fb2\", \"lessThan\": \"aec8e6bf839101784f3ef037dcdb9432c3f32343\", \"versionType\": \"git\"}], \"programFiles\": [\"fs/btrfs/volumes.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.8\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"4.8\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.11.7\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.11.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"fs/btrfs/volumes.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/47a83f8df39545f3f552bb6a1b6d9c30e37621dd\"}, {\"url\": \"https://git.kernel.org/stable/c/aec8e6bf839101784f3ef037dcdb9432c3f32343\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbtrfs: fix use-after-free of block device file in __btrfs_free_extra_devids()\\n\\nMounting btrfs from two images (which have the same one fsid and two\\ndifferent dev_uuids) in certain executing order may trigger an UAF for\\nvariable \u0027device-\u003ebdev_file\u0027 in __btrfs_free_extra_devids(). And\\nfollowing are the details:\\n\\n1. Attach image_1 to loop0, attach image_2 to loop1, and scan btrfs\\n   devices by ioctl(BTRFS_IOC_SCAN_DEV):\\n\\n             /  btrfs_device_1 \\u2192 loop0\\n   fs_device\\n             \\\\  btrfs_device_2 \\u2192 loop1\\n2. mount /dev/loop0 /mnt\\n   btrfs_open_devices\\n    btrfs_device_1-\u003ebdev_file = btrfs_get_bdev_and_sb(loop0)\\n    btrfs_device_2-\u003ebdev_file = btrfs_get_bdev_and_sb(loop1)\\n   btrfs_fill_super\\n    open_ctree\\n     fail: btrfs_close_devices // -ENOMEM\\n\\t    btrfs_close_bdev(btrfs_device_1)\\n             fput(btrfs_device_1-\u003ebdev_file)\\n\\t      // btrfs_device_1-\u003ebdev_file is freed\\n\\t    btrfs_close_bdev(btrfs_device_2)\\n             fput(btrfs_device_2-\u003ebdev_file)\\n\\n3. mount /dev/loop1 /mnt\\n   btrfs_open_devices\\n    btrfs_get_bdev_and_sb(\u0026bdev_file)\\n     // EIO, btrfs_device_1-\u003ebdev_file is not assigned,\\n     // which points to a freed memory area\\n    btrfs_device_2-\u003ebdev_file = btrfs_get_bdev_and_sb(loop1)\\n   btrfs_fill_super\\n    open_ctree\\n     btrfs_free_extra_devids\\n      if (btrfs_device_1-\u003ebdev_file)\\n       fput(btrfs_device_1-\u003ebdev_file) // UAF !\\n\\nFix it by setting \u0027device-\u003ebdev_file\u0027 as \u0027NULL\u0027 after closing the\\nbtrfs_device in btrfs_close_one_device().\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11.7\", \"versionStartIncluding\": \"4.8\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12\", \"versionStartIncluding\": \"4.8\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:42:34.683Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-50217\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:42:34.683Z\", \"dateReserved\": \"2024-10-21T19:36:19.972Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-11-09T10:14:28.798Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.