CVE-2024-50088

What it actually does

The vulnerability is an uninitialized pointer free in btrfs add_inode_ref(): the name struct is declared without initialization, and if either read_one_inode() call returns NULL the subsequent kfree(name.name) operates on uninitialized memory, enabling memory corruption.

Why it matters to the business

Affected Linux systems risk kernel crashes, denial of service, or potential privilege escalation; the issue appears in broad Linux kernel distributions and has been referenced in zero-day exploitation campaigns by espionage and financially motivated actors, increasing urgency for organizations relying on btrfs.

How an attack unfolds

An attacker supplies crafted filesystem operations that reach add_inode_ref() and force one of the read_one_inode() lookups to fail; execution then reaches the out label where kfree is performed on the uninitialized name.name pointer, resulting in arbitrary memory operations that can be leveraged for corruption or code execution.

How to fix it

Upgrade the Linux kernel to a fixed version such as 6.1.114 or the commit 12cf028381aa19bc38465341512c280256e8d82d; rebuild and reboot with the patched kernel; apply equivalent fixes from distribution vendors for any backported packages.

How to confirm the fix worked

Verify the running kernel version is at or above the listed fixed releases; inspect btrfs source for the initialization of the name struct before the read_one_inode calls; run static analysis tools such as Coverity on the updated code to confirm the defect is resolved.

Typical attack path

1. Trigger btrfs inode reference addition via crafted filesystem metadata or syscall sequence
2. Cause read_one_inode(root, parent_objectid) or read_one_inode(root, inode_objectid) to return NULL
3. Reach the out label and execute kfree(name.name) on the uninitialized pointer
4. Exploit resulting memory corruption for denial of service or privilege escalation

How to detect it

Review kernel logs for oops or panic messages originating from btrfs add_inode_ref or kfree on uninitialized memory; correlate with processes performing filesystem metadata operations on btrfs volumes; examine any crash dumps for references to the affected function.

What your security team should do

• Immediately identify all systems running vulnerable kernel versions and schedule patching to 6.1.114 or later
• Prioritize systems using btrfs filesystems and those exposed to untrusted filesystem images or network shares
• Monitor threat intelligence feeds for exploitation by espionage or financially motivated actors
• Test patched kernels in staging before broad deployment to avoid regressions