CVE-2024-56759
Published: 06 January 2025
Summary
CVE-2024-56759 is a high-severity Use After Free (CWE-416) vulnerability in Linux Linux Kernel. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 4.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and CM-7 (Least Functionality).
Deeper analysis
CVE-2024-56759 is a use-after-free vulnerability in the Linux kernel's BTRFS filesystem. It occurs during copy-on-write (COW) operations on tree blocks in btrfs_cow_block() when the trace_btrfs_cow_block() tracepoint is enabled and kernel preemption is active (CONFIG_PREEMPT=y). In affected paths like btrfs_search_slot(), the code holds the last reference to the extent buffer, which btrfs_force_cow_block() releases via free_extent_buffer_stale(), scheduling deferred release through RCU. Preemption can then allow another task to free the buffer before the tracepoint accesses it, leading to the use-after-free (CWE-416). The vulnerability carries a CVSS v3.1 base score of 7.8.
A local attacker with low privileges (PR:L) can exploit this with low complexity (AC:L) and no user interaction (UI:N), achieving high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H) in an unprivileged scope (S:U). Exploitation requires conditions including BTRFS usage, enabled tracing, and preemption, potentially allowing memory corruption, denial of service, or code execution via the freed extent buffer.
Mitigation involves applying upstream patches from the Linux kernel stable repository, such as commits 44f52bbe96df (and others listed in references). The fix relocates the trace_btrfs_cow_block() call to btrfs_force_cow_block() before the extent buffer is freed, preventing the race; this also adds tracing to the tree defrag path in btrfs_realloc_node() without adverse effects. Security practitioners should update affected kernels and review tracepoint configurations in BTRFS environments.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-53402
Vulnerability details
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix use-after-free when COWing tree bock and tracing is enabled When a COWing a tree block, at btrfs_cow_block(), and we have the tracepoint trace_btrfs_cow_block() enabled and preemption is also…
more
enabled (CONFIG_PREEMPT=y), we can trigger a use-after-free in the COWed extent buffer while inside the tracepoint code. This is because in some paths that call btrfs_cow_block(), such as btrfs_search_slot(), we are holding the last reference on the extent buffer @buf so btrfs_force_cow_block() drops the last reference on the @buf extent buffer when it calls free_extent_buffer_stale(buf), which schedules the release of the extent buffer with RCU. This means that if we are on a kernel with preemption, the current task may be preempted before calling trace_btrfs_cow_block() and the extent buffer already released by the time trace_btrfs_cow_block() is called, resulting in a use-after-free. Fix this by moving the trace_btrfs_cow_block() from btrfs_cow_block() to btrfs_force_cow_block() before the COWed extent buffer is freed. This also has a side effect of invoking the tracepoint in the tree defrag code, at defrag.c:btrfs_realloc_node(), since btrfs_force_cow_block() is called there, but this is fine and it was actually missing there.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local kernel UAF in BTRFS enables direct exploitation for privilege escalation to root via memory corruption/code execution.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Timely flaw remediation directly addresses the use-after-free vulnerability by applying kernel patches that relocate the tracepoint call before freeing the extent buffer.
Least functionality restricts unnecessary tracepoints like trace_btrfs_cow_block, preventing activation of the vulnerable COW path in BTRFS.
Memory protection mechanisms such as ASLR and non-executable memory mitigate exploitation of the use-after-free in the preempted extent buffer.