CVE-2023-1611

What it actually does

Use-after-free in btrfs_search_slot allows local attacker to crash the kernel and leak kernel memory contents.

Why it matters to the business

Affected Linux systems using btrfs face denial-of-service crashes and potential exposure of sensitive kernel data, increasing operational downtime and security risk.

How an attack unfolds

A local low-privileged attacker interacts with a btrfs filesystem to trigger the use-after-free in ctree.c, resulting in kernel panic or information disclosure.

How to fix it

Upgrade the Linux kernel to include commit 2f1a6be12ab6c8470d5776e68644726c94257c54 or later.

How to confirm the fix worked

Confirm kernel build contains the listed commit hash and verify btrfs workloads no longer trigger crashes or leaks.

Typical attack path

1. Gain local low-privileged access
2. Perform btrfs operations that invoke btrfs_search_slot
3. Trigger use-after-free for crash or memory leak

How to detect it

Examine kernel logs for btrfs_search_slot or ctree.c crashes and unexpected panics on systems running vulnerable kernels.

What your security team should do

• Apply the referenced kernel commit immediately on all btrfs-using systems
• Review and restrict local access where btrfs is mounted
• Monitor kernel logs for btrfs-related panics