CVE-2022-48733

{"id": "CVE-2022-48733", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2024-06-20T12:15:11.700", "references": [{"url": "https://git.kernel.org/stable/c/28b21c558a3753171097193b6f6602a94169093a", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/7e4c72dbaf62f8978af8321a24dbd35566d3a78a", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/9372fa1d73da5f1673921e365d0cd2c27ec7adc2", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/a7b717fa15165d3d9245614680bebc48a52ac05d", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-416"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix use-after-free after failure to create a snapshot\n\nAt ioctl.c:create_snapshot(), we allocate a pending snapshot structure and\nthen attach it to the transaction's list of pending snapshots. After that\nwe call btrfs_commit_transaction(), and if that returns an error we jump\nto 'fail' label, where we kfree() the pending snapshot structure. This can\nresult in a later use-after-free of the pending snapshot:\n\n1) We allocated the pending snapshot and added it to the transaction's\n list of pending snapshots;\n\n2) We call btrfs_commit_transaction(), and it fails either at the first\n call to btrfs_run_delayed_refs() or btrfs_start_dirty_block_groups().\n In both cases, we don't abort the transaction and we release our\n transaction handle. We jump to the 'fail' label and free the pending\n snapshot structure. We return with the pending snapshot still in the\n transaction's list;\n\n3) Another task commits the transaction. This time there's no error at\n all, and then during the transaction commit it accesses a pointer\n to the pending snapshot structure that the snapshot creation task\n has already freed, resulting in a user-after-free.\n\nThis issue could actually be detected by smatch, which produced the\nfollowing warning:\n\n fs/btrfs/ioctl.c:843 create_snapshot() warn: '&pending_snapshot->list' not removed from list\n\nSo fix this by not having the snapshot creation ioctl directly add the\npending snapshot to the transaction's list. Instead add the pending\nsnapshot to the transaction handle, and then at btrfs_commit_transaction()\nwe add the snapshot to the list only when we can guarantee that any error\nreturned after that point will result in a transaction abort, in which\ncase the ioctl code can safely free the pending snapshot and no one can\naccess it anymore."}, {"lang": "es", "value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: btrfs: corrige el use-after-free despu\u00e9s de una falla al crear una instant\u00e1nea En ioctl.c:create_snapshot(), asignamos una estructura de instant\u00e1nea pendiente y luego la adjuntamos a la lista de transacciones de instant\u00e1neas pendientes. Despu\u00e9s de eso, llamamos a btrfs_commit_transaction(), y si eso devuelve un error, saltamos a la etiqueta 'falla', donde liberamos() la estructura de instant\u00e1nea pendiente. Esto puede resultar en un uso posterior despu\u00e9s de la liberaci\u00f3n de la instant\u00e1nea pendiente: 1) Asignamos la instant\u00e1nea pendiente y la agregamos a la lista de instant\u00e1neas pendientes de la transacci\u00f3n; 2) Llamamos a btrfs_commit_transaction(), y falla en la primera llamada a btrfs_run_delayed_refs() o btrfs_start_dirty_block_groups(). En ambos casos, no abortamos la transacci\u00f3n y liberamos nuestro identificador de transacci\u00f3n. Saltamos a la etiqueta 'fallo' y liberamos la estructura de instant\u00e1nea pendiente. Regresamos con la instant\u00e1nea pendiente todav\u00eda en la lista de transacciones; 3) Otra tarea confirma la transacci\u00f3n. Esta vez no hay ning\u00fan error y luego, durante la confirmaci\u00f3n de la transacci\u00f3n, accede a un puntero a la estructura de instant\u00e1nea pendiente que la tarea de creaci\u00f3n de instant\u00e1nea ya ha liberado, lo que resulta en una liberaci\u00f3n de usuario. En realidad, este problema podr\u00eda ser detectado por smatch, que produjo la siguiente advertencia: fs/btrfs/ioctl.c:843 create_snapshot() advertencia: '&pending_snapshot->list' no se elimina de la lista. As\u00ed que solucione este problema al no tener el ioctl de creaci\u00f3n de instant\u00e1neas directamente agregue la instant\u00e1nea pendiente a la lista de transacciones. En su lugar, agregue la instant\u00e1nea pendiente al identificador de la transacci\u00f3n, y luego en btrfs_commit_transaction() agregamos la instant\u00e1nea a la lista solo cuando podamos garantizar que cualquier error devuelto despu\u00e9s de ese punto resultar\u00e1 en la cancelaci\u00f3n de la transacci\u00f3n, en cuyo caso el c\u00f3digo ioctl puede Libera la instant\u00e1nea pendiente y ya nadie podr\u00e1 acceder a ella."}], "lastModified": "2024-09-12T12:15:46.847", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "175866EA-083C-4008-AE58-694B60CFDCC1", "versionEndExcluding": "5.15.22"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0623892A-E3E4-44E6-8A5E-39A0B47AF782", "versionEndExcluding": "5.16.8", "versionStartIncluding": "5.16"}], "operator": "OR"}]}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}