From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E799D1A38E4 for ; Thu, 1 May 2025 14:15:07 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1746108908; cv=none; b=LX6scMIKyLRHx5jKKWYBHlPtGSEy/dYVMorOMv9oo1QlaaBGZRpv2mNYw1emUrv6l78O/GZ+L/bgfAc8MShbwCqTBQxY6UFSjdbB+C2rUW0QOk25UWVrhT/Sx8E4thuEpmSfT1oeLto3cMygRHrZ1fVSp+q+Lh7ATcY1kDXz62k= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1746108908; c=relaxed/simple; bh=0HGtAH8s9AtPGp86L2iY0P15GiIDvYVZTkMu7NkKOe0=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=BdKvEMcHHTuRvG/GodyPUSyWTSCzWRUbK8T3GegrDDikaj/FkAV3PD1AoRGNSKpWHq2skNTUKBiN379YF1rG26q9ZmE7UiCXbqEcorihggM3ZnRjK0Gt1N2WLtz5AofMjE3K3HBZKWm72ChRYt762YSTtim3cM+TBZ+YKR3b8Sg= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=yS4kdAGn; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="yS4kdAGn" Received: by smtp.kernel.org (Postfix) with ESMTPSA id EC2EDC4CEE3; Thu, 1 May 2025 14:15:06 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1746108907; bh=0HGtAH8s9AtPGp86L2iY0P15GiIDvYVZTkMu7NkKOe0=; h=From:To:Cc:Subject:Date:Reply-to:From; b=yS4kdAGnnb858X0drI3JTV3fVpHhXlXhRB/vyrC4OWpIXruE9fOqs72uqVyRQ2By3 Gdy0L4KexAwFHgq7hsCd18gaC5VhIRVhCo0y/lYY7x5+axvYtbzX7AX2VqOzUEtGZY tXaCTZyjcFZAlU9Omr9OzUKwnJ2fLoYvRWu4p93A= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2022-49849: btrfs: fix match incorrectly in dev_args_match_device Date: Thu, 1 May 2025 16:10:39 +0200 Message-ID: <2025050143-CVE-2022-49849-e2cc@gregkh> X-Mailer: git-send-email 2.49.0 Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Reply-to: , X-Developer-Signature: v=1; a=openpgp-sha256; l=2539; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=akX2fkq8mDfkxHBvGoUeN1xbaK1FX4CFNMsgNo7fVTE=; b=owGbwMvMwCRo6H6F97bub03G02pJDBnCDcv1VTL5ezYGfePTFb3Bdmr56fQ/erMnibNUcX9fL jCvv9+pI5aFQZCJQVZMkeXLNp6j+ysOKXoZ2p6GmcPKBDKEgYtTACbyWZphrqyq30rnnRJ2fcdf 7nNrcL06/5E6M8OCm9Pr4tyby7fWvK/0Tarf4LPD8vlrAA== X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: btrfs: fix match incorrectly in dev_args_match_device syzkaller found a failed assertion: assertion failed: (args->devid != (u64)-1) || args->missing, in fs/btrfs/volumes.c:6921 This can be triggered when we set devid to (u64)-1 by ioctl. In this case, the match of devid will be skipped and the match of device may succeed incorrectly. Patch 562d7b1512f7 introduced this function which is used to match device. This function contains two matching scenarios, we can distinguish them by checking the value of args->missing rather than check whether args->devid and args->uuid is default value. The Linux kernel CVE team has assigned CVE-2022-49849 to this issue. Affected and fixed versions =========================== Issue introduced in 5.15.54 with commit 5578b681fbf2b22d61189a2539efd3009518b328 and fixed in 5.15.79 with commit c9fe4719c662e0af17eea723cf345e37719fd3c9 Issue introduced in 5.16 with commit 562d7b1512f7369a19bca2883e2e8672d78f0481 and fixed in 6.0.9 with commit bc6c127c377010f136360552ebf91c2723081c1b Issue introduced in 5.16 with commit 562d7b1512f7369a19bca2883e2e8672d78f0481 and fixed in 6.1 with commit 0fca385d6ebc3cabb20f67bcf8a71f1448bdc001 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2022-49849 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: fs/btrfs/volumes.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/c9fe4719c662e0af17eea723cf345e37719fd3c9 https://git.kernel.org/stable/c/bc6c127c377010f136360552ebf91c2723081c1b https://git.kernel.org/stable/c/0fca385d6ebc3cabb20f67bcf8a71f1448bdc001