CVE-2022-48923

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

btrfs: prevent copying too big compressed lzo segment

Compressed length can be corrupted to be a lot larger than memory

we have allocated for buffer.

This will cause memcpy in copy_compressed_segment to write outside

of allocated memory.

This mostly results in stuck read syscall but sometimes when using

btrfs send can get #GP

kernel: general protection fault, probably for non-canonical address 0x841551d5c1000: 0000 [#1] PREEMPT SMP NOPTI

kernel: CPU: 17 PID: 264 Comm: kworker/u256:7 Tainted: P OE 5.17.0-rc2-1 #12

kernel: Workqueue: btrfs-endio btrfs_work_helper [btrfs]

kernel: RIP: 0010:lzo_decompress_bio (./include/linux/fortify-string.h:225 fs/btrfs/lzo.c:322 fs/btrfs/lzo.c:394) btrfs

Code starting with the faulting instruction

===========================================

0:* 48 8b 06 mov (%rsi),%rax <-- trapping instruction

3: 48 8d 79 08

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References