Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2022-48733— btrfs: fix use-after-free after failure to create a snapshot

CVSS 7.8 · High EPSS 0.23% · P14

Affected Version Matrix 10

VendorProductVersion RangeStatus
LinuxLinuxc37b2b6269ee4637fb7cdb5da0d1e47215d57ce2< 7e4c72dbaf62f8978af8321a24dbd35566d3a78aaffected
c37b2b6269ee4637fb7cdb5da0d1e47215d57ce2< a7b717fa15165d3d9245614680bebc48a52ac05daffected
c37b2b6269ee4637fb7cdb5da0d1e47215d57ce2< 9372fa1d73da5f1673921e365d0cd2c27ec7adc2affected
c37b2b6269ee4637fb7cdb5da0d1e47215d57ce2< 28b21c558a3753171097193b6f6602a94169093aaffected
3.7affected
< 3.7unaffected
5.10.226≤ 5.10.*unaffected
5.15.22≤ 5.15.*unaffected
… +2 more rows
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2022-48733

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
btrfs: fix use-after-free after failure to create a snapshot
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix use-after-free after failure to create a snapshot At ioctl.c:create_snapshot(), we allocate a pending snapshot structure and then attach it to the transaction's list of pending snapshots. After that we call btrfs_commit_transaction(), and if that returns an error we jump to 'fail' label, where we kfree() the pending snapshot structure. This can result in a later use-after-free of the pending snapshot: 1) We allocated the pending snapshot and added it to the transaction's list of pending snapshots; 2) We call btrfs_commit_transaction(), and it fails either at the first call to btrfs_run_delayed_refs() or btrfs_start_dirty_block_groups(). In both cases, we don't abort the transaction and we release our transaction handle. We jump to the 'fail' label and free the pending snapshot structure. We return with the pending snapshot still in the transaction's list; 3) Another task commits the transaction. This time there's no error at all, and then during the transaction commit it accesses a pointer to the pending snapshot structure that the snapshot creation task has already freed, resulting in a user-after-free. This issue could actually be detected by smatch, which produced the following warning: fs/btrfs/ioctl.c:843 create_snapshot() warn: '&pending_snapshot->list' not removed from list So fix this by not having the snapshot creation ioctl directly add the pending snapshot to the transaction's list. Instead add the pending snapshot to the transaction handle, and then at btrfs_commit_transaction() we add the snapshot to the list only when we can guarantee that any error returned after that point will result in a transaction abort, in which case the ioctl code can safely free the pending snapshot and no one can access it anymore.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel 存在安全漏洞，该漏洞源于 btrfs 模块创建快照失败后存在释放后重用问题。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

VendorProductAffected VersionsCPESubscribe
LinuxLinux c37b2b6269ee4637fb7cdb5da0d1e47215d57ce2 ~ 7e4c72dbaf62f8978af8321a24dbd35566d3a78a -
LinuxLinux 3.7 -

II. Public POCs for CVE-2022-48733

#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2022-48733

请登录查看更多情报信息。

Patches & Fixes for CVE-2022-48733 (1)

Other References for CVE-2022-48733 (2)

Same Patch Batch · Linux · 2024-06-20 · 67 CVEs total

CVE-2022-487119.8 CRITICALtipc: improve size validations for received domain records
CVE-2024-386208.8 HIGHBluetooth: HCI: Remove HCI_AMP support
CVE-2021-476208.1 HIGHBluetooth: refactor malicious adv data check
CVE-2022-487438.1 HIGHnet: amd-xgbe: Fix skb data length underflow
CVE-2022-487547.8 HIGHphylib: fix potential use-after-free
CVE-2022-487517.8 HIGHnet/smc: Transitional solution for clcsock race issue
CVE-2022-487167.8 HIGHASoC: codecs: wcd938x: fix incorrect used of portid
CVE-2022-487717.8 HIGHdrm/vmwgfx: Fix stale file descriptors on failed usercopy
CVE-2022-487207.8 HIGHnet: macsec: Fix offload support for NETDEV_UNREGISTER event
CVE-2022-487427.8 HIGHrtnetlink: make sure to refresh master_dev/m_ops in __rtnl_newlink()
CVE-2022-487217.8 HIGHnet/smc: Forward wakeup to smc socket waitqueue after fallback
CVE-2022-487627.8 HIGHarm64: extable: fix load_unaligned_zeropad() reg indices
CVE-2022-487267.8 HIGHRDMA/ucma: Protect mc during concurrent multicast leaves
CVE-2022-487357.8 HIGHALSA: hda: Fix UAF of leds class devs at unbinding
CVE-2022-487297.8 HIGHIB/hfi1: Fix panic with larger ipoib send_queue_size
CVE-2022-487597.8 HIGHrpmsg: char: Fix race between the release of rpmsg_ctrldev and cdev
CVE-2022-487447.5 HIGHnet/mlx5e: Avoid field-overflowing memcpy()
CVE-2022-487277.3 HIGHKVM: arm64: Avoid consuming a stale esr value when SError occur
CVE-2022-487397.1 HIGHASoC: hdmi-codec: Fix OOB memory accesses
CVE-2022-487177.1 HIGHASoC: max9759: fix underflow in speaker_gain_control_put()

Showing top 20 of 67 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2022-48733

No comments yet

Leave a comment