CyberRota Analysis
AI-GeneratedThe vulnerability in the Linux kernel affects the Btrfs file system, specifically in the handling of ROOT_REF and ROOT_BACKREF items, which can lead to out-of-bounds memory access when corrupted items are processed. This can result in excessive data being copied into fixed-size buffers, potentially causing crashes or other unintended behavior. Organizations using Linux systems with Btrfs should prioritize this issue to mitigate risks associated with data corruption and system stability.
Original NVD Description
In the Linux kernel, the following vulnerability has been resolved: btrfs: tree-checker: validate names in ROOT_REF and ROOT_BACKREF ROOT_REF and ROOT_BACKREF items contain a struct btrfs_root_ref followed by the subvolume name. Several readers assume that this layout is already valid and then use the on-disk name length directly. A corrupted item can therefore make those readers address bytes outside the item, and BTRFS_IOC_GET_SUBVOL_INFO can copy too many bytes into its fixed-size UAPI name buffer. Validate ROOT_REF and ROOT_BACKREF items in tree-checker before any reader uses them. Reject records that do not contain a non-empty name, whose name_len does not exactly describe the remaining item payload, or whose name exceeds BTRFS_NAME_LEN. For BTRFS_IOC_GET_SUBVOL_INFO, copy only the validated on-disk name_len instead of deriving the copy length from the item size. The ioctl result is zeroed when allocated. That leaves the existing trailing zero byte untouched.