CVE-2023-3111

What it actually does

Use-after-free in prepare_to_relocate within the Btrfs relocation code, triggered when btrfs_ioctl_balance is called before btrfs_ioctl_defrag, resulting in memory corruption that can lead to local privilege escalation.

Why it matters to the business

Enables local attackers to gain elevated privileges on Linux systems using Btrfs, potentially leading to full system compromise; the issue is over three years old with low exploit probability and no known in-the-wild campaigns.

How an attack unfolds

A local attacker invokes btrfs_ioctl_balance followed by btrfs_ioctl_defrag on a Btrfs volume to trigger the use-after-free in prepare_to_relocate, then leverages the resulting memory corruption for privilege escalation, consistent with patterns seen in other recent Linux kernel privilege-escalation flaws.

How to fix it

Upgrade the Linux kernel to a version containing commit cd01d6ce01bc4d0b181c751258649bee66de9c56; apply the fix to all Btrfs-enabled systems and rebuild any custom kernels.

How to confirm the fix worked

Confirm the running kernel includes commit cd01d6ce01bc4d0b181c751258649bee66de9c56; reproduce the balance-then-defrag ioctl sequence in a test environment and verify absence of use-after-free conditions.

Typical attack path

1. Obtain local shell access on a Linux system using Btrfs
2. Locate or create a Btrfs filesystem
3. Invoke btrfs_ioctl_balance()
4. Immediately invoke btrfs_ioctl_defrag()
5. Exploit the resulting use-after-free for code execution and privilege escalation

How to detect it

Review kernel audit logs and dmesg for sequences involving balance and defrag ioctls on Btrfs volumes; watch for unexpected crashes or memory corruption warnings in relocation code paths.

What your security team should do

• Apply the kernel fix containing commit cd01d6ce01bc4d0b181c751258649bee66de9c56 to all Btrfs systems immediately
• Restrict untrusted local user access on Btrfs hosts until patched
• Monitor kernel update channels for Btrfs-related fixes
• Audit systems for custom or outdated kernels