Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2022-48733— btrfs: fix use-after-free after failure to create a snapshot

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel 存在安全漏洞，该漏洞源于 btrfs 模块创建快照失败后存在释放后重用问题。

CVSS 7.8 · High EPSS 0.23% · P13

Possible ATT&CK Techniques 1 AI

T1068 · Exploitation for Privilege Escalation

Affected Version Matrix 10

VendorProduct Version RangeStatus
Linux Linux c37b2b6269ee4637fb7cdb5da0d1e47215d57ce2< 7e4c72dbaf62f8978af8321a24dbd35566d3a78a affected
c37b2b6269ee4637fb7cdb5da0d1e47215d57ce2< a7b717fa15165d3d9245614680bebc48a52ac05d affected
c37b2b6269ee4637fb7cdb5da0d1e47215d57ce2< 9372fa1d73da5f1673921e365d0cd2c27ec7adc2 affected
c37b2b6269ee4637fb7cdb5da0d1e47215d57ce2< 28b21c558a3753171097193b6f6602a94169093a affected
3.7 affected
< 3.7 unaffected
5.10.226≤ 5.10.* unaffected
5.15.22≤ 5.15.* unaffected
… +2 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2022-48733

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
btrfs: fix use-after-free after failure to create a snapshot
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix use-after-free after failure to create a snapshot At ioctl.c:create_snapshot(), we allocate a pending snapshot structure and then attach it to the transaction's list of pending snapshots. After that we call btrfs_commit_transaction(), and if that returns an error we jump to 'fail' label, where we kfree() the pending snapshot structure. This can result in a later use-after-free of the pending snapshot: 1) We allocated the pending snapshot and added it to the transaction's list of pending snapshots; 2) We call btrfs_commit_transaction(), and it fails either at the first call to btrfs_run_delayed_refs() or btrfs_start_dirty_block_groups(). In both cases, we don't abort the transaction and we release our transaction handle. We jump to the 'fail' label and free the pending snapshot structure. We return with the pending snapshot still in the transaction's list; 3) Another task commits the transaction. This time there's no error at all, and then during the transaction commit it accesses a pointer to the pending snapshot structure that the snapshot creation task has already freed, resulting in a user-after-free. This issue could actually be detected by smatch, which produced the following warning: fs/btrfs/ioctl.c:843 create_snapshot() warn: '&pending_snapshot->list' not removed from list So fix this by not having the snapshot creation ioctl directly add the pending snapshot to the transaction's list. Instead add the pending snapshot to the transaction handle, and then at btrfs_commit_transaction() we add the snapshot to the list only when we can guarantee that any error returned after that point will result in a transaction abort, in which case the ioctl code can safely free the pending snapshot and no one can access it anymore.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel 存在安全漏洞，该漏洞源于 btrfs 模块创建快照失败后存在释放后重用问题。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux c37b2b6269ee4637fb7cdb5da0d1e47215d57ce2 ~ 7e4c72dbaf62f8978af8321a24dbd35566d3a78a -
Linux Linux 3.7 -

II. Public POCs for CVE-2022-48733

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2022-48733

请登录查看更多情报信息。

Patches & Fixes for CVE-2022-48733 (1)

Other References for CVE-2022-48733 (2)

Same Patch Batch · Linux · 2024-06-20 · 67 CVEs total

CVE-2022-48711 9.8 CRITICAL tipc: improve size validations for received domain records
CVE-2024-38620 8.8 HIGH Bluetooth: HCI: Remove HCI_AMP support
CVE-2021-47620 8.1 HIGH Bluetooth: refactor malicious adv data check
CVE-2022-48743 8.1 HIGH net: amd-xgbe: Fix skb data length underflow
CVE-2022-48754 7.8 HIGH phylib: fix potential use-after-free
CVE-2022-48751 7.8 HIGH net/smc: Transitional solution for clcsock race issue
CVE-2022-48716 7.8 HIGH ASoC: codecs: wcd938x: fix incorrect used of portid
CVE-2022-48771 7.8 HIGH drm/vmwgfx: Fix stale file descriptors on failed usercopy
CVE-2022-48720 7.8 HIGH net: macsec: Fix offload support for NETDEV_UNREGISTER event
CVE-2022-48742 7.8 HIGH rtnetlink: make sure to refresh master_dev/m_ops in __rtnl_newlink()
CVE-2022-48721 7.8 HIGH net/smc: Forward wakeup to smc socket waitqueue after fallback
CVE-2022-48762 7.8 HIGH arm64: extable: fix load_unaligned_zeropad() reg indices
CVE-2022-48726 7.8 HIGH RDMA/ucma: Protect mc during concurrent multicast leaves
CVE-2022-48735 7.8 HIGH ALSA: hda: Fix UAF of leds class devs at unbinding
CVE-2022-48729 7.8 HIGH IB/hfi1: Fix panic with larger ipoib send_queue_size
CVE-2022-48759 7.8 HIGH rpmsg: char: Fix race between the release of rpmsg_ctrldev and cdev
CVE-2022-48744 7.5 HIGH net/mlx5e: Avoid field-overflowing memcpy()
CVE-2022-48727 7.3 HIGH KVM: arm64: Avoid consuming a stale esr value when SError occur
CVE-2022-48739 7.1 HIGH ASoC: hdmi-codec: Fix OOB memory accesses
CVE-2022-48717 7.1 HIGH ASoC: max9759: fix underflow in speaker_gain_control_put()

Showing top 20 of 67 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2022-48733

No comments yet

Leave a comment