CVE-2024-56774

What it actually does

Null pointer dereference in btrfs_search_slot() when the extent tree root is NULL due to corruption combined with the rescue=ibadroots mount option, triggered during scrub operations that attempt to search the extent tree.

Why it matters to the business

Systems using the btrfs file system may experience unexpected crashes or denial of service when administrators attempt recovery on corrupted file system metadata, potentially disrupting operations and requiring manual intervention or data recovery.

How an attack unfolds

An attacker with local access mounts a btrfs volume using the rescue=ibadroots option on a file system with a deliberately corrupted extent tree root, then triggers scrub or other operations that call btrfs_search_slot() without validating the root pointer, causing a kernel null pointer dereference and system crash.

How to fix it

Update to a kernel version containing the sanity check for the btrfs root pointer in btrfs_search_slot(). Reboot after applying the update and avoid using rescue=ibadroots on potentially corrupted volumes until patched.

How to confirm the fix worked

Confirm the installed kernel includes the added NULL root check in btrfs_search_slot(); attempt to reproduce the syzbot scenario on a test system with rescue=ibadroots and verify no dereference occurs.

Typical attack path

1. Obtain local access to a system using btrfs.
2. Prepare or corrupt an extent tree root in the btrfs volume.
3. Mount the volume with the rescue=ibadroots option.
4. Invoke scrub or metadata search operations that reach btrfs_search_slot().
5. Trigger null pointer dereference leading to kernel panic.

How to detect it

Review kernel logs for null pointer dereference oops traces mentioning btrfs_search_slot or extent tree operations during scrub; inspect dmesg and syslog for mount attempts with rescue=ibadroots followed by crashes.

What your security team should do

• Apply the btrfs root sanity check patch immediately on all affected systems.
• Audit btrfs volumes for corruption indicators before using rescue mount options.
• Monitor for kernel oops or panic logs involving btrfs_search_slot after any recovery attempts.