Critical NULL Pointer Dereference in Linux Kernel btrfs Package
Summary
CVE-2022-49833: In the Linux kernel, the following vulnerability has been resolved: btrfs: zoned: clone zoned device info when cloning a device When cloning a btrfs_device, we're not cloning the associated btrfs_zoned_device_info struct... Affects linux versions < 6.0.10-1. Fixed in 6.0.10-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interaction. The btrfs (B-tree file system) is a modern file system for Linux that supports advanced features such as snapshots, dynamic inode allocation, and integrated multi-device support. However, it is susceptible to vulnerabilities that can compromise system stability and security.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the btrfs file system related to the cloning of zoned devices. When a btrfs_device is cloned, the associated btrfs_zoned_device_info structure is not cloned, leading to a NULL pointer dereference when accessing the device's zone_info. This issue can occur when attempting to set a zone as active, potentially resulting in system crashes or data loss. The vulnerability was uncovered through fstests' testcase btrfs/161.
How To Fix
Minimum fixed version
6.0.10-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. Users are advised to apply the patch as soon as it becomes available.
Conclusion
The CVE-2022-49833 vulnerability in the Linux kernel's btrfs file system poses a significant risk due to potential system crashes and data loss. Users are encouraged to update their packages to the patched version as soon as it becomes available and to utilize tools like Vulert to monitor for vulnerabilities in their applications.
See every vulnerability recorded for linux →
FAQ
CVE-2022-49833 is a vulnerability in the Linux kernel's btrfs file system that can lead to a NULL pointer dereference when cloning zoned devices.
This vulnerability can cause system crashes or data loss when accessing the zone_info of a cloned btrfs_device.
Yes, a patch is available for Debian 12 and 13 in version 6.0.10-1. Users of Debian 11 should monitor for updates.
You can use Vulert, which monitors open-source vulnerabilities in your software using a manifest file. Visit Vulert Scanner to check your application without signup.
While there are no specific workarounds, it is recommended to apply the patch as soon as possible to mitigate risks associated with this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
