CVE-2024-41067: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-41067 is a vulnerability in the Linux kernel's BTRFS file system scrub functionality. The issue was discovered when running btrfs/060 test with forced RST (RAID Stripe Tree) feature, which would cause a crash due to an ASSERT() failure inside the scrub_read_endio() function. The vulnerability was disclosed in July 2024 and affects the BTRFS subsystem in the Linux kernel (Kernel Git).

The vulnerability occurs in the scrub_submit_extent_sector_read() function where a new bbio (BTRFS bio) is allocated and btrfs_map_block() is called to verify RST range coverage. If btrfs_map_block() fails, it immediately calls endio for the empty bbio. In scrub_read_endio(), the code attempts to find the sector number through bvecs iteration, but since the bio is empty, it returns sector_nr == stripe->nr_sectors, triggering an ASSERT(sector_nr < stripe->nr_sectors) failure. Additionally, there was a race condition where if the submission thread is the only owner of pending_io, the scrub would never complete due to the pending_io counter not being decreased (Kernel Git).

The vulnerability can cause system crashes when performing BTRFS scrub operations with the RST feature enabled. This could lead to system instability and potential denial of service conditions (NVD).

The vulnerability requires local access to the system and the ability to trigger BTRFS scrub operations. It specifically manifests when using the RST (RAID Stripe Tree) feature during file system operations (Kernel Git).

The issue has been fixed by modifying the code to call btrfs_map_block() before allocating a new bbio, rather than after. This change prevents the handling of empty bbios and fixes the race condition with the pending_io counter. The fix has been implemented in the Linux kernel, and users should update to a patched version. The patch has been merged into the stable kernel tree (Kernel Git).