Linux Distros 未修補的弱點：CVE-2022-50571
high Nessus Plugin ID 271578
語言:
概要
Linux/Unix 主機上安裝的一個或多個套件存有弱點，供應商表示將不會修補。說明
Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且供應商未提供可用的修補程式。- btrfs在快取載入失敗時呼叫 __btrfs_remove_free_space_cache_locked 現在 lockdep 會在整個 CI 執行期間保持啟用 我在 generic/475 中開始看到下列堆疊 ------------[在此處截取 ]---- -------- 警告 CPU: 1 PID: 2171864 at fs/btrfs/discard.c:604 btrfs_discard_update_discardable+0x98/0xb0 CPU: 1 PID: 2171864 Comm: kworker/u4:0 未受污染 5.19.0- rc8+ #789 硬體名稱QEMU Standard PC (Q35 + ICH9, 2009)BIOS 1.13.0-2.fc32 04/01/2014 工作佇列btrfs-cache btrfs_work_helper RIP0010btrfs_discard_update_discardable+0x98/0xb0 RSP0018 ffffb857c2f7bad0 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff8c85c605c200 RCX: 0000000000000001 RDX: 0000000000000000 RSI: ffffffff86807c5b RDI: ffffffff868a831e RBP: ffff8c85c4c54000 R08: 0000000000000000 R09:
0000000000000000 R10ffff8c85c66932f0 R110000000000000001 R12ffff8c85c3899010 R13ffff8c85d5be4f40 R14ffff8c85c4c54000 R15: ffff8c86114bfa80 FS: 0000000000000000(0000) GS:ffff8c863bd00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f2e7f168160 CR3:
000000010289a004 CR40000000000370ee0 呼叫追踪 __btrfs_remove_free_space_cache+0x27/0x30 load_free_space_cache+0xad2/0xaf0 caching_thread+0x40b/0x650 lock_release+0x137/0x2d0 btrfs_work_helper+0xf2/0x3e0 lock_is_held_type+0xe2/0x140 process_one_work+0x271/0x590 ? process_one_work+0x590/0x590 worker_thread+0x52/0x3b0 ? process_one_work+0x590/0x590 kthread+0xf0/0x120 ? kthread_complete_and_exit+0x20/0x20 ret_from_fork+0x1f/0x30 這是程式碼 ctl = block_group->free_space_ctl; disk_ctl = &block_group->fs_info->discard_ctl
lockdep_assert_held(&ctl->tree_lock);我們有一個暫時可用空間 ctl 可用來載入可用空間快取以避免在我們載入快取時發生配置。當我們遇到錯誤時會予以釋放不過這也會呼叫 btrfs_discard_update_discardable其需要保留 block_group->free_space_ctl->tree_lock。不過這是我們的暫時 ctl因此不會保留此鎖定。藉由呼叫 __btrfs_remove_free_space_cache_locked 來修正此問題我們只會清理項目而不會混淆可捨棄的統計資料。 (CVE-2022-50571)
請注意，Nessus 依賴供應商報告的套件存在。
解決方案
目前尚未有已知的解決方案。另請參閱
Plugin 詳細資訊
嚴重性: High
ID: 271578
檔案名稱: unpatched_CVE_2022_50571.nasl
版本: 1.1
類型: local
代理程式: unix
系列: Misc.
已發布: 2025/10/27
已更新: 2025/10/27
支援的感應器: Frictionless Assessment AWS, Frictionless Assessment Azure, Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Nessus
風險資訊
VPR
風險因素: High
分數: 7.4
CVSS v2
風險因素: Medium
基本分數: 6.1
時間性分數: 5.2
媒介: CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:C
CVSS 評分資料來源: CVE-2022-50571
CVSS v3
風險因素: High
基本分數: 7.8
時間性分數: 7.1
媒介: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
時間媒介: CVSS:3.0/E:U/RL:U/RC:C
弱點資訊
CPE: p-cpe:/a:redhat:enterprise_linux:kernel-debug-devel, p-cpe:/a:centos:centos:kernel-headers, p-cpe:/a:redhat:enterprise_linux:kernel-debug, cpe:/o:debian:debian_linux:11.0, p-cpe:/a:redhat:enterprise_linux:bpftool, p-cpe:/a:centos:centos:bpftool, p-cpe:/a:centos:centos:python-perf, p-cpe:/a:centos:centos:kernel-rt-devel, p-cpe:/a:redhat:enterprise_linux:kernel-rt-debug, p-cpe:/a:redhat:enterprise_linux:kernel-tools, p-cpe:/a:centos:centos:kernel-kdump, p-cpe:/a:centos:centos:kernel-kdump-devel, cpe:/o:centos:centos:7, p-cpe:/a:debian:debian_linux:linux, p-cpe:/a:centos:centos:kernel-doc, p-cpe:/a:centos:centos:kernel-tools-libs, p-cpe:/a:centos:centos:kernel-rt-debug-kvm, p-cpe:/a:redhat:enterprise_linux:kernel, p-cpe:/a:centos:centos:kernel-rt-debug-devel, p-cpe:/a:redhat:enterprise_linux:kernel-rt-trace-devel, p-cpe:/a:redhat:enterprise_linux:kernel-rt-doc, p-cpe:/a:redhat:enterprise_linux:perf, p-cpe:/a:centos:centos:kernel-tools, p-cpe:/a:redhat:enterprise_linux:python-perf, p-cpe:/a:redhat:enterprise_linux:kernel-kdump, p-cpe:/a:redhat:enterprise_linux:kernel-abi-whitelists, p-cpe:/a:centos:centos:kernel-rt-debug, p-cpe:/a:redhat:enterprise_linux:kernel-rt, p-cpe:/a:redhat:enterprise_linux:kernel-rt-debug-devel, p-cpe:/a:centos:centos:kernel-rt-doc, p-cpe:/a:redhat:enterprise_linux:kernel-devel, p-cpe:/a:centos:centos:kernel-rt-kvm, p-cpe:/a:centos:centos:kernel-debug-devel, p-cpe:/a:redhat:enterprise_linux:kernel-rt-debug-kvm, p-cpe:/a:redhat:enterprise_linux:kernel-tools-libs, cpe:/o:redhat:enterprise_linux:7, p-cpe:/a:redhat:enterprise_linux:kernel-tools-libs-devel, p-cpe:/a:centos:centos:kernel-rt-trace-kvm, p-cpe:/a:centos:centos:kernel-devel, p-cpe:/a:centos:centos:kernel-tools-libs-devel, p-cpe:/a:centos:centos:perf, p-cpe:/a:centos:centos:kernel-bootwrapper, p-cpe:/a:centos:centos:kernel-debug, p-cpe:/a:redhat:enterprise_linux:kernel-rt-trace-kvm, p-cpe:/a:centos:centos:kernel-rt-trace-devel, p-cpe:/a:centos:centos:kernel-rt-trace, p-cpe:/a:centos:centos:kernel, p-cpe:/a:redhat:enterprise_linux:kernel-headers, p-cpe:/a:redhat:enterprise_linux:kernel-kdump-devel, p-cpe:/a:redhat:enterprise_linux:kernel-bootwrapper, p-cpe:/a:redhat:enterprise_linux:kernel-rt-kvm, p-cpe:/a:redhat:enterprise_linux:kernel-doc, p-cpe:/a:redhat:enterprise_linux:kernel-rt-devel, p-cpe:/a:centos:centos:kernel-abi-whitelists, p-cpe:/a:redhat:enterprise_linux:kernel-rt-trace, p-cpe:/a:centos:centos:kernel-rt
必要的 KB 項目: Host/local_checks_enabled, Host/cpu, global_settings/vendor_unpatched, Host/OS/identifier
可輕鬆利用: No known exploits are available
弱點發布日期: 2025/10/22
參考資訊
CVE: CVE-2022-50571