CVE-2024-35949: 
Linux Kernel vulnerability analysis and mitigation

A vulnerability in the Linux kernel's BTRFS filesystem has been identified as CVE-2024-35949. The issue involves improper validation of the WRITTEN flag on metadata blocks in BTRFS, which could lead to potential security risks. The vulnerability was discovered in May 2024 and affects the BTRFS filesystem implementation in the Linux kernel (Kernel Git).

The vulnerability stems from the way BTRFS handles leaf checks in relation to the WRITTEN flag on metadata blocks. Previously, btrfs_check_leaf() would only run extended leaf checks if the WRITTEN flag was set on header flags. After the removal of CONFIG_BTRFS_FS_CHECK_INTEGRITY option, there was a gap in checking that could allow corrupted blocks without the WRITTEN flag to bypass important validation steps. This could lead to accessing memory outside of the extent buffer when processing item pointers (Kernel Git).

When exploited, this vulnerability could lead to out-of-bounds memory access through the extent buffer accessors. This was demonstrated through a crafted image that manipulated the WRITTEN bit, resulting in KASAN reporting out-of-bound access and general protection faults in the system (Kernel Git).

The issue has been patched by adding checks to ensure the WRITTEN flag is set appropriately and making __btrfs_check_leaf() always perform item checking. This fix has been incorporated into various Linux distributions, including Fedora 40 with kernel version 6.8.10-300.fc40 (Fedora Update).