CVE-2022-48733

What it actually does

Use-after-free in btrfs snapshot creation: pending_snapshot struct is freed on btrfs_commit_transaction failure but remains on the transaction list, allowing subsequent commit to dereference the freed pointer.

Why it matters to the business

Linux systems using Btrfs may experience kernel crashes, memory corruption, or potential code execution leading to system downtime or full compromise; widespread in distributions and cloud images increases exposure risk.

How an attack unfolds

An attacker issues a Btrfs snapshot ioctl that triggers a transaction commit failure, causing the pending snapshot to be freed while still referenced; a follow-on transaction commit then accesses the dangling pointer, resulting in use-after-free that can be chained into kernel exploitation for privilege escalation.

How to fix it

Update the Linux kernel to a version containing commit 7e4c72dbaf62f8978af8321a24dbd35566d3a78a or later; rebuild and reboot with the patched kernel; avoid Btrfs snapshots on unpatched systems until updated.

How to confirm the fix worked

Verify kernel source contains the fix removing direct list addition of pending_snapshot; confirm no 'warn: '&pending_snapshot->list' not removed from list' smatch warning; test snapshot creation under injected commit failures.

Typical attack path

1. Issue Btrfs snapshot creation via ioctl
2. Force or induce btrfs_commit_transaction failure
3. Trigger second transaction commit from another process
4. Trigger dereference of freed pending_snapshot structure
5. Leverage UAF for memory corruption or code execution

How to detect it

Search kernel logs and dmesg for Btrfs transaction commit failures followed by use-after-free warnings or oops involving pending_snapshot or list operations; review audit logs for frequent snapshot ioctl calls preceding crashes.

What your security team should do

• Prioritize kernel upgrades containing the referenced commit across all Btrfs-using systems
• Monitor for Btrfs-related kernel panics or warnings in dmesg
• Restrict unprivileged snapshot creation until patched
• Review downstream kernel packages for backports of the fix