CVE-2022-48833

一、漏洞信息
 漏洞编号：[CVE-2022-48833](https://nvd.nist.gov/vuln/detail/CVE-2022-48833)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.0,6.1.14,6.1.19,6.1.5,6.1.6,6.1.8,6.4.0,6.6.0
 CVSS V2.0分值：
  BaseScore：0.0 Low
  Vector：CVSS：2.0/
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:btrfs: skip reserved bytes warning on unmount after log cleanup failureAfter the recent changes made by commit c2e39305299f01 ( btrfs: clearextent buffer uptodate when we fail to write it ) and its followup fix,commit 651740a5024117 ( btrfs: check WRITE_ERR when trying to read anextent buffer ), we can now end up not cleaning up space reservations oflog tree extent buffers after a transaction abort happens, as well as notcleaning up still dirty extent buffers.This happens because if writeback for a log tree extent buffer failed,then we have cleared the bit EXTENT_BUFFER_UPTODATE from the extent bufferand we have also set the bit EXTENT_BUFFER_WRITE_ERR on it. Later on,when trying to free the log tree with free_log_tree(), which iteratesover the tree, we can end up getting an -EIO error when trying to reada node or a leaf, since read_extent_buffer_pages() returns -EIO if anextent buffer does not have EXTENT_BUFFER_UPTODATE set and has theEXTENT_BUFFER_WRITE_ERR bit set. Getting that -EIO means that we returnimmediately as we can not iterate over the entire tree.In that case we never update the reserved space for an extent buffer inthe respective block group and space_info object.When this happens we get the following traces when unmounting the fs:[174957.284509] BTRFS: error (device dm-0) in cleanup_transaction:1913: errno=-5 IO failure[174957.286497] BTRFS: error (device dm-0) in free_log_tree:3420: errno=-5 IO failure[174957.399379] ------------[ cut here ]------------[174957.402497] WARNING: CPU: 2 PID: 3206883 at fs/btrfs/block-group.c:127 btrfs_put_block_group+0x77/0xb0 [btrfs][174957.407523] Modules linked in: btrfs overlay dm_zero (...)[174957.424917] CPU: 2 PID: 3206883 Comm: umount Tainted: G        W         5.16.0-rc5-btrfs-next-109 #1[174957.426689] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014[174957.428716] RIP: 0010:btrfs_put_block_group+0x77/0xb0 [btrfs][174957.429717] Code: 21 48 8b bd (...)[174957.432867] RSP: 0018:ffffb70d41cffdd0 EFLAGS: 00010206[174957.433632] RAX: 0000000000000001 RBX: ffff8b09c3848000 RCX: ffff8b0758edd1c8[174957.434689] RDX: 0000000000000001 RSI: ffffffffc0b467e7 RDI: ffff8b0758edd000[174957.436068] RBP: ffff8b0758edd000 R08: 0000000000000000 R09: 0000000000000000[174957.437114] R10: 0000000000000246 R11: 0000000000000000 R12: ffff8b09c3848148[174957.438140] R13: ffff8b09c3848198 R14: ffff8b0758edd188 R15: dead000000000100[174957.439317] FS:  00007f328fb82800(0000) GS:ffff8b0a2d200000(0000) knlGS:0000000000000000[174957.440402] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033[174957.441164] CR2: 00007fff13563e98 CR3: 0000000404f4e005 CR4: 0000000000370ee0[174957.442117] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000[174957.443076] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400[174957.443948] Call Trace:[174957.444264]  <TASK>[174957.444538]  btrfs_free_block_groups+0x255/0x3c0 [btrfs][174957.445238]  close_ctree+0x301/0x357 [btrfs][174957.445803]  ? call_rcu+0x16c/0x290[174957.446250]  generic_shutdown_super+0x74/0x120[174957.446832]  kill_anon_super+0x14/0x30[174957.447305]  btrfs_kill_super+0x12/0x20 [btrfs][174957.447890]  deactivate_locked_super+0x31/0xa0[174957.448440]  cleanup_mnt+0x147/0x1c0[174957.448888]  task_work_run+0x5c/0xa0[174957.449336]  exit_to_user_mode_prepare+0x1e5/0x1f0[174957.449934]  syscall_exit_to_user_mode+0x16/0x40[174957.450512]  do_syscall_64+0x48/0xc0[174957.450980]  entry_SYSCALL_64_after_hwframe+0x44/0xae[174957.451605] RIP: 0033:0x7f328fdc4a97[174957.452059] Code: 03 0c 00 f7 (...)[174957.454320] RSP: 002b:00007fff13564ec8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6[174957.455262] RAX: 0000000000000000 RBX: 00007f328feea264 RCX: 00007f328fdc4a97[174957.456131] RDX: 0000000000000000 RSI: 00000000000000---truncated---
 漏洞公开时间：2024-07-16 21:15:10
 漏洞创建时间：2024-07-17 01:42:30
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2022-48833
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/40cdc509877bacb438213b83c7541c5e24a1d9ec |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/44557a8f539a822c91238c1f95a95f98a5093d82 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/4c5d94990fa2fd609360ecd0f7e183212a7d115c |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-48833 | https://bugzilla.suse.com/show_bug.cgi?id=1228059 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2022-48833 | https://bugzilla.suse.com/show_bug.cgi?id=1228059 |
| suse_bugzilla | https://git.kernel.org/stable/c/40cdc509877bacb438213b83c7541c5e24a1d9ec | https://bugzilla.suse.com/show_bug.cgi?id=1228059 |
| suse_bugzilla | https://git.kernel.org/stable/c/44557a8f539a822c91238c1f95a95f98a5093d82 | https://bugzilla.suse.com/show_bug.cgi?id=1228059 |
| suse_bugzilla | https://git.kernel.org/stable/c/4c5d94990fa2fd609360ecd0f7e183212a7d115c | https://bugzilla.suse.com/show_bug.cgi?id=1228059 |
| suse_bugzilla | https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2022/CVE-2022-48833.mbox | https://bugzilla.suse.com/show_bug.cgi?id=1228059 |
| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2298174 | https://bugzilla.suse.com/show_bug.cgi?id=1228059 |
| ubuntu | https://www.cve.org/CVERecord?id=CVE-2022-48833 | https://ubuntu.com/security/CVE-2022-48833 |
| ubuntu | https://git.kernel.org/linus/40cdc509877bacb438213b83c7541c5e24a1d9ec (5.17-rc3) | https://ubuntu.com/security/CVE-2022-48833 |
| ubuntu | https://git.kernel.org/stable/c/4c5d94990fa2fd609360ecd0f7e183212a7d115c | https://ubuntu.com/security/CVE-2022-48833 |
| ubuntu | https://git.kernel.org/stable/c/44557a8f539a822c91238c1f95a95f98a5093d82 | https://ubuntu.com/security/CVE-2022-48833 |
| ubuntu | https://git.kernel.org/stable/c/40cdc509877bacb438213b83c7541c5e24a1d9ec | https://ubuntu.com/security/CVE-2022-48833 |
| ubuntu | https://nvd.nist.gov/vuln/detail/CVE-2022-48833 | https://ubuntu.com/security/CVE-2022-48833 |
| ubuntu | https://launchpad.net/bugs/cve/CVE-2022-48833 | https://ubuntu.com/security/CVE-2022-48833 |
| ubuntu | https://security-tracker.debian.org/tracker/CVE-2022-48833 | https://ubuntu.com/security/CVE-2022-48833 |
| cve_search |  | https://git.kernel.org/stable/c/4c5d94990fa2fd609360ecd0f7e183212a7d115c |
| cve_search |  | https://git.kernel.org/stable/c/44557a8f539a822c91238c1f95a95f98a5093d82 |
| cve_search |  | https://git.kernel.org/stable/c/40cdc509877bacb438213b83c7541c5e24a1d9ec |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  其它
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
| linux |  | https://git.kernel.org/linus/40cdc509877bacb438213b83c7541c5e24a1d9ec | https://git.kernel.org/linus/1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 | ubuntu |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
                    Reserved.         
 openEuler评分：
  3.9
 Vector：CVSS：2.0/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L
 受影响版本排查(受影响/不受影响)：
  1.openEuler-20.03-LTS-SP4(4.19.90):不受影响
2.openEuler-22.03-LTS-SP1(5.10.0):不受影响
3.openEuler-22.03-LTS-SP3(5.10.0):不受影响
4.openEuler-22.03-LTS-SP4(5.10.0):不受影响
5.master(6.1.0):不受影响
6.openEuler-24.03-LTS(6.6.0):不受影响
7.openEuler-24.03-LTS-Next(6.6.0):不受影响

修复是否涉及abi变化(是/否)：
  1.openEuler-20.03-LTS-SP4(4.19.90):否
2.openEuler-22.03-LTS-SP1(5.10.0):否
3.openEuler-22.03-LTS-SP3(5.10.0):否
4.master(6.1.0):否
5.openEuler-24.03-LTS(6.6.0):否
6.openEuler-24.03-LTS-Next(6.6.0):否
7.openEuler-22.03-LTS-SP4(5.10.0):否

src-openEuler / kernel
Closed

Content Risk Flag

Comments (7)

src-openEuler / kernelClosed .gitee-modal { width: 500px !important; }

Content Risk Flag

CVE-2022-48833

Comments (7)

Search

src-openEuler / kernel
Closed