CVE-2023-1611: Linux Kernel btrfs Use-After-Free Flaw

CVE-2023-1611 Overview

CVE-2023-1611 is a use-after-free flaw [CWE-416] in btrfs_search_slot within fs/btrfs/ctree.c in the Btrfs filesystem of the Linux kernel. The defect arises from a race condition between the quota disable and quota assign ioctls, which can cause the kernel to access a freed quota root. A local, low-privileged attacker capable of issuing Btrfs ioctls can trigger the race to crash the system and potentially leak kernel memory contents. The flaw affects Linux kernel versions up to 6.3-rc5 and was shipped in Fedora 36 and 37 until patched.

Critical Impact
Local users can crash the kernel and potentially read sensitive kernel memory by racing Btrfs quota ioctls against a freed quota root.

Affected Products

Linux kernel up to and including 6.3-rc5
Fedora 36
Fedora 37

Discovery Timeline

2023-04-03 - CVE-2023-1611 published to NVD
2025-02-13 - Last updated in NVD database

Technical Details for CVE-2023-1611

Vulnerability Analysis

The vulnerability resides in the Btrfs quota group (qgroup) subsystem. Two ioctls, BTRFS_IOC_QUOTA_CTL (disable) and BTRFS_IOC_QGROUP_ASSIGN (assign), can execute concurrently without proper serialization. When the disable path frees the quota root, an in-flight assign path can call btrfs_search_slot against the freed root structure, producing a use-after-free read in kernel memory.

The use-after-free can result in a kernel crash (denial of service) and, depending on heap state, expose freed kernel memory contents through subsequent operations. Exploitation requires local access and the ability to invoke Btrfs ioctls on a mounted Btrfs volume.

Root Cause

The Btrfs qgroup code did not hold qgroup_ioctl_lock across the call to btrfs_run_qgroups from the assign ioctl path. The disable ioctl could therefore tear down fs_info->quota_root while the assign path was still traversing it via btrfs_search_slot, dereferencing freed memory.

Attack Vector

An unprivileged local user with permission to interact with a Btrfs filesystem invokes the quota assign ioctl while another thread invokes the quota disable ioctl. Winning the race causes btrfs_search_slot to operate on a freed quota root.

// Patch: fs/btrfs/ioctl.c - serialize btrfs_run_qgroups under qgroup_ioctl_lock
 	}
 
 	/* update qgroup status and info */
+	mutex_lock(&fs_info->qgroup_ioctl_lock);
 	err = btrfs_run_qgroups(trans);
+	mutex_unlock(&fs_info->qgroup_ioctl_lock);
 	if (err < 0)
 		btrfs_handle_fs_error(fs_info, err,
 				      "failed to update qgroup status and info");
// Source: https://github.com/torvalds/linux/commit/2f1a6be12ab6c8470d5776e68644726c94257c54

// Patch: fs/btrfs/qgroup.c - assert qgroup_ioctl_lock is held outside commit path
 /*
- * called from commit_transaction. Writes all changed qgroups to disk.
+ * Writes all changed qgroups to disk.
+ * Called by the transaction commit path and the qgroup assign ioctl.
  */
 int btrfs_run_qgroups(struct btrfs_trans_handle *trans)
 {
 	struct btrfs_fs_info *fs_info = trans->fs_info;
 	int ret = 0;
 
+	/*
+	 * In case we are called from the qgroup assign ioctl, assert that we
+	 * are holding the qgroup_ioctl_lock, otherwise we can race with a quota
+	 * disable operation (ioctl) and access a freed quota root.
+	 */
+	if (trans->transaction->state != TRANS_STATE_COMMIT_DOING)
+		lockdep_assert_held(&fs_info->qgroup_ioctl_lock);
+
 	if (!fs_info->quota_root)
 		return ret;
// Source: https://github.com/torvalds/linux/commit/2f1a6be12ab6c8470d5776e68644726c94257c54

Detection Methods for CVE-2023-1611

Indicators of Compromise

Kernel oops or panic messages referencing btrfs_search_slot or btrfs_run_qgroups in /var/log/kern.log or dmesg.
KASAN reports with use-after-free on Btrfs qgroup structures when KASAN is enabled.
Unexpected Btrfs filesystem errors after concurrent btrfs qgroup administrative commands.

Detection Strategies

Inventory installed kernel versions and flag systems running Linux kernels at or below 6.3-rc5 with Btrfs mounted.
Monitor process telemetry for non-root users invoking Btrfs ioctls or the btrfs userspace tool against quota controls.
Correlate kernel crash events with preceding BTRFS_IOC_QUOTA_CTL and BTRFS_IOC_QGROUP_ASSIGN activity.

Monitoring Recommendations

Forward kernel ring buffer and journald logs to a centralized log platform and alert on Btrfs stack traces.
Audit ioctl syscalls on Btrfs mount points using auditd rules that capture caller UID and command argument.
Track package versions of kernel across the fleet and alert on hosts still running unpatched Fedora 36/37 builds.

How to Mitigate CVE-2023-1611

Immediate Actions Required

Apply vendor kernel updates from Fedora, Debian, or your distribution that include commit 2f1a6be12ab6c8470d5776e68644726c94257c54.
Reboot affected hosts after patch installation to load the corrected kernel image.
Restrict shell and ioctl access on multi-tenant Linux systems where Btrfs is in use.

Patch Information

The upstream fix is commit 2f1a6be12ab6c8470d5776e68644726c94257c54 in torvalds/linux, which serializes btrfs_run_qgroups under fs_info->qgroup_ioctl_lock and adds a lockdep_assert_held guard. Distribution updates are tracked in the Red Hat Bug Report, the Debian LTS Announcement, and the Fedora package announcements (FEDORA-2023-5QCM6XO4HS, FEDORA-2023-ZWECAZ7V7E).

Workarounds

Disable Btrfs quotas on affected volumes using btrfs quota disable <path> when feasible.
Limit access to Btrfs filesystems so that only trusted administrators can invoke quota ioctls.
Avoid running concurrent quota administration scripts until the patched kernel is deployed.

bash

# Verify running kernel and disable Btrfs quotas as a temporary mitigation
uname -r
sudo btrfs quota disable /mnt/data
# After patching, update and reboot
sudo dnf update kernel -y && sudo reboot