Double Completion Error in Btrfs Compressed Reads - Linux Kernel Vulnerability
Summary
CVE-2022-49167: In the Linux kernel, the following vulnerability has been resolved: btrfs: do not double complete bio on errors during compressed reads I hit some weird panics while fixing up the error handling from btrfs_lookup_bio_sum... Affects linux versions < 5.17.3-1. Fixed in 5.17.3-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware and software interaction. It supports various file systems, including Btrfs, which is known for its advanced features like snapshots and compression. However, a vulnerability has been identified in the Btrfs implementation that affects how compressed reads are handled, potentially leading to system instability.
Vulnerability Detail
The vulnerability arises from improper error handling in the Btrfs compressed read path. When an error occurs during the setup of compression bios, the bio is completed twice: once by the compression path and again by the btrfs_submit_data_bio() function. This double completion can lead to system panics and unpredictable behavior, as the kernel may attempt to process the same bio multiple times, causing resource mismanagement and crashes.
How To Fix
Minimum fixed version
5.17.3-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch as soon as it becomes available.
Conclusion
The CVE-2022-49167 vulnerability in the Linux kernel's Btrfs file system poses a significant risk due to improper error handling during compressed reads. Users are advised to update to the patched version of the kernel to prevent potential system crashes and data loss. Monitoring tools like Vulert can help keep your software secure from such vulnerabilities.
See every vulnerability recorded for linux →
FAQ
CVE-2022-49167 is a vulnerability in the Linux kernel related to the Btrfs file system, specifically concerning the handling of compressed reads that can lead to double completion of bio.
This vulnerability can cause system panics and crashes due to improper handling of bio completions, potentially leading to data loss or corruption.
If you are using Debian 11, 12, or 13 with the Linux kernel version prior to 5.17.3-1, your system is vulnerable to this issue.
While there are no specific workarounds, it is crucial to plan for an update as soon as possible to mitigate the risk of system instability.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities in your software using just a manifest file like package-lock.json. You can check if your application is affected by this vulnerability using the Vulert playground at Vulert Scanner without any signup.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
