CVE-2024-50087

What it actually does

Uninitialized pointer in fscrypt_str.name after kmalloc failure in read_alloc_one_name() leads to use-after-free when the struct is later freed.

Why it matters to the business

Linux systems using btrfs may experience kernel crashes, memory corruption, or local privilege escalation, increasing downtime and security risk for servers and desktops relying on this filesystem.

How an attack unfolds

An attacker crafts input that forces read_alloc_one_name() to take the kmalloc error path, leaving the name pointer uninitialized; subsequent free operation then dereferences attacker-controlled or invalid memory, enabling code execution or denial of service.

How to fix it

Upgrade Linux kernel to version 6.1.114 or later, or apply commit b37de9491f140a0ff125c27dd1050185c3accbc1; for Ubuntu 16.04 heat packages update to 1:6.0.0~b1-0ubuntu1 or newer.

How to confirm the fix worked

Verify running kernel version is at or above the fixed release; inspect btrfs source for the corrected read_alloc_one_name() initialization logic; run regression tests exercising name allocation error paths.

Typical attack path

1. Trigger btrfs directory or file operations that invoke read_alloc_one_name()
2. Force allocation failure via memory pressure or crafted filenames
3. Cause the error path to skip initialization of fscrypt_str.name
4. Trigger the subsequent free of the uninitialized pointer
5. Leverage resulting use-after-free for memory corruption or control-flow hijack

How to detect it

Examine kernel logs for oops/panic messages referencing btrfs, fscrypt_str, or read_alloc_one_name; search audit or system logs for unusual memory allocation failures followed by btrfs operations.

What your security team should do

• Apply kernel updates to fixed versions immediately on all btrfs deployments
• Monitor for kernel oops or panic logs related to btrfs name handling
• Restrict untrusted local access until patches are deployed
• Review downstream package dependencies for delayed updates