Cloudanix VulnDB

CVE-2021-47508

None

CVSS

—

EPSS

0.2%

Published

May 24, 2024

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in the Linux kernel's btrfs storage code can slowly leak memory during certain file operations, eventually causing slowdowns or crashes if left unpatched.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Theoretical
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Memory leak of extent_changeset allocations in btrfs direct IO write and defrag paths when btrfs_check_data_free_space or btrfs_delalloc_reserve_space fail after the 65b3c08606e5 commit.

Why it matters to the business

Repeated file writes or defragmentation on btrfs filesystems gradually exhaust kernel memory, leading to performance degradation, out-of-memory kills of processes, or system instability over time.

How an attack unfolds

An attacker or workload repeatedly triggers direct IO writes or defrag operations into NOCOW ranges that cause reservation failures; each failure leaks an extent_changeset object that is never freed, allowing gradual memory exhaustion without authentication or special privileges beyond write access.

How to fix it

Upgrade to a Linux kernel containing the fix that adds extent_changeset_free calls in btrfs_check_data_free_space and btrfs_delalloc_reserve_space on error paths; apply the patch referenced in the commit if backporting is required.

How to confirm the fix worked

Run kmemleak or slabinfo monitoring during direct IO write and defrag workloads that previously triggered leaks; confirm no unreferenced extent_changeset objects accumulate after applying the fix.

Typical attack path

  1. Obtain write access to a btrfs filesystem
  2. Issue repeated direct IO writes or defrag operations targeting ranges that trigger reservation failure paths
  3. Each failed reservation leaks an unreferenced extent_changeset object
  4. Kernel memory usage grows until OOM conditions occur

How to detect it

Enable kmemleak and inspect for unreferenced extent_changeset objects during btrfs direct IO or defrag activity; review dmesg and slabinfo for growing allocations tied to ulist_add_merge and qgroup_reserve_data call paths.

What your security team should do

  • Prioritize kernel upgrade on systems using btrfs with direct IO or defrag workloads
  • Monitor kernel memory usage and kmemleak reports for extent_changeset leaks
  • Restrict untrusted direct IO access until patched

The record

In the Linux kernel, the following vulnerability has been resolved: btrfs: free exchange changeset on failures Fstests runs on my VMs have show several kmemleak reports like the following. unreferenced object 0xffff88811ae59080 (size 64): comm "xfs_io", pid 12124, jiffies 4294987392 (age 6.368s) hex dump (first 32 bytes): 00 c0 1c 00 00 00 00 00 ff cf 1c 00 00 00 00 00 ................ 90 97 e5 1a 81 88 ff ff 90 97 e5 1a 81 88 ff ff ................ backtrace: [<00000000ac0176d2>] ulist_add_merge+0x60/0x150 [btrfs] [<0000000076e9f312>] set_state_bits+0x86/0xc0 [btrfs] [<0000000014fe73d6>] set_extent_bit+0x270/0x690 [btrfs] [<000000004f675208>] set_record_extent_bits+0x19/0x20 [btrfs] [<00000000b96137b1>] qgroup_reserve_data+0x274/0x310 [btrfs] [<0000000057e9dcbb>] btrfs_check_data_free_space+0x5c/0xa0 [btrfs] [<0000000019c4511d>] btrfs_delalloc_reserve_space+0x1b/0xa0 [btrfs] [<000000006d37e007>] btrfs_dio_iomap_begin+0x415/0x970 [btrfs] [<00000000fb8a74b8>] iomap_iter+0x161/0x1e0 [<0000000071dff6ff>] __iomap_dio_rw+0x1df/0x700 [<000000002567ba53>] iomap_dio_rw+0x5/0x20 [<0000000072e555f8>] btrfs_file_write_iter+0x290/0x530 [btrfs] [<000000005eb3d845>] new_sync_write+0x106/0x180 [<000000003fb505bf>] vfs_write+0x24d/0x2f0 [<000000009bb57d37>] __x64_sys_pwrite64+0x69/0xa0 [<000000003eba3fdf>] do_syscall_64+0x43/0x90 In case brtfs_qgroup_reserve_data() or btrfs_delalloc_reserve_metadata() fail the allocated extent_changeset will not be freed. So in btrfs_check_data_free_space() and btrfs_delalloc_reserve_space() free the allocated extent_changeset to get rid of the allocated memory. The issue currently only happens in the direct IO write path, but only after 65b3c08606e5 ("btrfs: fix ENOSPC failure when attempting direct IO write into NOCOW range"), and also at defrag_one_locked_target(). Every other place is always calling extent_changeset_free() even if its call to btrfs_delalloc_reserve_space() or btrfs_check_data_free_space() has failed.

Affected packages

Ecosystem Package Introduced Fixed
Debian:11 linux 0 No fix
Debian:12 linux 0 5.15.15-1
Debian:13 linux 0 5.15.15-1
SUSE:Linux Enterprise High Availability Extension 15 SP5 kernel-default 0 5.14.21-150500.55.68.1
SUSE:Linux Enterprise Live Patching 15 SP5 kernel-default 0 5.14.21-150500.55.68.1
SUSE:Linux Enterprise Live Patching 15 SP5 kernel-livepatch-SLE15-SP5-RT_Update_16 0 1-150500.11.3.1
SUSE:Linux Enterprise Live Patching 15 SP5 kernel-livepatch-SLE15-SP5_Update_15 0 1-150500.11.3.1
SUSE:Linux Enterprise Micro 5.5 kernel-default 0 5.14.21-150500.55.68.1
SUSE:Linux Enterprise Micro 5.5 kernel-default-base 0 5.14.21-150500.55.68.1.150500.6.31.1
SUSE:Linux Enterprise Micro 5.5 kernel-rt 0 5.14.21-150500.13.58.1
SUSE:Linux Enterprise Micro 5.5 kernel-source-rt 0 5.14.21-150500.13.58.1
SUSE:Linux Enterprise Module for Basesystem 15 SP5 kernel-64kb 0 5.14.21-150500.55.68.1
SUSE:Linux Enterprise Module for Basesystem 15 SP5 kernel-default 0 5.14.21-150500.55.68.1
SUSE:Linux Enterprise Module for Basesystem 15 SP5 kernel-default-base 0 5.14.21-150500.55.68.1.150500.6.31.1
SUSE:Linux Enterprise Module for Basesystem 15 SP5 kernel-source 0 5.14.21-150500.55.68.1
SUSE:Linux Enterprise Module for Basesystem 15 SP5 kernel-zfcpdump 0 5.14.21-150500.55.68.1
SUSE:Linux Enterprise Module for Development Tools 15 SP5 kernel-docs 0 5.14.21-150500.55.68.1
SUSE:Linux Enterprise Module for Development Tools 15 SP5 kernel-obs-build 0 5.14.21-150500.55.68.1
SUSE:Linux Enterprise Module for Development Tools 15 SP5 kernel-source 0 5.14.21-150500.55.68.1
SUSE:Linux Enterprise Module for Development Tools 15 SP5 kernel-syms 0 5.14.21-150500.55.68.1
SUSE:Linux Enterprise Module for Legacy 15 SP5 kernel-default 0 5.14.21-150500.55.68.1
SUSE:Linux Enterprise Module for Public Cloud 15 SP5 kernel-azure 0 5.14.21-150500.33.57.1
SUSE:Linux Enterprise Module for Public Cloud 15 SP5 kernel-source-azure 0 5.14.21-150500.33.57.1
SUSE:Linux Enterprise Module for Public Cloud 15 SP5 kernel-syms-azure 0 5.14.21-150500.33.57.1
SUSE:Linux Enterprise Workstation Extension 15 SP5 kernel-default 0 5.14.21-150500.55.68.1
SUSE:Real Time Module 15 SP5 kernel-rt 0 5.14.21-150500.13.58.1
SUSE:Real Time Module 15 SP5 kernel-rt_debug 0 5.14.21-150500.13.58.1
SUSE:Real Time Module 15 SP5 kernel-source-rt 0 5.14.21-150500.13.58.1
SUSE:Real Time Module 15 SP5 kernel-syms-rt 0 5.14.21-150500.13.58.1
Ubuntu:16.04:LTS linux-hwe-edge 0 No fix
Ubuntu:18.04:LTS linux-aws-5.0 0 No fix
Ubuntu:18.04:LTS linux-aws-5.3 0 No fix
Ubuntu:18.04:LTS linux-azure 0 No fix
Ubuntu:18.04:LTS linux-azure-5.3 0 No fix
Ubuntu:18.04:LTS linux-azure-edge 0 No fix
Ubuntu:18.04:LTS linux-gcp 0 No fix
Ubuntu:18.04:LTS linux-gcp-5.3 0 No fix
Ubuntu:18.04:LTS linux-gke-4.15 0 No fix
Ubuntu:18.04:LTS linux-gke-5.4 0 No fix
Ubuntu:18.04:LTS linux-gkeop-5.4 0 No fix
Ubuntu:18.04:LTS linux-hwe 0 No fix
Ubuntu:18.04:LTS linux-hwe-edge 0 No fix
Ubuntu:18.04:LTS linux-oem 0 No fix
Ubuntu:18.04:LTS linux-oracle-5.0 0 No fix
Ubuntu:18.04:LTS linux-oracle-5.3 0 No fix
Ubuntu:20.04:LTS linux 0 No fix
Ubuntu:20.04:LTS linux-aws 0 No fix
Ubuntu:20.04:LTS linux-aws-5.11 0 No fix
Ubuntu:20.04:LTS linux-aws-5.13 0 No fix
Ubuntu:20.04:LTS linux-aws-5.15 0 5.15.0-1014.18~20.04.1
Ubuntu:20.04:LTS linux-aws-5.8 0 No fix
Ubuntu:20.04:LTS linux-azure 0 No fix
Ubuntu:20.04:LTS linux-azure-5.11 0 No fix
Ubuntu:20.04:LTS linux-azure-5.13 0 No fix
Ubuntu:20.04:LTS linux-azure-5.15 0 5.15.0-1007.8~20.04.1
Ubuntu:20.04:LTS linux-azure-5.8 0 No fix
Ubuntu:20.04:LTS linux-azure-fde 0 No fix
Ubuntu:20.04:LTS linux-azure-fde-5.15 0 5.15.0-1019.24~20.04.1.1
Ubuntu:20.04:LTS linux-bluefield 0 No fix
Ubuntu:20.04:LTS linux-gcp 0 No fix
Ubuntu:20.04:LTS linux-gcp-5.11 0 No fix
Ubuntu:20.04:LTS linux-gcp-5.13 0 No fix
Ubuntu:20.04:LTS linux-gcp-5.15 0 5.15.0-1006.9~20.04.1
Ubuntu:20.04:LTS linux-gcp-5.8 0 No fix
Ubuntu:20.04:LTS linux-gke 0 No fix
Ubuntu:20.04:LTS linux-gke-5.15 0 No fix
Ubuntu:20.04:LTS linux-gkeop 0 No fix
Ubuntu:20.04:LTS linux-gkeop-5.15 0 5.15.0-1003.5~20.04.2
Ubuntu:20.04:LTS linux-hwe-5.11 0 No fix
Ubuntu:20.04:LTS linux-hwe-5.13 0 No fix
Ubuntu:20.04:LTS linux-hwe-5.15 0 5.15.0-33.34~20.04.1
Ubuntu:20.04:LTS linux-hwe-5.8 0 No fix
Ubuntu:20.04:LTS linux-ibm 0 No fix
Ubuntu:20.04:LTS linux-ibm-5.15 0 5.15.0-1033.36~20.04.1
Ubuntu:20.04:LTS linux-intel-5.13 0 No fix
Ubuntu:20.04:LTS linux-intel-iotg-5.15 0 5.15.0-1003.5~20.04.1
Ubuntu:20.04:LTS linux-iot 0 No fix
Ubuntu:20.04:LTS linux-kvm 0 No fix
Ubuntu:20.04:LTS linux-lowlatency-hwe-5.15 0 5.15.0-33.34~20.04.1
Ubuntu:20.04:LTS linux-oem-5.10 0 No fix
Ubuntu:20.04:LTS linux-oem-5.13 0 No fix
Ubuntu:20.04:LTS linux-oem-5.14 0 No fix
Ubuntu:20.04:LTS linux-oem-5.6 0 No fix
Ubuntu:20.04:LTS linux-oracle 0 No fix
Ubuntu:20.04:LTS linux-oracle-5.11 0 No fix
Ubuntu:20.04:LTS linux-oracle-5.13 0 No fix
Ubuntu:20.04:LTS linux-oracle-5.15 0 5.15.0-1007.9~20.04.1
Ubuntu:20.04:LTS linux-oracle-5.8 0 No fix
Ubuntu:20.04:LTS linux-raspi 0 No fix
Ubuntu:20.04:LTS linux-raspi2 0 No fix
Ubuntu:20.04:LTS linux-riscv 0 No fix
Ubuntu:20.04:LTS linux-riscv-5.11 0 No fix
Ubuntu:20.04:LTS linux-riscv-5.15 0 5.15.0-1015.17~20.04.1
Ubuntu:20.04:LTS linux-riscv-5.8 0 No fix
Ubuntu:20.04:LTS linux-xilinx-zynqmp 0 No fix
Ubuntu:22.04:LTS linux 0 5.15.0-17.17
Ubuntu:22.04:LTS linux-allwinner-5.19 0 No fix
Ubuntu:22.04:LTS linux-aws 0 5.15.0-1002.4
Ubuntu:22.04:LTS linux-aws-5.19 0 No fix
Ubuntu:22.04:LTS linux-aws-6.2 0 No fix
Ubuntu:22.04:LTS linux-aws-6.5 0 6.5.0-1008.8~22.04.1
Ubuntu:22.04:LTS linux-aws-6.8 0 6.8.0-1009.9~22.04.2
Ubuntu:22.04:LTS linux-azure 0 5.15.0-1001.2
Ubuntu:22.04:LTS linux-azure-5.19 0 No fix
Ubuntu:22.04:LTS linux-azure-6.2 0 No fix
Ubuntu:22.04:LTS linux-azure-6.5 0 6.5.0-1007.7~22.04.1
Ubuntu:22.04:LTS linux-azure-6.8 0 6.8.0-1008.8~22.04.1
Ubuntu:22.04:LTS linux-azure-fde 0 5.15.0-1019.24.1
Ubuntu:22.04:LTS linux-azure-fde-5.19 0 No fix
Ubuntu:22.04:LTS linux-azure-fde-6.2 0 No fix
Ubuntu:22.04:LTS linux-gcp 0 5.15.0-1001.3
Ubuntu:22.04:LTS linux-gcp-5.19 0 No fix
Ubuntu:22.04:LTS linux-gcp-6.2 0 No fix
Ubuntu:22.04:LTS linux-gcp-6.5 0 6.5.0-1010.10~22.04.3
Ubuntu:22.04:LTS linux-gcp-6.8 0 6.8.0-1010.11~22.04.1
Ubuntu:22.04:LTS linux-gke 0 5.15.0-1002.2
Ubuntu:22.04:LTS linux-gkeop 0 5.15.0-1001.2
Ubuntu:22.04:LTS linux-hwe-5.19 0 No fix
Ubuntu:22.04:LTS linux-hwe-6.2 0 No fix
Ubuntu:22.04:LTS linux-hwe-6.5 0 6.5.0-14.14~22.04.1
Ubuntu:22.04:LTS linux-hwe-6.8 0 6.8.0-38.38~22.04.1
Ubuntu:22.04:LTS linux-ibm 0 5.15.0-1002.2
Ubuntu:22.04:LTS linux-intel-iot-realtime 0 No fix
Ubuntu:22.04:LTS linux-intel-iot-realtime 0 5.15.0-1021.26
Ubuntu:22.04:LTS linux-intel-iotg 0 5.15.0-1004.6
Ubuntu:22.04:LTS linux-kvm 0 5.15.0-1002.2
Ubuntu:22.04:LTS linux-lowlatency 0 5.15.0-22.22
Ubuntu:22.04:LTS linux-lowlatency-hwe-5.19 0 No fix
Ubuntu:22.04:LTS linux-lowlatency-hwe-6.2 0 No fix
Ubuntu:22.04:LTS linux-lowlatency-hwe-6.5 0 6.5.0-14.14.1~22.04.1
Ubuntu:22.04:LTS linux-lowlatency-hwe-6.8 0 6.8.0-38.38.1~22.04.2
Ubuntu:22.04:LTS linux-nvidia 0 5.15.0-1005.5
Ubuntu:22.04:LTS linux-nvidia-6.2 0 No fix
Ubuntu:22.04:LTS linux-nvidia-6.5 0 6.5.0-1004.4
Ubuntu:22.04:LTS linux-nvidia-6.8 0 6.8.0-1008.8~22.04.1
Ubuntu:22.04:LTS linux-oem-5.17 0 No fix
Ubuntu:22.04:LTS linux-oem-6.0 0 No fix
Ubuntu:22.04:LTS linux-oem-6.1 0 No fix
Ubuntu:22.04:LTS linux-oem-6.5 0 6.5.0-1003.3
Ubuntu:22.04:LTS linux-oracle 0 5.15.0-1001.3
Ubuntu:22.04:LTS linux-oracle-6.5 0 6.5.0-1013.13~22.04.4
Ubuntu:22.04:LTS linux-oracle-6.8 0 6.8.0-1006.6~22.04.3
Ubuntu:22.04:LTS linux-raspi 0 5.15.0-1002.2
Ubuntu:22.04:LTS linux-realtime 0 No fix
Ubuntu:22.04:LTS linux-riscv 0 No fix
Ubuntu:22.04:LTS linux-riscv-5.19 0 No fix
Ubuntu:22.04:LTS linux-riscv-6.5 0 6.5.0-17.17.1.1~22.04.1
Ubuntu:22.04:LTS linux-riscv-6.8 0 6.8.0-38.38.1~22.04.1
Ubuntu:22.04:LTS linux-starfive-5.19 0 No fix
Ubuntu:22.04:LTS linux-starfive-6.2 0 No fix
Ubuntu:22.04:LTS linux-starfive-6.5 0 6.5.0-1007.8~22.04.1
Ubuntu:22.04:LTS linux-xilinx-zynqmp 0 5.15.0-1022.26
Ubuntu:22.04:LTS:for:NVIDIA:BlueField linux-bluefield 0 5.15.0-1011.13
Ubuntu:24.04:LTS linux 0 6.5.0-9.9
Ubuntu:24.04:LTS linux-aws 0 6.5.0-1008.8
Ubuntu:24.04:LTS linux-azure 0 6.5.0-1007.7
Ubuntu:24.04:LTS linux-gcp 0 6.5.0-1007.7
Ubuntu:24.04:LTS linux-gke 0 6.8.0-1003.5
Ubuntu:24.04:LTS linux-gkeop 0 6.8.0-1001.3
Ubuntu:24.04:LTS linux-ibm 0 6.5.0-1009.9
Ubuntu:24.04:LTS linux-lowlatency 0 6.5.0-9.9.1
Ubuntu:24.04:LTS linux-nvidia 0 6.8.0-1007.7
Ubuntu:24.04:LTS linux-nvidia-lowlatency 0 6.8.0-1009.9.1
Ubuntu:24.04:LTS linux-oem-6.11 0 6.11.0-1007.7
Ubuntu:24.04:LTS linux-oem-6.8 0 6.8.0-1003.3
Ubuntu:24.04:LTS linux-oracle 0 6.5.0-1010.10
Ubuntu:24.04:LTS linux-raspi 0 6.5.0-1005.7
Ubuntu:24.04:LTS linux-raspi-realtime 0 No fix
Ubuntu:24.04:LTS linux-raspi-realtime 0 6.7.0-2001.1
Ubuntu:24.04:LTS linux-realtime 0 6.8.0-1008.19
Ubuntu:24.04:LTS linux-riscv 0 6.5.0-9.9.1
Ubuntu:24.10 linux 0 6.8.0-31.31
Ubuntu:24.10 linux-aws 0 6.8.0-1008.8
Ubuntu:24.10 linux-azure 0 6.8.0-1007.7
Ubuntu:24.10 linux-gcp 0 6.8.0-1007.7
Ubuntu:24.10 linux-lowlatency 0 6.8.0-31.31.1
Ubuntu:24.10 linux-oracle 0 6.8.0-1005.5
Ubuntu:24.10 linux-raspi 0 6.8.0-1004.4
Ubuntu:24.10 linux-realtime 0 6.11.0-1001.1
Ubuntu:24.10 linux-riscv 0 6.8.0-31.31.1
Ubuntu:Pro:14.04:LTS linux 0 No fix
Ubuntu:Pro:14.04:LTS linux-aws 0 No fix
Ubuntu:Pro:14.04:LTS linux-azure 0 No fix
Ubuntu:Pro:14.04:LTS linux-lts-xenial 0 No fix
Ubuntu:Pro:16.04:LTS linux 0 No fix
Ubuntu:Pro:16.04:LTS linux-aws 0 No fix
Ubuntu:Pro:16.04:LTS linux-aws-hwe 0 No fix
Ubuntu:Pro:16.04:LTS linux-azure 0 No fix
Ubuntu:Pro:16.04:LTS linux-gcp 0 No fix
Ubuntu:Pro:16.04:LTS linux-hwe 0 No fix
Ubuntu:Pro:16.04:LTS linux-hwe-edge 0 No fix
Ubuntu:Pro:16.04:LTS linux-kvm 0 No fix
Ubuntu:Pro:16.04:LTS linux-oracle 0 No fix
Ubuntu:Pro:18.04:LTS linux 0 No fix
Ubuntu:Pro:18.04:LTS linux-aws 0 No fix
Ubuntu:Pro:18.04:LTS linux-aws-5.0 0 No fix
Ubuntu:Pro:18.04:LTS linux-aws-5.3 0 No fix
Ubuntu:Pro:18.04:LTS linux-aws-5.4 0 No fix
Ubuntu:Pro:18.04:LTS linux-azure 0 No fix
Ubuntu:Pro:18.04:LTS linux-azure-4.15 0 No fix

Related vulnerabilities