Decompression Thread Hang in Linux Kernel - EROFS Package Vulnerability
Summary
CVE-2022-50193: In the Linux kernel, the following vulnerability has been resolved: erofs: wake up all waiters after z_erofs_lzma_head ready When the user mounts the erofs second times, the decompression thread may hung. Affects linux versions < 6.0.2-1. Fixed in 6.0.2-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of the operating system, responsible for managing hardware and system resources. It supports various file systems, including EROFS (Enhanced Read-Only File System), which is designed for efficient storage and access of read-only data. The vulnerability in question affects the EROFS package, specifically during the decompression process when mounting the file system multiple times, leading to potential system hangs.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the EROFS package that can cause a decompression thread to hang when the user mounts the EROFS file system multiple times. This issue arises from a race condition between two tasks: one task is responsible for loading the LZMA configuration and another task attempts to decompress data but ends up sleeping due to an empty node queue. This can lead to a situation where the decompression thread is indefinitely blocked, resulting in system instability and degraded performance.
How To Fix
Minimum fixed version
6.0.2-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is recommended to avoid mounting the EROFS file system multiple times until the patch is applied.
Conclusion
The vulnerability identified in the Linux kernel's EROFS package poses a risk of decompression thread hangs when mounting the file system multiple times. Users are encouraged to update to the patched version 6.0.2-1 to mitigate this issue. Monitoring tools like Vulert can assist in identifying vulnerabilities in your software.
See every vulnerability recorded for linux →
FAQ
EROFS stands for Enhanced Read-Only File System, which is designed for efficient storage and access of read-only data in the Linux kernel.
The primary symptom is that the decompression thread may hang, leading to system instability and performance issues when mounting the EROFS file system multiple times.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability.
While the vulnerability may cause system hangs, it does not directly lead to data loss. However, it can affect system performance and stability.
If you cannot update the package immediately, it is advisable to limit the use of the EROFS file system until the patch is applied to avoid potential hangs.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
