Deadlock Vulnerability in Linux Kernel's Btrfs File System - CVE-2022-49547
Summary
CVE-2022-49547: In the Linux kernel, the following vulnerability has been resolved: btrfs: fix deadlock between concurrent dio writes when low on free data space When reserving data space for a direct IO write we can end up deadlocking... Affects linux versions < 5.18.5-1. Fixed in 5.18.5-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of Linux operating systems, responsible for managing hardware and system resources. Btrfs (B-tree file system) is a modern file system for Linux that offers advanced features such as snapshots, dynamic inode allocation, and integrated volume management. However, it is susceptible to a deadlock vulnerability when multiple tasks attempt concurrent direct I/O writes under low data space conditions, potentially leading to system hangs.
Vulnerability Detail
CVE-2022-49547 describes a deadlock scenario in the Btrfs file system of the Linux kernel. The vulnerability arises when multiple tasks try to perform direct I/O writes to the same file range while the system is low on available data space. This situation can lead to a deadlock involving the tasks performing the writes and the asynchronous data reclaim task, causing the system to become unresponsive. The deadlock occurs due to improper locking mechanisms when reserving data space, which can be triggered sporadically during specific test cases.
How To Fix
Minimum fixed version
5.18.5-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. However, avoiding concurrent direct I/O writes to the same file range when the system is low on data space may help mitigate the risk of encountering the deadlock.
Conclusion
CVE-2022-49547 presents a significant deadlock vulnerability in the Linux kernel's Btrfs file system, which can lead to system hangs under specific conditions. It is crucial for users to update their systems to the patched version to avoid potential disruptions. Regular monitoring for vulnerabilities using tools like Vulert can help maintain system security.
See every vulnerability recorded for linux →
FAQ
CVE-2022-49547 is a vulnerability in the Linux kernel's Btrfs file system that can lead to a deadlock when multiple tasks attempt concurrent direct I/O writes under low data space conditions.
If your system is running a vulnerable version of the Linux kernel with Btrfs, you may experience system hangs or unresponsiveness due to the deadlock condition.
The vulnerability affects Linux kernel versions prior to 5.18.5-1 on Debian 12 and 13.
Yes, the patch is available in version 5.18.5-1 of the Linux package. It is recommended to update to this version to mitigate the vulnerability.
You can use Vulert, which monitors open-source vulnerabilities in your software by analyzing a manifest file like package-lock.json. Visit Vulert Scanner to check if your application is affected without needing to sign up.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
