CVE-2022-50456 (GCVE-0-2022-50456)

Vulnerability from cvelistv5 – Published: 2025-10-01 11:45 – Updated: 2025-12-23 13:29
VLAI?
Title
btrfs: fix resolving backrefs for inline extent followed by prealloc
Summary
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix resolving backrefs for inline extent followed by prealloc If a file consists of an inline extent followed by a regular or prealloc extent, then a legitimate attempt to resolve a logical address in the non-inline region will result in add_all_parents reading the invalid offset field of the inline extent. If the inline extent item is placed in the leaf eb s.t. it is the first item, attempting to access the offset field will not only be meaningless, it will go past the end of the eb and cause this panic: [17.626048] BTRFS warning (device dm-2): bad eb member end: ptr 0x3fd4 start 30834688 member offset 16377 size 8 [17.631693] general protection fault, probably for non-canonical address 0x5088000000000: 0000 [#1] SMP PTI [17.635041] CPU: 2 PID: 1267 Comm: btrfs Not tainted 5.12.0-07246-g75175d5adc74-dirty #199 [17.637969] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 [17.641995] RIP: 0010:btrfs_get_64+0xe7/0x110 [17.649890] RSP: 0018:ffffc90001f73a08 EFLAGS: 00010202 [17.651652] RAX: 0000000000000001 RBX: ffff88810c42d000 RCX: 0000000000000000 [17.653921] RDX: 0005088000000000 RSI: ffffc90001f73a0f RDI: 0000000000000001 [17.656174] RBP: 0000000000000ff9 R08: 0000000000000007 R09: c0000000fffeffff [17.658441] R10: ffffc90001f73790 R11: ffffc90001f73788 R12: ffff888106afe918 [17.661070] R13: 0000000000003fd4 R14: 0000000000003f6f R15: cdcdcdcdcdcdcdcd [17.663617] FS: 00007f64e7627d80(0000) GS:ffff888237c80000(0000) knlGS:0000000000000000 [17.666525] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [17.668664] CR2: 000055d4a39152e8 CR3: 000000010c596002 CR4: 0000000000770ee0 [17.671253] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [17.673634] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [17.676034] PKRU: 55555554 [17.677004] Call Trace: [17.677877] add_all_parents+0x276/0x480 [17.679325] find_parent_nodes+0xfae/0x1590 [17.680771] btrfs_find_all_leafs+0x5e/0xa0 [17.682217] iterate_extent_inodes+0xce/0x260 [17.683809] ? btrfs_inode_flags_to_xflags+0x50/0x50 [17.685597] ? iterate_inodes_from_logical+0xa1/0xd0 [17.687404] iterate_inodes_from_logical+0xa1/0xd0 [17.689121] ? btrfs_inode_flags_to_xflags+0x50/0x50 [17.691010] btrfs_ioctl_logical_to_ino+0x131/0x190 [17.692946] btrfs_ioctl+0x104a/0x2f60 [17.694384] ? selinux_file_ioctl+0x182/0x220 [17.695995] ? __x64_sys_ioctl+0x84/0xc0 [17.697394] __x64_sys_ioctl+0x84/0xc0 [17.698697] do_syscall_64+0x33/0x40 [17.700017] entry_SYSCALL_64_after_hwframe+0x44/0xae [17.701753] RIP: 0033:0x7f64e72761b7 [17.709355] RSP: 002b:00007ffefb067f58 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [17.712088] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f64e72761b7 [17.714667] RDX: 00007ffefb067fb0 RSI: 00000000c0389424 RDI: 0000000000000003 [17.717386] RBP: 00007ffefb06d188 R08: 000055d4a390d2b0 R09: 00007f64e7340a60 [17.719938] R10: 0000000000000231 R11: 0000000000000246 R12: 0000000000000001 [17.722383] R13: 0000000000000000 R14: 00000000c0389424 R15: 000055d4a38fd2a0 [17.724839] Modules linked in: Fix the bug by detecting the inline extent item in add_all_parents and skipping to the next extent item.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 8da6d5815c592b713ecaf4f4f8b631f8359c96c4 , < c59ee1528b3432ec9dca220567f7eb507820917a (git)
Affected: 8da6d5815c592b713ecaf4f4f8b631f8359c96c4 , < 0061ab5153fb8bc574b44fbb773680d0ede48c9c (git)
Affected: 8da6d5815c592b713ecaf4f4f8b631f8359c96c4 , < 99590f29b2b7567fda2b503aa3d81a0d3e09dce5 (git)
Affected: 8da6d5815c592b713ecaf4f4f8b631f8359c96c4 , < 645e2dac6e97f756f28a2f82b2e7bf7f29a68827 (git)
Affected: 8da6d5815c592b713ecaf4f4f8b631f8359c96c4 , < a94b90ac1f251d1007c0c43ee289a61b50f2505f (git)
Affected: 8da6d5815c592b713ecaf4f4f8b631f8359c96c4 , < 560840afc3e63bbe5d9c5ef6b2ecf8f3589adff6 (git)
Create a notification for this product.
    Linux Linux Affected: 3.3
Unaffected: 0 , < 3.3 (semver)
Unaffected: 5.4.229 , ≤ 5.4.* (semver)
Unaffected: 5.10.163 , ≤ 5.10.* (semver)
Unaffected: 5.15.87 , ≤ 5.15.* (semver)
Unaffected: 6.0.18 , ≤ 6.0.* (semver)
Unaffected: 6.1.4 , ≤ 6.1.* (semver)
Unaffected: 6.2 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/btrfs/backref.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c59ee1528b3432ec9dca220567f7eb507820917a",
              "status": "affected",
              "version": "8da6d5815c592b713ecaf4f4f8b631f8359c96c4",
              "versionType": "git"
            },
            {
              "lessThan": "0061ab5153fb8bc574b44fbb773680d0ede48c9c",
              "status": "affected",
              "version": "8da6d5815c592b713ecaf4f4f8b631f8359c96c4",
              "versionType": "git"
            },
            {
              "lessThan": "99590f29b2b7567fda2b503aa3d81a0d3e09dce5",
              "status": "affected",
              "version": "8da6d5815c592b713ecaf4f4f8b631f8359c96c4",
              "versionType": "git"
            },
            {
              "lessThan": "645e2dac6e97f756f28a2f82b2e7bf7f29a68827",
              "status": "affected",
              "version": "8da6d5815c592b713ecaf4f4f8b631f8359c96c4",
              "versionType": "git"
            },
            {
              "lessThan": "a94b90ac1f251d1007c0c43ee289a61b50f2505f",
              "status": "affected",
              "version": "8da6d5815c592b713ecaf4f4f8b631f8359c96c4",
              "versionType": "git"
            },
            {
              "lessThan": "560840afc3e63bbe5d9c5ef6b2ecf8f3589adff6",
              "status": "affected",
              "version": "8da6d5815c592b713ecaf4f4f8b631f8359c96c4",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/btrfs/backref.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.3"
            },
            {
              "lessThan": "3.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.229",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.163",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.87",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.0.*",
              "status": "unaffected",
              "version": "6.0.18",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.229",
                  "versionStartIncluding": "3.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.163",
                  "versionStartIncluding": "3.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.87",
                  "versionStartIncluding": "3.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0.18",
                  "versionStartIncluding": "3.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.4",
                  "versionStartIncluding": "3.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.2",
                  "versionStartIncluding": "3.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix resolving backrefs for inline extent followed by prealloc\n\nIf a file consists of an inline extent followed by a regular or prealloc\nextent, then a legitimate attempt to resolve a logical address in the\nnon-inline region will result in add_all_parents reading the invalid\noffset field of the inline extent. If the inline extent item is placed\nin the leaf eb s.t. it is the first item, attempting to access the\noffset field will not only be meaningless, it will go past the end of\nthe eb and cause this panic:\n\n  [17.626048] BTRFS warning (device dm-2): bad eb member end: ptr 0x3fd4 start 30834688 member offset 16377 size 8\n  [17.631693] general protection fault, probably for non-canonical address 0x5088000000000: 0000 [#1] SMP PTI\n  [17.635041] CPU: 2 PID: 1267 Comm: btrfs Not tainted 5.12.0-07246-g75175d5adc74-dirty #199\n  [17.637969] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014\n  [17.641995] RIP: 0010:btrfs_get_64+0xe7/0x110\n  [17.649890] RSP: 0018:ffffc90001f73a08 EFLAGS: 00010202\n  [17.651652] RAX: 0000000000000001 RBX: ffff88810c42d000 RCX: 0000000000000000\n  [17.653921] RDX: 0005088000000000 RSI: ffffc90001f73a0f RDI: 0000000000000001\n  [17.656174] RBP: 0000000000000ff9 R08: 0000000000000007 R09: c0000000fffeffff\n  [17.658441] R10: ffffc90001f73790 R11: ffffc90001f73788 R12: ffff888106afe918\n  [17.661070] R13: 0000000000003fd4 R14: 0000000000003f6f R15: cdcdcdcdcdcdcdcd\n  [17.663617] FS:  00007f64e7627d80(0000) GS:ffff888237c80000(0000) knlGS:0000000000000000\n  [17.666525] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  [17.668664] CR2: 000055d4a39152e8 CR3: 000000010c596002 CR4: 0000000000770ee0\n  [17.671253] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n  [17.673634] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n  [17.676034] PKRU: 55555554\n  [17.677004] Call Trace:\n  [17.677877]  add_all_parents+0x276/0x480\n  [17.679325]  find_parent_nodes+0xfae/0x1590\n  [17.680771]  btrfs_find_all_leafs+0x5e/0xa0\n  [17.682217]  iterate_extent_inodes+0xce/0x260\n  [17.683809]  ? btrfs_inode_flags_to_xflags+0x50/0x50\n  [17.685597]  ? iterate_inodes_from_logical+0xa1/0xd0\n  [17.687404]  iterate_inodes_from_logical+0xa1/0xd0\n  [17.689121]  ? btrfs_inode_flags_to_xflags+0x50/0x50\n  [17.691010]  btrfs_ioctl_logical_to_ino+0x131/0x190\n  [17.692946]  btrfs_ioctl+0x104a/0x2f60\n  [17.694384]  ? selinux_file_ioctl+0x182/0x220\n  [17.695995]  ? __x64_sys_ioctl+0x84/0xc0\n  [17.697394]  __x64_sys_ioctl+0x84/0xc0\n  [17.698697]  do_syscall_64+0x33/0x40\n  [17.700017]  entry_SYSCALL_64_after_hwframe+0x44/0xae\n  [17.701753] RIP: 0033:0x7f64e72761b7\n  [17.709355] RSP: 002b:00007ffefb067f58 EFLAGS: 00000246 ORIG_RAX: 0000000000000010\n  [17.712088] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f64e72761b7\n  [17.714667] RDX: 00007ffefb067fb0 RSI: 00000000c0389424 RDI: 0000000000000003\n  [17.717386] RBP: 00007ffefb06d188 R08: 000055d4a390d2b0 R09: 00007f64e7340a60\n  [17.719938] R10: 0000000000000231 R11: 0000000000000246 R12: 0000000000000001\n  [17.722383] R13: 0000000000000000 R14: 00000000c0389424 R15: 000055d4a38fd2a0\n  [17.724839] Modules linked in:\n\nFix the bug by detecting the inline extent item in add_all_parents and\nskipping to the next extent item."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-12-23T13:29:29.725Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c59ee1528b3432ec9dca220567f7eb507820917a"
        },
        {
          "url": "https://git.kernel.org/stable/c/0061ab5153fb8bc574b44fbb773680d0ede48c9c"
        },
        {
          "url": "https://git.kernel.org/stable/c/99590f29b2b7567fda2b503aa3d81a0d3e09dce5"
        },
        {
          "url": "https://git.kernel.org/stable/c/645e2dac6e97f756f28a2f82b2e7bf7f29a68827"
        },
        {
          "url": "https://git.kernel.org/stable/c/a94b90ac1f251d1007c0c43ee289a61b50f2505f"
        },
        {
          "url": "https://git.kernel.org/stable/c/560840afc3e63bbe5d9c5ef6b2ecf8f3589adff6"
        }
      ],
      "title": "btrfs: fix resolving backrefs for inline extent followed by prealloc",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-50456",
    "datePublished": "2025-10-01T11:45:29.587Z",
    "dateReserved": "2025-10-01T11:38:45.640Z",
    "dateUpdated": "2025-12-23T13:29:29.725Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.