CVE-2022-48733 — btrfs: fix use-after-free after failure to create a snapshot

Affected: Linux

In the Linux kernel, the following vulnerability has been resolved:

btrfs: fix use-after-free after failure to create a snapshot

At ioctl.c:create_snapshot(), we allocate a pending snapshot structure and then attach it to the transaction's list of pending snapshots. After that we call btrfs_commit_transaction(), and if that returns an error we jump to 'fail' label, where we kfree() the pending snapshot structure. This can result in a later use-after-free of the pending snapshot:

1) We allocated the pending snapshot and added it to the transaction's list of pending snapshots;

2) We call btrfs_commit_transaction(), and it fails either at the first call to btrfs_run_delayed_refs() or btrfs_start_dirty_block_groups(). In both cases, we don't abort the transaction and we release our transaction handle. We jump to the 'fail' label and free the pending snapshot structure. We return with the pending snapshot still in the transaction's list;

3) Another task commits the transaction. This time there's no error at all, and then during the transaction commit it accesses a pointer to the pending snapshot structure that the snapshot creation task has already freed, resulting in a user-after-free.

This issue could actually be detected by smatch, which produced the following warning:

fs/btrfs/ioctl.c:843 create_snapshot() warn: '&pending_snapshot->list' not removed from list

So fix this by not having the snapshot creation ioctl directly add the pending sn…

USN-7121-1 — linux, linux-aws, linux-aws-hwe, linux-azure, linux-azure-4.15, linux-gcp, linux-gcp-4.15, linux-hwe, linux-kvm, linux-…

Affected: Ubuntu:Pro:16.04:LTS: linux-aws-hwe, Ubuntu:Pro:16.04:LTS: linux-azure, Ubuntu:Pro:16.04:LTS: linux-gcp, Ubuntu:Pro:16.04:LTS: linux-hwe, Ubuntu:Pro:18.04:LTS: linux, Ubuntu:Pro:18.04:LTS: linux-aws, Ubuntu:Pro:18.04:LTS: linux-azure-4.15, Ubuntu:Pro:18.04:LTS: linux-gcp-4.15, Ubuntu:Pro:18.04:LTS: linux-kvm, Ubuntu:Pro:18.04:LTS: linux-oracle

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM64 architecture; - S390 architecture; - x86 architecture; - Block layer subsystem; - Cryptographic API; - ATM drivers; - Device frequency scaling framework; - GPU drivers; - Hardware monitoring drivers; - VMware VMCI Driver; - Network drivers; - Device tree and open firmware driver; - SCSI drivers; - Greybus lights staging drivers; - BTRFS file system; - File systems infrastructure; - F2FS file system; - JFS file system; - NILFS2 file system; - Netfilter; - Memory management; - Ethernet bridge; - IPv6 networking; - IUCV driver; - Logical Link layer; - MAC80211 subsystem; - NFC subsystem; - Network traffic control; - Unix domain sockets; (CVE-2023-52614, CVE-2024-26633, CVE-2024-46758, CVE-2024-46723, CVE-2023-52502, CVE-2024-41059, CVE-2024-44987, CVE-2024-36020, CVE-2023-52599, CVE-2023-52639, CVE-2024-26668, CVE-2024-42094, CVE-2022-48938, CVE-2022-48733, CVE-2024-27397, CVE-2023-52578, CVE-2024-38560, CVE-2024-38538, CVE-2024-42310, CVE-2024-46722, CVE-2024-46800, CVE-2024-41095, CVE-2024-42104, CVE-2024-35877, CVE-2022-48943, CVE-2024-46743, CVE-2023-52531, CVE-2024-46757, CVE-2024-36953, CVE-2024-46756, CVE-2024-38596, CVE-2023-52612, CVE-2024-38637, CVE-2024-41071, CVE-2024-46759, CVE-2024-43882, CVE-2024-26675, CVE-2024-43854, CV…

Most recent entries from all

CVE-2022-48733 — btrfs: fix use-after-free after failure to create a snapshot

USN-7121-1 — linux, linux-aws, linux-aws-hwe, linux-azure, linux-azure-4.15, linux-gcp, linux-gcp-4.15, linux-hwe, linux-kvm, linux-…