CVE-2024-50217

A flaw was found in the Linux kernel's btrfs filesystem. A local attacker could exploit a use-after-free (UAF) vulnerability by mounting two btrfs images with identical filesystem IDs but different device universally unique identifiers (UUIDs) in a specific sequence. This could lead to memory corruption, potentially allowing for privilege escalation or causing a system crash (denial of service).

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, if the Btrfs filesystem is not in use, the btrfs kernel module can be blacklisted to prevent it from being loaded. This can be achieved by creating a modprobe configuration file.

Create /etc/modprobe.d/blacklist-btrfs.conf with the following content: blacklist btrfs

After creating the file, regenerate the initramfs and reboot the system for the changes to take effect.

dracut -f -v reboot

Warning: Blacklisting the btrfs module will prevent the system from mounting or using any Btrfs filesystems. Ensure that no critical system components or data rely on Btrfs before applying this mitigation.