CVE-2022-49849

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-49849
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix match incorrectly in dev_args_match_device syzkaller found a failed assertion: assertion failed: (args->devid != (u64)-1) || args->missing, in fs/btrfs/volumes.c:6921 This can be triggered when we set devid to (u64)-1 by ioctl. In this case, the match of devid will be skipped and the match of device may succeed incorrectly. Patch 562d7b1512f7 introduced this function which is used to match device. This function contains two matching scenarios, we can distinguish them by checking the value of args->missing rather than check whether args->devid and args->uuid is default value.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/0fca385d6ebc3cabb20f67bcf8a71f1448bdc001 Patch
https://git.kernel.org/stable/c/bc6c127c377010f136360552ebf91c2723081c1b Patch
https://git.kernel.org/stable/c/c9fe4719c662e0af17eea723cf345e37719fd3c9 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc4:*:*:*:*:*:*
History

10 Nov 2025, 21:02

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
CPE cpe:2.3:o:linux:linux_kernel:6.1:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc3:*:*:*:*:*:*
First Time Linux
Linux linux Kernel
References () https://git.kernel.org/stable/c/0fca385d6ebc3cabb20f67bcf8a71f1448bdc001 - () https://git.kernel.org/stable/c/0fca385d6ebc3cabb20f67bcf8a71f1448bdc001 - Patch
References () https://git.kernel.org/stable/c/bc6c127c377010f136360552ebf91c2723081c1b - () https://git.kernel.org/stable/c/bc6c127c377010f136360552ebf91c2723081c1b - Patch
References () https://git.kernel.org/stable/c/c9fe4719c662e0af17eea723cf345e37719fd3c9 - () https://git.kernel.org/stable/c/c9fe4719c662e0af17eea723cf345e37719fd3c9 - Patch
CWE NVD-CWE-noinfo

02 May 2025, 13:53

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: btrfs: corrección de coincidencia incorrecta en dev_args_match_device syzkaller encontró una aserción fallida: assertion failed: (args->devid != (u64)-1) || args->missing, en fs/btrfs/volumes.c:6921 Esto puede activarse cuando configuramos devid en (u64)-1 mediante ioctl. En este caso, se omitirá la coincidencia de devid y la coincidencia de dispositivo puede tener éxito incorrectamente. El parche 562d7b1512f7 introdujo esta función que se utiliza para hacer coincidir dispositivos. Esta función contiene dos escenarios de coincidencia; podemos distinguirlos comprobando el valor de args->missing en lugar de comprobar si args->devid y args->uuid son los valores predeterminados.

01 May 2025, 15:16

Type Values Removed Values Added
New CVE
Information

Published : 2025-05-01 15:16

Updated : 2025-11-10 21:02

NVD link : CVE-2022-49849

Mitre link : CVE-2022-49849

CVE.ORG link : CVE-2022-49849

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
NVD-CWE-noinfo