Vulnerability in btrfs Kernel Package: Leaked bioc in read_zone_info
Summary
GSD-2022-1004412: btrfs: zoned: fix a leaked bioc in read_zone_info. Affects Kernel versions >= 7db1c5d14dcd521bef1780b79dcc68b3968447a9, < d300ced1288937d727cad69b3374f489f3e24795. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The btrfs package is a file system for Linux that provides advanced features such as snapshots, pooling, and integrated device management. It is widely used in various Linux distributions. The vulnerability in question affects the btrfs package, specifically the zoned feature. The zoned feature allows for the use of zoned block devices, which have specific write constraints. This vulnerability involves a leaked bioc (block I/O context) in the read_zone_info function of the zoned module.
Vulnerability Detail
The vulnerability occurs due to a failure to properly release a bioc in the read_zone_info function of the btrfs zoned module. This can lead to resource leaks and potential memory corruption. An attacker could potentially exploit this vulnerability to cause a denial-of-service condition or execute arbitrary code with elevated privileges. The vulnerability was introduced in version v5.12 of the Linux Kernel and has been fixed in version v5.15.56.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can avoid using the zoned feature of the btrfs package until the vulnerability is patched. This can be done by disabling the zoned module or using a different file system that does not rely on zoned block devices.
Conclusion
In conclusion, the btrfs package in the Linux Kernel is vulnerable to a leaked bioc in the read_zone_info function. This vulnerability can lead to resource leaks, memory corruption, and potential privilege escalation. It is recommended to update the Linux Kernel to version v5.15.56 or later to fix the vulnerability. Alternatively, users can disable the zoned module or avoid using the zoned feature until the vulnerability is patched. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can potentially lead to resource leaks and memory corruption. An attacker could exploit this vulnerability to cause a denial-of-service condition or execute arbitrary code with elevated privileges.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file and the Vulert Playground will analyze it for any open-source vulnerabilities, including this one.
Yes, a patch for this vulnerability is available in version v5.15.56 of the Linux Kernel. It is recommended to update to this version or later to mitigate the vulnerability.
Yes, as a workaround, you can disable the zoned module or avoid using the zoned feature of the btrfs package until the vulnerability is patched.
At the time of this report, there are no known exploits for this vulnerability. However, it is important to apply the patch or workaround as soon as possible to prevent potential exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
