CVE-2022-49999

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

btrfs: fix space cache corruption and potential double allocations

When testing space_cache v2 on a large set of machines, we encountered a

few symptoms:

1. "unable to add free space :-17" (EEXIST) errors.

2. Missing free space info items, sometimes caught with a "missing free

space info for X" error.

3. Double-accounted space: ranges that were allocated in the extent tree

and also marked as free in the free space tree, ranges that were

marked as allocated twice in the extent tree, or ranges that were

marked as free twice in the free space tree. If the latter made it

onto disk, the next reboot would hit the BUG_ON() in

add_new_free_space().

4. On some hosts with no on-disk corruption or error messages, the

in-memory space cache (dumped with drgn) disagreed with the free

space tree.

All of these symptoms have the same underlying cause: a race between

caching the free space for a block group a

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References