CVE-2023-54185

Vulnerability

Analysis

In the Linux kernel's btrfs filesystem, the function add_new_free_space() contained multiple BUG_ON() calls that would trigger a kernel panic if adding free space to the in-memory free space cache failed. Such failures are typically due to memory allocation errors (-ENOMEM) which, while rare, could occur under memory pressure.

Exploitation

An attacker with local access and the ability to trigger memory exhaustion could potentially cause a denial-of-service (DoS) condition by forcing a BUG_ON() crash. No special privileges are required beyond the ability to manipulate btrfs operations that call this function, such as certain file operations or filesystem management actions.

Impact

The bug converts a potentially recoverable error into a system crash, leading to denial of service. By removing the BUG_ON() calls and returning errors to callers, the system can handle memory allocation failures more gracefully, allowing other parts of the kernel to manage the error without crashing the system.

Mitigation

The fix is implemented in commit [1], which changes add_new_free_space() to return errors instead of triggering BUG_ON. The commit is included in the Linux kernel stable tree, and users should apply the corresponding kernel update to mitigate the vulnerability.