{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2022-48923","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2024-08-21T06:06:23.296Z","datePublished":"2024-08-22T01:32:58.084Z","dateUpdated":"2026-08-05T08:52:55.898Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T08:52:55.898Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: prevent copying too big compressed lzo segment\n\nCompressed length can be corrupted to be a lot larger than memory\nwe have allocated for buffer.\nThis will cause memcpy in copy_compressed_segment to write outside\nof allocated memory.\n\nThis mostly results in stuck read syscall but sometimes when using\nbtrfs send can get #GP\n\n  kernel: general protection fault, probably for non-canonical address 0x841551d5c1000: 0000 [#1] PREEMPT SMP NOPTI\n  kernel: CPU: 17 PID: 264 Comm: kworker/u256:7 Tainted: P           OE     5.17.0-rc2-1 #12\n  kernel: Workqueue: btrfs-endio btrfs_work_helper [btrfs]\n  kernel: RIP: 0010:lzo_decompress_bio (./include/linux/fortify-string.h:225 fs/btrfs/lzo.c:322 fs/btrfs/lzo.c:394) btrfs\n  Code starting with the faulting instruction\n  ===========================================\n     0:*  48 8b 06                mov    (%rsi),%rax              <-- trapping instruction\n     3:   48 8d 79 08             lea    0x8(%rcx),%rdi\n     7:   48 83 e7 f8             and    $0xfffffffffffffff8,%rdi\n     b:   48 89 01                mov    %rax,(%rcx)\n     e:   44 89 f0                mov    %r14d,%eax\n    11:   48 8b 54 06 f8          mov    -0x8(%rsi,%rax,1),%rdx\n  kernel: RSP: 0018:ffffb110812efd50 EFLAGS: 00010212\n  kernel: RAX: 0000000000001000 RBX: 000000009ca264c8 RCX: ffff98996e6d8ff8\n  kernel: RDX: 0000000000000064 RSI: 000841551d5c1000 RDI: ffffffff9500435d\n  kernel: RBP: ffff989a3be856c0 R08: 0000000000000000 R09: 0000000000000000\n  kernel: R10: 0000000000000000 R11: 0000000000001000 R12: ffff98996e6d8000\n  kernel: R13: 0000000000000008 R14: 0000000000001000 R15: 000841551d5c1000\n  kernel: FS:  0000000000000000(0000) GS:ffff98a09d640000(0000) knlGS:0000000000000000\n  kernel: CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  kernel: CR2: 00001e9f984d9ea8 CR3: 000000014971a000 CR4: 00000000003506e0\n  kernel: Call Trace:\n  kernel:  <TASK>\n  kernel: end_compressed_bio_read (fs/btrfs/compression.c:104 fs/btrfs/compression.c:1363 fs/btrfs/compression.c:323) btrfs\n  kernel: end_workqueue_fn (fs/btrfs/disk-io.c:1923) btrfs\n  kernel: btrfs_work_helper (fs/btrfs/async-thread.c:326) btrfs\n  kernel: process_one_work (./arch/x86/include/asm/jump_label.h:27 ./include/linux/jump_label.h:212 ./include/trace/events/workqueue.h:108 kernel/workqueue.c:2312)\n  kernel: worker_thread (./include/linux/list.h:292 kernel/workqueue.c:2455)\n  kernel: ? process_one_work (kernel/workqueue.c:2397)\n  kernel: kthread (kernel/kthread.c:377)\n  kernel: ? kthread_complete_and_exit (kernel/kthread.c:332)\n  kernel: ret_from_fork (arch/x86/entry/entry_64.S:301)\n  kernel:  </TASK>"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The overflow is reached only through local VFS reads of LZO-compressed extents (read → btrfs_submit_compressed_read → end_compressed_bio_read → lzo_decompress_bio → copy_compressed_segment) on a mounted btrfs image, not via any network protocol handler.\nAC:L - A crafted on-disk LZO segment header with an oversized LE32 seg_len deterministically drives memcpy past workspace->cbuf (sized only to lzo1x_worst_compress(PAGE_SIZE)); no race or attacker-uncontrollable layout is required.\nPR:N - The attacker needs no account on the target—only a malicious btrfs image (USB/SD/loop/cloud volume); normal writes cannot plant bad segment lengths, encoded write requires CAP_SYS_ADMIN, and btrfs lacks FS_USERNS_MOUNT so the privileged mount is performed by the victim/automounter.\nUI:R - Exploitation requires a user or automount daemon to mount the attacker-supplied btrfs volume and then read a compressed LZO extent so lzo_decompress_bio runs.\nS:U - Impact is confined to host-kernel heap corruption in the btrfs decompression path within the same OS security authority; there is no VM escape, IOMMU bypass, or other cross-boundary effect.\nC:H - The unbounded heap overflow of workspace->cbuf (and OOB indexing of compressed_pages as cur_in grows) is memory corruption that can be leveraged for kernel information disclosure, so Confidentiality is High.\nI:H - memcpy of attacker-controlled length/content past the allocated cbuf is a classic out-of-bounds write enabling heap corruption and control-flow hijacking primitives, so Integrity is High.\nA:H - The bug produces documented general protection faults in lzo_decompress_bio and stuck reads/hangs, which are full kernel availability impact under CVSS guidance."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/btrfs/lzo.c"],"versions":[{"version":"a6e66e6f8c1b685e11b778bef614480a9c1a5278","lessThan":"8df508b7a44cd8110c726057cd28e8f8116885eb","status":"affected","versionType":"git"},{"version":"a6e66e6f8c1b685e11b778bef614480a9c1a5278","lessThan":"e326bd06cdde46df952361456232022298281d16","status":"affected","versionType":"git"},{"version":"a6e66e6f8c1b685e11b778bef614480a9c1a5278","lessThan":"741b23a970a79d5d3a1db2d64fa2c7b375a4febb","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/btrfs/lzo.c"],"versions":[{"version":"5.15","status":"affected"},{"version":"0","lessThan":"5.15","status":"unaffected","versionType":"semver"},{"version":"5.15.26","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"5.16.12","lessThanOrEqual":"5.16.*","status":"unaffected","versionType":"semver"},{"version":"5.17","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15","versionEndExcluding":"5.15.26"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15","versionEndExcluding":"5.16.12"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15","versionEndExcluding":"5.17"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/8df508b7a44cd8110c726057cd28e8f8116885eb"},{"url":"https://git.kernel.org/stable/c/e326bd06cdde46df952361456232022298281d16"},{"url":"https://git.kernel.org/stable/c/741b23a970a79d5d3a1db2d64fa2c7b375a4febb"}],"title":"btrfs: prevent copying too big compressed lzo segment","x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2022-48923","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2024-09-10T15:33:22.056264Z"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2024-09-12T17:33:00.797Z"}}]}}