CVE-2022-49079: In the Linux kernel, the following vulnerability has been resolved: btrfs: zoned: traverse devices under chunk_mutex in btrfs_can_activate_zone…

PriorityP421medium5.5CVSS 3.1

AVLACLPRLUINSUCNINAH

EPSS

0.18%

7.9th percentile

In the Linux kernel, the following vulnerability has been resolved: btrfs: zoned: traverse devices under chunk_mutex in btrfs_can_activate_zone btrfs_can_activate_zone() can be called with the device_list_mutex already held, which will lead to a deadlock: insert_dev_extents() // Takes device_list_mutex `-> insert_dev_extent() `-> btrfs_insert_empty_item() `-> btrfs_insert_empty_items() `-> btrfs_search_slot() `-> btrfs_cow_block() `-> __btrfs_cow_block() `-> btrfs_alloc_tree_block() `-> btrfs_reserve_extent() `-> find_free_extent() `-> find_free_extent_update_loop() `-> can_allocate_chunk() `-> btrfs_can_activate_zone() // Takes device_list_mutex again Instead of using the RCU on fs_devices->device_list we can use fs_devices->alloc_list, protected by the chunk_mutex to traverse the list of active devices. We are in the chunk allocation thread. The newer chunk allocation happens from the devices in the fs_device->alloc_list protected by the chunk_mutex. btrfs_create_chunk() lockdep_assert_held(&info->chunk_mutex); gather_device_info list_for_each_entry(device, &fs_devices->alloc_list, dev_alloc_list) Also, a device that reappears after the mount won't join the alloc_list yet and, it will be in the dev_list, which we don't want to consider in the context of the chunk alloc. [15.166572] WARNING: possible recursive locking detected [15.167117] 5.17.0-rc6-dennis #79 Not tainted [15.167487] -------------------------------------------- [15.167733] kworker/u8:3/146 is trying to acquire lock: [15.167733] ffff888102962ee0 (&fs_devs->device_list_mutex){+.+.}-{3:3}, at: find_free_extent+0x15a/0x14f0 [btrfs] [15.167733] [15.167733] but task is already holding lock: [15.167733] ffff888102962ee0 (&fs_devs->device_list_mutex){+.+.}-{3:3}, at: btrfs_create_pending_block_groups+0x20a/0x560 [btrfs] [15.167733] [15.167733] other info that might help us debug this: [15.167733] Possible unsafe locking scenario: [15.167733] [15.171834] CPU0 [15.171834] ---- [15.171834] lock(&fs_de

Affected

11 ranges

Vendor	Product	Version range	Fixed in
debian	linux	< linux 5.17.3-1 (bookworm)	linux 5.17.3-1 (bookworm)
linux	linux	—	—
linux	linux	>= a85f05e59bc15a83ad910dbcb71df5ad8fa77295 < 09e65ae515af2b24d6dc23af21719a3b41de83e5	09e65ae515af2b24d6dc23af21719a3b41de83e5
linux	linux	>= a85f05e59bc15a83ad910dbcb71df5ad8fa77295 < 142f822bd945a7be442a2916ec6167cc102c4183	142f822bd945a7be442a2916ec6167cc102c4183
linux	linux	>= a85f05e59bc15a83ad910dbcb71df5ad8fa77295 < 0b9e66762aa0cda2a9c2d5542d64e04dac528fa6	0b9e66762aa0cda2a9c2d5542d64e04dac528fa6
linux	linux_kernel	—	—
linux	linux_kernel	>= 0 < 5.17.3-1	5.17.3-1
linux	linux_kernel	>= 0 < 5.17.3-1	5.17.3-1
linux	linux_kernel	>= 0 < 5.17.3-1	5.17.3-1
linux	linux_kernel	>= 5.16 < 5.16.20	5.16.20
linux	linux_kernel	>= 5.17 < 5.17.3	5.17.3

CVSS provenance

nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

osv5.5MEDIUM

vendor_debian5.5MEDIUM

vendor_redhat5.5MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.