Vulnerability in btrfs: fix anon_dev leak in create_subvol()
Summary
GSD-2022-1003066: btrfs: fix anon_dev leak in create_subvol(). Affects Kernel versions < d887b3de318834f9aa637ecf79c6bc66cba7c69a. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The btrfs package is a part of the Linux Kernel ecosystem and is responsible for providing support for the B-tree file system. It is widely used in Linux distributions and offers advanced features such as snapshots, subvolumes, and data deduplication. The create_subvol() function within the btrfs package is used to create subvolumes. However, a vulnerability has been discovered in this function that leads to an anonymous device (anon_dev) leak. This vulnerability could potentially be exploited by an attacker to cause resource exhaustion and impact system stability.
Vulnerability Detail
The vulnerability in the create_subvol() function of the btrfs package allows an anonymous device (anon_dev) leak. When creating subvolumes, the function fails to properly release the allocated anon_dev, leading to a resource leak. This can be exploited by an attacker to exhaust system resources, potentially causing a denial-of-service condition. The impact of this vulnerability may vary depending on the system's configuration and the attacker's ability to trigger the vulnerable code path.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the official fix by updating the Linux Kernel to the patched version.
Conclusion
In conclusion, the btrfs package in the Linux Kernel is vulnerable to an anon_dev leak in the create_subvol() function. This vulnerability can be exploited to exhaust system resources and potentially cause a denial-of-service condition. Users are advised to update their systems to the latest available kernel version to ensure the vulnerability is patched. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
btrfs is a file system implemented in the Linux Kernel that provides advanced features such as snapshots, subvolumes, and data deduplication.
The create_subvol() function is a part of the btrfs package and is used to create subvolumes within the file system.
An anonymous device (anon_dev) leak refers to a situation where system resources allocated for anonymous devices are not properly released, leading to resource exhaustion and potential system instability.
The impact of this vulnerability may vary depending on the system's configuration and the attacker's ability to trigger the vulnerable code path. It could potentially lead to resource exhaustion and a denial-of-service condition.
To fix this vulnerability, it is recommended to update the Linux Kernel to version v5.17.14 or later, which includes the necessary patch to address the issue.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
