Deadlock Vulnerability in Linux Kernel's Btrfs Package: CVE-2022-49079
Summary
CVE-2022-49079: In the Linux kernel, the following vulnerability has been resolved: btrfs: zoned: traverse devices under chunk_mutex in btrfs_can_activate_zone btrfs_can_activate_zone() can be called with the device_list_mutex already h... Affects linux versions < 5.17.3-1. Fixed in 5.17.3-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Linux kernel is the core component of Linux operating systems, managing hardware and system resources. Btrfs (B-tree file system) is a modern file system for Linux that provides advanced features like snapshots, dynamic inode allocation, and integrated volume management. However, it is susceptible to a deadlock vulnerability that can occur during chunk allocation, potentially leading to system instability.
Vulnerability Detail
The vulnerability, identified as CVE-2022-49079, arises from the function btrfs_can_activate_zone, which can be called while holding the device_list_mutex. This can lead to a deadlock situation where the system attempts to acquire the same lock multiple times, causing a halt in operations. The deadlock occurs during the chunk allocation process, where the system tries to traverse the device list while already holding a lock, resulting in a recursive locking scenario. This vulnerability can severely impact system performance and reliability, especially in environments relying on Btrfs for data management.
How To Fix
Minimum fixed version
5.17.3-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is recommended to apply the patch as soon as it is available to avoid potential deadlock scenarios.
Conclusion
CVE-2022-49079 is a critical deadlock vulnerability in the Linux kernel's Btrfs file system that can lead to significant system performance issues. Users are urged to update to the patched version to ensure system stability. Monitoring tools like Vulert can assist in identifying vulnerabilities in your software.
See every vulnerability recorded for linux →
FAQ
CVE-2022-49079 is a vulnerability in the Linux kernel's Btrfs file system that can lead to a deadlock during chunk allocation.
This vulnerability can cause system instability and performance issues, particularly in systems using Btrfs for data management.
You should update your Linux kernel to version 5.17.3-1 or later to mitigate the vulnerability.
Yes, you can use Vulert, which monitors open-source vulnerabilities in your software using a manifest file like package-lock.json. You can check for vulnerabilities in your application without needing to install anything.
Detailed information about CVE-2022-49079 can be found on security databases and the official Linux kernel mailing lists.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
