CVE-2023-54023

Vulnerability

A race condition exists in the Linux kernel's btrfs filesystem when balance operations are run concurrently with cancel or pause requests. The issue arises from flawed error handling in the balance completion path: when a balance operation finishes successfully (returns 0) but a concurrent pause or cancel request is pending, the cleanup logic is not executed correctly. This leaves the filesystem in an inconsistent state, specifically, the exclusive operation flag is not properly cleared or set to the paused state, leading to a subsequent assertion failure when another balance is attempted [1].

##

An attacker with local access and the ability to trigger btrfs ioctl calls (e.g., via unprivileged user namespaces or as a regular user with appropriate permissions) can exploit this race condition. The attack requires running a balance operation and simultaneously sending a cancel or pause ioctl. The race window is small but reproducible, as demonstrated by syzbot's reproducer [1]. No special privileges beyond those needed to invoke the relevant ioctls are required.

##

The impact is a kernel panic (BUG_ON) triggered by the assertion failure, resulting in a denial of service (DoS) for the entire system. The panic manifests as a crash with the message "assertion failed: fs_info->exclusive_operation == BTRANSACTION == BTRFS_EXCLOP_BALANCE_PAUSED" and a subsequent kernel BUG at fs/btrfs/messages.c:259 [1]. This can be used to crash a targeted system, disrupting availability.

##

The vulnerability is fixed in

Linux kernel commits b19c98f237cd and ddf7e8984c83, which correct the error handling to always perform cleanup regardless of the return value unless the operation was explicitly cancelled and the pause flag was set [1]. Users should apply the latest stable kernel updates to mitigate this issue.