Security readout for executives and security teams
Plain-English summary
A malformed or corrupted Btrfs filesystem can bypass an important metadata check and cause the Linux kernel to access memory outside the expected buffer. Successful triggering could crash a system or potentially affect confidentiality and integrity. The strongest exposure is on systems that mount untrusted, removable, or externally supplied Btrfs filesystems.
Executive priority
Treat this as a high-priority kernel update where Btrfs and untrusted filesystem mounting intersect. Patch through normal emergency maintenance controls, prioritizing multi-user, hosting, forensic, backup, and image-processing systems. Systems without Btrfs exposure are lower priority, but their status should be verified rather than assumed.
Technical view
Btrfs leaf validation previously depended on the WRITTEN header flag. Clearing that flag on corrupted or crafted metadata could skip extended item-pointer checks and cause out-of-bounds kernel memory access during filesystem mounting or reading. The referenced correction validates WRITTEN state and ensures leaf items are always checked.
Likely exposure
Exposure is limited to Linux systems running an affected kernel with Btrfs available, particularly those mounting untrusted disk images or media. The supplied CVSS rates exploitation as local, low complexity, low privilege, and requiring no user interaction. The bundle’s version data is ambiguous, so distribution-specific status should be verified.
Exploitation context
The report demonstrates the flaw using a crafted filesystem image and records KASAN-detected out-of-bounds access during mounting. CISA KEV status is false, and no supplied source establishes active exploitation. The demonstrated result is a kernel protection fault; broader confidentiality, integrity, and availability impacts are reflected in the supplied CVSS assessment.
Researcher notes
The root issue is a validation gap caused by relying on the WRITTEN metadata flag before performing extended leaf checks. The supplied reproduction altered that bit and placed a directory item near an extent-buffer boundary. Exact vulnerable and fixed release ranges are not reliably expressed in the bundle; use distribution advisories or commit ancestry.
Mitigation direction
- Install a vendor kernel update containing the referenced Btrfs correction.
- Reboot affected systems into the updated kernel after installation.
- Restrict untrusted users from mounting Btrfs filesystems or supplied disk images until patched.
- Prioritize shared hosts, appliances, and analysis systems that routinely process external storage images.
Validation and detection
- Inventory running kernel versions and compare them with distribution advisories and referenced stable fixes.
- Identify systems using Btrfs or allowing users to mount Btrfs images and removable media.
- Confirm the corrected kernel is running after maintenance, not merely installed.
- Review logs for BTRFS warnings, protection faults, or out-of-bounds reports associated with mount activity.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-35949 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/9dff3e36ea89e8003516841c27c45af562b6ef44CVE reference, Linux
- https://git.kernel.org/stable/c/ef3ba8ce8cf7075b716aa4afcefc3034215878eeCVE reference, Linux
- https://git.kernel.org/stable/c/e03418abde871314e1a3a550f4c8afb7b89cb273CVE reference, Linux
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OTB4HWU2PTVW5NEYHHLOCXDKG3PYA534/CVE reference, CVE · x_transferred
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.