CVE-2022-48833: Vulnerability in Linux Linux

Severity: mediumType: vulnerabilityCVE-2022-48833

In the Linux kernel, the following vulnerability has been resolved: btrfs: skip reserved bytes warning on unmount after log cleanup failure After the recent changes made by commit c2e39305299f01 ("btrfs: clear extent buffer uptodate when we fail to write it") and its followup fix, commit 651740a5024117 ("btrfs: check WRITE_ERR when trying to read an extent buffer"), we can now end up not cleaning up space reservations of log tree extent buffers after a transaction abort happens, as well as not cleaning up still dirty extent buffers. This happens because if writeback for a log tree extent buffer failed, then we have cleared the bit EXTENT_BUFFER_UPTODATE from the extent buffer and we have also set the bit EXTENT_BUFFER_WRITE_ERR on it. Later on, when trying to free the log tree with free_log_tree(), which iterates over the tree, we can end up getting an -EIO error when trying to read a node or a leaf, since read_extent_buffer_pages() returns -EIO if an extent buffer does not have EXTENT_BUFFER_UPTODATE set and has the EXTENT_BUFFER_WRITE_ERR bit set. Getting that -EIO means that we return immediately as we can not iterate over the entire tree. In that case we never update the reserved space for an extent buffer in the respective block group and space_info object. When this happens we get the following traces when unmounting the fs: [174957.284509] BTRFS: error (device dm-0) in cleanup_transaction:1913: errno=-5 IO failure [174957.286497] BTRFS: error (device dm-0) in free_log_tree:3420: errno=-5 IO failure [174957.399379] ------------[ cut here ]------------ [174957.402497] WARNING: CPU: 2 PID: 3206883 at fs/btrfs/block-group.c:127 btrfs_put_block_group+0x77/0xb0 [btrfs] [174957.407523] Modules linked in: btrfs overlay dm_zero (...) [174957.424917] CPU: 2 PID: 3206883 Comm: umount Tainted: G W 5.16.0-rc5-btrfs-next-109 #1 [174957.426689] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 [174957.428716] RIP: 0010:btrfs_put_block_group+0x77/0xb0 [btrfs] [174957.429717] Code: 21 48 8b bd (...) [174957.432867] RSP: 0018:ffffb70d41cffdd0 EFLAGS: 00010206 [174957.433632] RAX: 0000000000000001 RBX: ffff8b09c3848000 RCX: ffff8b0758edd1c8 [174957.434689] RDX: 0000000000000001 RSI: ffffffffc0b467e7 RDI: ffff8b0758edd000 [174957.436068] RBP: ffff8b0758edd000 R08: 0000000000000000 R09: 0000000000000000 [174957.437114] R10: 0000000000000246 R11: 0000000000000000 R12: ffff8b09c3848148 [174957.438140] R13: ffff8b09c3848198 R14: ffff8b0758edd188 R15: dead000000000100 [174957.439317] FS: 00007f328fb82800(0000) GS:ffff8b0a2d200000(0000) knlGS:0000000000000000 [174957.440402] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [174957.441164] CR2: 00007fff13563e98 CR3: 0000000404f4e005 CR4: 0000000000370ee0 [174957.442117] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [174957.443076] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [174957.443948] Call Trace: [174957.444264] <TASK> [174957.444538] btrfs_free_block_groups+0x255/0x3c0 [btrfs] [174957.445238] close_ctree+0x301/0x357 [btrfs] [174957.445803] ? call_rcu+0x16c/0x290 [174957.446250] generic_shutdown_super+0x74/0x120 [174957.446832] kill_anon_super+0x14/0x30 [174957.447305] btrfs_kill_super+0x12/0x20 [btrfs] [174957.447890] deactivate_locked_super+0x31/0xa0 [174957.448440] cleanup_mnt+0x147/0x1c0 [174957.448888] task_work_run+0x5c/0xa0 [174957.449336] exit_to_user_mode_prepare+0x1e5/0x1f0 [174957.449934] syscall_exit_to_user_mode+0x16/0x40 [174957.450512] do_syscall_64+0x48/0xc0 [174957.450980] entry_SYSCALL_64_after_hwframe+0x44/0xae [174957.451605] RIP: 0033:0x7f328fdc4a97 [174957.452059] Code: 03 0c 00 f7 (...) [174957.454320] RSP: 002b:00007fff13564ec8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [174957.455262] RAX: 0000000000000000 RBX: 00007f328feea264 RCX: 00007f328fdc4a97 [174957.456131] RDX: 0000000000000000 RSI: 00000000000000 ---truncated---

AI Analysis

Technical Summary

CVE-2022-48833 is a vulnerability in the Linux kernel's Btrfs filesystem implementation related to improper cleanup of reserved space after a log tree writeback failure. The issue arises from recent changes in the kernel that clear the EXTENT_BUFFER_UPTODATE bit and set the EXTENT_BUFFER_WRITE_ERR bit on extent buffers when writeback fails. This leads to a failure in iterating over the log tree during unmount operations because read_extent_buffer_pages() returns an -EIO error when it encounters extent buffers marked with a write error and not uptodate. Consequently, the cleanup process for reserved space in block groups and space_info objects is skipped. This results in reserved space not being freed properly, causing errors during filesystem unmounts, including IO failures and kernel warnings. The vulnerability manifests as error messages and kernel warnings during unmount, potentially leading to resource leakage and filesystem instability. Although the vulnerability does not appear to allow direct code execution or privilege escalation, it can cause denial of service conditions by preventing proper unmounting and cleanup of Btrfs filesystems. The issue affects Linux kernel versions containing the specified commits and is resolved by ensuring proper cleanup of reserved space even after writeback failures. There are no known exploits in the wild, and no CVSS score has been assigned yet.

Potential Impact

For European organizations, especially those relying on Linux servers with Btrfs filesystems, this vulnerability could lead to filesystem instability and denial of service conditions. Systems may experience IO errors and warnings during unmount operations, potentially causing data loss or corruption if unmounts are forced or interrupted improperly. This is particularly critical for environments with high availability requirements or those performing frequent filesystem snapshots and rollbacks using Btrfs. The inability to properly clean reserved space can degrade system performance over time and complicate maintenance operations. Organizations running containerized workloads or virtualized environments on Linux with Btrfs backing storage might face operational disruptions. Although the vulnerability does not directly expose data confidentiality or integrity risks, the availability impact could affect critical infrastructure, data centers, and cloud service providers in Europe that utilize affected Linux kernel versions.

Mitigation Recommendations

1. Apply the latest Linux kernel patches that address this issue as soon as they become available from trusted sources or Linux distributions. 2. Monitor kernel updates from major European Linux distributions (e.g., Debian, Ubuntu, SUSE, Red Hat) and prioritize upgrades in production environments using Btrfs. 3. Implement rigorous filesystem monitoring to detect IO errors or warnings related to Btrfs unmount operations, enabling early detection of the issue. 4. Schedule maintenance windows to perform controlled unmounts and remounts of Btrfs filesystems, minimizing the risk of encountering this error during critical operations. 5. Consider using alternative stable filesystems if immediate patching is not feasible, especially for critical workloads. 6. Backup important data regularly to mitigate potential data loss from forced unmounts or filesystem corruption. 7. Engage with Linux vendor support channels for guidance and best practices tailored to the organization's environment. 8. Avoid abrupt shutdowns or forced unmounts of Btrfs filesystems to reduce the chance of triggering the bug.