« Volver al listado

CVE-2022-49850

Estado: ModificadaMedia (5.5)—

In the Linux kernel, the following vulnerability has been resolved:

nilfs2: fix deadlock in nilfs_count_free_blocks()

A semaphore deadlock can occur if nilfs_get_block() detects metadata corruption while locating data blocks and a superblock writeback occurs at the same time:

Here, nilfs_get_block() readlocks rwsem A (= NILFS_MDT(dat_inode)->mi_sem) and then calls nilfs_bmap_lookup_contig(), but if it fails due to metadata corruption, __nilfs_error() is called from nilfs_bmap_convert_error() inside the lock section.

Since __nilfs_error() calls nilfs_set_error() unless the filesystem is read-only and nilfs_set_error() attempts to writelock rwsem B (= nilfs->ns_sem) to write back superblock exclusively, hierarchical lock acquisition occurs in the order rwsem A -> rwsem B.

Leer descripción completaMostrar menos

Now, if another task starts updating the superblock, it may writelock rwsem B during the lock sequence above, and can deadlock trying to readlock rwsem A in nilfs_count_free_blocks().

However, there is actually no need to take rwsem A in nilfs_count_free_blocks() because it, within the lock section, only reads a single integer data on a shared struct with nilfs_sufile_get_ncleansegs(). This has been the case after commit aa474a220180 ("nilfs2: add local variable to cache the number of clean segments"), that is, even before this bug was introduced.

So, this resolves the deadlock problem by just not taking the semaphore in nilfs_count_free_blocks().

Detalles técnicos trazas, registros y código del informe original
task 1                               task 2
------                               ------
* A file operation *
nilfs_truncate()
  nilfs_get_block()
    down_read(rwsem A) <--
    nilfs_bmap_lookup_contig()
      ...                            generic_shutdown_super()
                                       nilfs_put_super()
                                         * Prepare to write superblock *
                                         down_write(rwsem B) <--
                                         nilfs_cleanup_super()
      * Detect b-tree corruption *         nilfs_set_log_cursor()
      nilfs_bmap_convert_error()             nilfs_count_free_blocks()
        __nilfs_error()                        down_read(rwsem A) <--
          nilfs_set_error()
            down_write(rwsem B) <--

                           *** DEADLOCK ***

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Linux — Linux Kernel

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-49850",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2022-49850",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-10-01T16:11:54.441454Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.5,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 1.8
      },
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.5,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "e828949e5b42bfd234ee537cdb7c5e3a577958a3",
              "lessThan": "3c89ca6d3dfa6c09c515807a7a97a521f5d5147e",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e828949e5b42bfd234ee537cdb7c5e3a577958a3",
              "lessThan": "8b4506cff6630bb474bb46a2a75c31e533a756ba",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e828949e5b42bfd234ee537cdb7c5e3a577958a3",
              "lessThan": "f0cc93080d4c09510b74ecba87fd778cca390bb1",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e828949e5b42bfd234ee537cdb7c5e3a577958a3",
              "lessThan": "36ff974b0310771417c0be64b64aa221bd70d63d",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e828949e5b42bfd234ee537cdb7c5e3a577958a3",
              "lessThan": "1d4ff73062096c21b47954d2996b4df259777bda",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e828949e5b42bfd234ee537cdb7c5e3a577958a3",
              "lessThan": "abc082aac0d9b6b926038fc3adb7008306581be2",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e828949e5b42bfd234ee537cdb7c5e3a577958a3",
              "lessThan": "cb029b54953420f7a2d65100f1c5107f14411bdc",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e828949e5b42bfd234ee537cdb7c5e3a577958a3",
              "lessThan": "8ac932a4921a96ca52f61935dbba64ea87bbd5dc",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "fs/nilfs2/the_nilfs.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.38"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "2.6.38",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "4.9.334",
              "versionType": "semver",
              "lessThanOrEqual": "4.9.*"
            },
            {
              "status": "unaffected",
              "version": "4.14.300",
              "versionType": "semver",
              "lessThanOrEqual": "4.14.*"
            },
            {
              "status": "unaffected",
              "version": "4.19.267",
              "versionType": "semver",
              "lessThanOrEqual": "4.19.*"
            },
            {
              "status": "unaffected",
              "version": "5.4.225",
              "versionType": "semver",
              "lessThanOrEqual": "5.4.*"
            },
            {
              "status": "unaffected",
              "version": "5.10.155",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.79",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.0.9",
              "versionType": "semver",
              "lessThanOrEqual": "6.0.*"
            },
            {
              "status": "unaffected",
              "version": "6.1",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "fs/nilfs2/the_nilfs.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2025-05-01T15:16:08.567",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/1d4ff73062096c21b47954d2996b4df259777bda",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/36ff974b0310771417c0be64b64aa221bd70d63d",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/3c89ca6d3dfa6c09c515807a7a97a521f5d5147e",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/8ac932a4921a96ca52f61935dbba64ea87bbd5dc",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/8b4506cff6630bb474bb46a2a75c31e533a756ba",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/abc082aac0d9b6b926038fc3adb7008306581be2",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/cb029b54953420f7a2d65100f1c5107f14411bdc",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/f0cc93080d4c09510b74ecba87fd778cca390bb1",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-667"
        }
      ]
    },
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-667"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: fix deadlock in nilfs_count_free_blocks()\n\nA semaphore deadlock can occur if nilfs_get_block() detects metadata\ncorruption while locating data blocks and a superblock writeback occurs at\nthe same time:\n\ntask 1                               task 2\n------                               ------\n* A file operation *\nnilfs_truncate()\n  nilfs_get_block()\n    down_read(rwsem A) <--\n    nilfs_bmap_lookup_contig()\n      ...                            generic_shutdown_super()\n                                       nilfs_put_super()\n                                         * Prepare to write superblock *\n                                         down_write(rwsem B) <--\n                                         nilfs_cleanup_super()\n      * Detect b-tree corruption *         nilfs_set_log_cursor()\n      nilfs_bmap_convert_error()             nilfs_count_free_blocks()\n        __nilfs_error()                        down_read(rwsem A) <--\n          nilfs_set_error()\n            down_write(rwsem B) <--\n\n                           *** DEADLOCK ***\n\nHere, nilfs_get_block() readlocks rwsem A (= NILFS_MDT(dat_inode)->mi_sem)\nand then calls nilfs_bmap_lookup_contig(), but if it fails due to metadata\ncorruption, __nilfs_error() is called from nilfs_bmap_convert_error()\ninside the lock section.\n\nSince __nilfs_error() calls nilfs_set_error() unless the filesystem is\nread-only and nilfs_set_error() attempts to writelock rwsem B (=\nnilfs->ns_sem) to write back superblock exclusively, hierarchical lock\nacquisition occurs in the order rwsem A -> rwsem B.\n\nNow, if another task starts updating the superblock, it may writelock\nrwsem B during the lock sequence above, and can deadlock trying to\nreadlock rwsem A in nilfs_count_free_blocks().\n\nHowever, there is actually no need to take rwsem A in\nnilfs_count_free_blocks() because it, within the lock section, only reads\na single integer data on a shared struct with\nnilfs_sufile_get_ncleansegs().  This has been the case after commit\naa474a220180 (\"nilfs2: add local variable to cache the number of clean\nsegments\"), that is, even before this bug was introduced.\n\nSo, this resolves the deadlock problem by just not taking the semaphore in\nnilfs_count_free_blocks()."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: nilfs2: corregir bloqueo en nilfs_count_free_blocks() Un bloqueo de semáforo puede ocurrir si nilfs_get_block() detecta corrupción de metadatos mientras localiza bloques de datos y ocurre una escritura diferida de superbloque al mismo tiempo: tarea 1 tarea 2 ------ ------ * Una operación de archivo * nilfs_truncate() nilfs_get_block() down_read(rwsem A) &lt;-- nilfs_bmap_lookup_contig() ... generic_shutdown_super() nilfs_put_super() * Preparar para escribir superbloque * down_write(rwsem B) &lt;-- nilfs_cleanup_super() * Detectar corrupción de árbol b * nilfs_set_log_cursor() nilfs_bmap_convert_error() nilfs_count_free_blocks() __nilfs_error() down_read(rwsem A) &lt;-- nilfs_set_error() down_write(rwsem B) &lt;-- *** DEADLOCK *** Aquí, nilfs_get_block() vuelve a bloquear rwsem A (= NILFS_MDT(dat_inode)-&gt;mi_sem) y luego llama a nilfs_bmap_lookup_contig(), pero si falla debido a la corrupción de metadatos, se llama a __nilfs_error() desde nilfs_bmap_convert_error() dentro de la sección de bloqueo. Dado que __nilfs_error() llama a nilfs_set_error() a menos que el sistema de archivos sea de solo lectura y nilfs_set_error() intente bloquear la escritura de rwsem B (= nilfs-&gt;ns_sem) para reescribir exclusivamente el superbloque, la adquisición del bloqueo jerárquico se produce en el orden rwsem A -&gt; rwsem B. Ahora bien, si otra tarea comienza a actualizar el superbloque, puede bloquear la escritura de rwsem B durante la secuencia de bloqueo anterior y puede bloquearse al intentar bloquear la lectura de rwsem A en nilfs_count_free_blocks(). Sin embargo, no es necesario tomar rwsem A en nilfs_count_free_blocks() porque, dentro de la sección de bloqueo, solo lee un único dato entero en una estructura compartida con nilfs_sufile_get_ncleansegs(). Esto ha sucedido después del commit aa474a220180 (\"nilfs2: añadir variable local para almacenar en caché el número de segmentos limpios\"), incluso antes de que se introdujera este error. Por lo tanto, esto resuelve el problema de interbloqueo simplemente eliminando el semáforo en nilfs_count_free_blocks()."
    }
  ],
  "lastModified": "2026-06-17T05:19:18.160",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D036C92F-D89C-426E-949E-DCDB2F1458DB",
              "versionEndExcluding": "4.9.334",
              "versionStartIncluding": "2.6.38"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "424802D2-E9E7-48A9-AD6F-DF2227B3D83A",
              "versionEndExcluding": "4.14.300",
              "versionStartIncluding": "4.10"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A5C69A12-68E2-400E-9A5A-375A673C8402",
              "versionEndExcluding": "4.19.267",
              "versionStartIncluding": "4.15"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "94D21814-3051-4860-AB06-C7880A3D4933",
              "versionEndExcluding": "5.4.225",
              "versionStartIncluding": "4.20"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "172AC75C-0949-4468-9C58-64E2893EF0CE",
              "versionEndExcluding": "5.10.155",
              "versionStartIncluding": "5.5"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "39DC45D8-E30E-4F4A-9332-393B7BCF6900",
              "versionEndExcluding": "5.15.79",
              "versionStartIncluding": "5.11"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C3F26709-7D49-4AF0-8145-46CCF4E8E2AD",
              "versionEndExcluding": "6.0.9",
              "versionStartIncluding": "5.16"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E7E331DA-1FB0-4DEC-91AC-7DA69D461C11"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "17F0B248-42CF-4AE6-A469-BB1BAE7F4705"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E2422816-0C14-4B5E-A1E6-A9D776E5C49B"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1C6E00FE-5FB9-4D20-A1A1-5A32128F9B76"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}