CVE-2024-35935

What it actually does

Improper handling of path buffer construction failure in btrfs send's iterate_inode_ref() could lead to kernel address disclosure via BUG_ON behavior instead of graceful error return.

Why it matters to the business

Low-severity local information disclosure on Linux systems using btrfs; minimal operational disruption but requires kernel updates on affected distributions to eliminate any address leak risk.

How an attack unfolds

A local attacker with access to a btrfs filesystem invokes the send operation under conditions that trigger path ref underflow during inode reference iteration, potentially causing the kernel to surface address information through the original BUG_ON path.

How to fix it

Update the Linux kernel to a version containing commit be2b6bcc936ae17f42fff6494106a5660b35d8d3 or later; rebuild and reboot with the patched kernel; avoid use of btrfs send until updated if the workload permits.

How to confirm the fix worked

Verify the running kernel contains commit be2b6bcc936ae17f42fff6494106a5660b35d8d3 via git log or uname; confirm absence of BUG_ON in the iterate_inode_ref function in the btrfs send code.

Typical attack path

1. Obtain local user access on a btrfs-enabled Linux system
2. Mount or access a btrfs volume
3. Trigger btrfs send with crafted inode references that cause path buffer underflow
4. Observe any kernel output or side effects that may expose addresses

How to detect it

Review kernel logs for btrfs send related BUG_ON entries or unexpected address references; examine audit logs for invocations of btrfs send by non-administrative users.

What your security team should do

• Apply the referenced kernel commit or distribution backport immediately on systems using btrfs
• Audit btrfs send usage and restrict to trusted local users
• Monitor kernel changelogs for related btrfs fixes