Critical Vulnerability in Linux Kernel: EROFS Missing xas_retry() in FSCACHE Mode
Summary
CVE-2022-49815: In the Linux kernel, the following vulnerability has been resolved: erofs: fix missing xas_retry() in fscache mode The xarray iteration only holds the RCU read lock and thus may encounter XA_RETRY_ENTRY if there's proces... Affects linux versions < 6.0.10-1. Fixed in 6.0.10-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interaction. It is known for its stability, performance, and flexibility, supporting a wide range of applications from servers to embedded systems. The recent vulnerability identified as CVE-2022-49815 affects the EROFS (Enhanced Read-Only File System) module, which is designed to optimize storage efficiency and performance. This vulnerability arises from a flaw in the xarray iteration process, which can lead to system crashes when accessed concurrently.
Vulnerability Detail
In the Linux kernel, specifically within the EROFS module, a critical vulnerability has been identified due to the absence of the xas_retry() function in fscache mode. The xarray iteration only holds the RCU read lock, which may lead to encountering XA_RETRY_ENTRY if another process modifies the xarray concurrently. This situation can cause an 'oops' error when attempting to reference an invalid entry, potentially resulting in system instability or crashes.
How To Fix
Minimum fixed version
6.0.10-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch by updating the kernel as described above.
Conclusion
The CVE-2022-49815 vulnerability in the Linux kernel's EROFS module poses a significant risk due to its potential to cause system crashes. Users are strongly advised to update their kernel to the patched version 6.0.10-1 or later to ensure system stability. Monitoring tools like Vulert can assist in identifying vulnerabilities in your software without the need for complex setups.
See every vulnerability recorded for linux →
FAQ
CVE-2022-49815 is a vulnerability in the Linux kernel's EROFS module that can lead to system crashes due to improper handling of concurrent modifications in the xarray.
If your system is running a vulnerable version of the Linux kernel, it may experience instability or crashes when the EROFS module is accessed concurrently.
While there are no specific workarounds, it is crucial to plan for an update as soon as possible to mitigate the risk of system crashes.
Detailed information can be found in the official CVE database and security advisories related to the Linux kernel.
Vulert allows you to monitor and alert for open-source vulnerabilities in your software using just a manifest file like package-lock.json, providing real-time insights without requiring code access.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
