cve-2022-48733
Vulnerability from cvelistv5
Published
2024-06-20 11:13
Modified
2024-12-19 08:06
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix use-after-free after failure to create a snapshot At ioctl.c:create_snapshot(), we allocate a pending snapshot structure and then attach it to the transaction's list of pending snapshots. After that we call btrfs_commit_transaction(), and if that returns an error we jump to 'fail' label, where we kfree() the pending snapshot structure. This can result in a later use-after-free of the pending snapshot: 1) We allocated the pending snapshot and added it to the transaction's list of pending snapshots; 2) We call btrfs_commit_transaction(), and it fails either at the first call to btrfs_run_delayed_refs() or btrfs_start_dirty_block_groups(). In both cases, we don't abort the transaction and we release our transaction handle. We jump to the 'fail' label and free the pending snapshot structure. We return with the pending snapshot still in the transaction's list; 3) Another task commits the transaction. This time there's no error at all, and then during the transaction commit it accesses a pointer to the pending snapshot structure that the snapshot creation task has already freed, resulting in a user-after-free. This issue could actually be detected by smatch, which produced the following warning: fs/btrfs/ioctl.c:843 create_snapshot() warn: '&pending_snapshot->list' not removed from list So fix this by not having the snapshot creation ioctl directly add the pending snapshot to the transaction's list. Instead add the pending snapshot to the transaction handle, and then at btrfs_commit_transaction() we add the snapshot to the list only when we can guarantee that any error returned after that point will result in a transaction abort, in which case the ioctl code can safely free the pending snapshot and no one can access it anymore.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/28b21c558a3753171097193b6f6602a94169093aPatch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/7e4c72dbaf62f8978af8321a24dbd35566d3a78a
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/9372fa1d73da5f1673921e365d0cd2c27ec7adc2Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/a7b717fa15165d3d9245614680bebc48a52ac05dPatch
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/28b21c558a3753171097193b6f6602a94169093aPatch
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/9372fa1d73da5f1673921e365d0cd2c27ec7adc2Patch
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/a7b717fa15165d3d9245614680bebc48a52ac05dPatch
Impacted products
Vendor Product Version
Linux Linux
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T15:25:01.133Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/a7b717fa15165d3d9245614680bebc48a52ac05d"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/9372fa1d73da5f1673921e365d0cd2c27ec7adc2"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/28b21c558a3753171097193b6f6602a94169093a"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-48733",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T17:10:54.149503Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:34:48.869Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/btrfs/ioctl.c",
            "fs/btrfs/transaction.c",
            "fs/btrfs/transaction.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7e4c72dbaf62f8978af8321a24dbd35566d3a78a",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "a7b717fa15165d3d9245614680bebc48a52ac05d",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "9372fa1d73da5f1673921e365d0cd2c27ec7adc2",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "28b21c558a3753171097193b6f6602a94169093a",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/btrfs/ioctl.c",
            "fs/btrfs/transaction.c",
            "fs/btrfs/transaction.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.226",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.22",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.16.*",
              "status": "unaffected",
              "version": "5.16.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix use-after-free after failure to create a snapshot\n\nAt ioctl.c:create_snapshot(), we allocate a pending snapshot structure and\nthen attach it to the transaction\u0027s list of pending snapshots. After that\nwe call btrfs_commit_transaction(), and if that returns an error we jump\nto \u0027fail\u0027 label, where we kfree() the pending snapshot structure. This can\nresult in a later use-after-free of the pending snapshot:\n\n1) We allocated the pending snapshot and added it to the transaction\u0027s\n   list of pending snapshots;\n\n2) We call btrfs_commit_transaction(), and it fails either at the first\n   call to btrfs_run_delayed_refs() or btrfs_start_dirty_block_groups().\n   In both cases, we don\u0027t abort the transaction and we release our\n   transaction handle. We jump to the \u0027fail\u0027 label and free the pending\n   snapshot structure. We return with the pending snapshot still in the\n   transaction\u0027s list;\n\n3) Another task commits the transaction. This time there\u0027s no error at\n   all, and then during the transaction commit it accesses a pointer\n   to the pending snapshot structure that the snapshot creation task\n   has already freed, resulting in a user-after-free.\n\nThis issue could actually be detected by smatch, which produced the\nfollowing warning:\n\n  fs/btrfs/ioctl.c:843 create_snapshot() warn: \u0027\u0026pending_snapshot-\u003elist\u0027 not removed from list\n\nSo fix this by not having the snapshot creation ioctl directly add the\npending snapshot to the transaction\u0027s list. Instead add the pending\nsnapshot to the transaction handle, and then at btrfs_commit_transaction()\nwe add the snapshot to the list only when we can guarantee that any error\nreturned after that point will result in a transaction abort, in which\ncase the ioctl code can safely free the pending snapshot and no one can\naccess it anymore."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-19T08:06:40.992Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7e4c72dbaf62f8978af8321a24dbd35566d3a78a"
        },
        {
          "url": "https://git.kernel.org/stable/c/a7b717fa15165d3d9245614680bebc48a52ac05d"
        },
        {
          "url": "https://git.kernel.org/stable/c/9372fa1d73da5f1673921e365d0cd2c27ec7adc2"
        },
        {
          "url": "https://git.kernel.org/stable/c/28b21c558a3753171097193b6f6602a94169093a"
        }
      ],
      "title": "btrfs: fix use-after-free after failure to create a snapshot",
      "x_generator": {
        "engine": "bippy-5f407fcff5a0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-48733",
    "datePublished": "2024-06-20T11:13:20.737Z",
    "dateReserved": "2024-06-20T11:09:39.053Z",
    "dateUpdated": "2024-12-19T08:06:40.992Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-48733\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-06-20T12:15:11.700\",\"lastModified\":\"2024-11-21T07:33:53.347\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbtrfs: fix use-after-free after failure to create a snapshot\\n\\nAt ioctl.c:create_snapshot(), we allocate a pending snapshot structure and\\nthen attach it to the transaction\u0027s list of pending snapshots. After that\\nwe call btrfs_commit_transaction(), and if that returns an error we jump\\nto \u0027fail\u0027 label, where we kfree() the pending snapshot structure. This can\\nresult in a later use-after-free of the pending snapshot:\\n\\n1) We allocated the pending snapshot and added it to the transaction\u0027s\\n   list of pending snapshots;\\n\\n2) We call btrfs_commit_transaction(), and it fails either at the first\\n   call to btrfs_run_delayed_refs() or btrfs_start_dirty_block_groups().\\n   In both cases, we don\u0027t abort the transaction and we release our\\n   transaction handle. We jump to the \u0027fail\u0027 label and free the pending\\n   snapshot structure. We return with the pending snapshot still in the\\n   transaction\u0027s list;\\n\\n3) Another task commits the transaction. This time there\u0027s no error at\\n   all, and then during the transaction commit it accesses a pointer\\n   to the pending snapshot structure that the snapshot creation task\\n   has already freed, resulting in a user-after-free.\\n\\nThis issue could actually be detected by smatch, which produced the\\nfollowing warning:\\n\\n  fs/btrfs/ioctl.c:843 create_snapshot() warn: \u0027\u0026pending_snapshot-\u003elist\u0027 not removed from list\\n\\nSo fix this by not having the snapshot creation ioctl directly add the\\npending snapshot to the transaction\u0027s list. Instead add the pending\\nsnapshot to the transaction handle, and then at btrfs_commit_transaction()\\nwe add the snapshot to the list only when we can guarantee that any error\\nreturned after that point will result in a transaction abort, in which\\ncase the ioctl code can safely free the pending snapshot and no one can\\naccess it anymore.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: btrfs: corrige el use-after-free despu\u00e9s de una falla al crear una instant\u00e1nea En ioctl.c:create_snapshot(), asignamos una estructura de instant\u00e1nea pendiente y luego la adjuntamos a la lista de transacciones de instant\u00e1neas pendientes. Despu\u00e9s de eso, llamamos a btrfs_commit_transaction(), y si eso devuelve un error, saltamos a la etiqueta \u0027falla\u0027, donde liberamos() la estructura de instant\u00e1nea pendiente. Esto puede resultar en un uso posterior despu\u00e9s de la liberaci\u00f3n de la instant\u00e1nea pendiente: 1) Asignamos la instant\u00e1nea pendiente y la agregamos a la lista de instant\u00e1neas pendientes de la transacci\u00f3n; 2) Llamamos a btrfs_commit_transaction(), y falla en la primera llamada a btrfs_run_delayed_refs() o btrfs_start_dirty_block_groups(). En ambos casos, no abortamos la transacci\u00f3n y liberamos nuestro identificador de transacci\u00f3n. Saltamos a la etiqueta \u0027fallo\u0027 y liberamos la estructura de instant\u00e1nea pendiente. Regresamos con la instant\u00e1nea pendiente todav\u00eda en la lista de transacciones; 3) Otra tarea confirma la transacci\u00f3n. Esta vez no hay ning\u00fan error y luego, durante la confirmaci\u00f3n de la transacci\u00f3n, accede a un puntero a la estructura de instant\u00e1nea pendiente que la tarea de creaci\u00f3n de instant\u00e1nea ya ha liberado, lo que resulta en una liberaci\u00f3n de usuario. En realidad, este problema podr\u00eda ser detectado por smatch, que produjo la siguiente advertencia: fs/btrfs/ioctl.c:843 create_snapshot() advertencia: \u0027\u0026amp;pending_snapshot-\u0026gt;list\u0027 no se elimina de la lista. As\u00ed que solucione este problema al no tener el ioctl de creaci\u00f3n de instant\u00e1neas directamente agregue la instant\u00e1nea pendiente a la lista de transacciones. En su lugar, agregue la instant\u00e1nea pendiente al identificador de la transacci\u00f3n, y luego en btrfs_commit_transaction() agregamos la instant\u00e1nea a la lista solo cuando podamos garantizar que cualquier error devuelto despu\u00e9s de ese punto resultar\u00e1 en la cancelaci\u00f3n de la transacci\u00f3n, en cuyo caso el c\u00f3digo ioctl puede Libera la instant\u00e1nea pendiente y ya nadie podr\u00e1 acceder a ella.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"5.15.22\",\"matchCriteriaId\":\"175866EA-083C-4008-AE58-694B60CFDCC1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"5.16.8\",\"matchCriteriaId\":\"0623892A-E3E4-44E6-8A5E-39A0B47AF782\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/28b21c558a3753171097193b6f6602a94169093a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7e4c72dbaf62f8978af8321a24dbd35566d3a78a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/9372fa1d73da5f1673921e365d0cd2c27ec7adc2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a7b717fa15165d3d9245614680bebc48a52ac05d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/28b21c558a3753171097193b6f6602a94169093a\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9372fa1d73da5f1673921e365d0cd2c27ec7adc2\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a7b717fa15165d3d9245614680bebc48a52ac05d\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.