CVE-2022-49363

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-49363
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to do sanity check on block address in f2fs_do_zero_range() As Yanming reported in bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=215894 I have encountered a bug in F2FS file system in kernel v5.17. I have uploaded the system call sequence as case.c, and a fuzzed image can be found in google net disk The kernel should enable CONFIG_KASAN=y and CONFIG_KASAN_INLINE=y. You can reproduce the bug by running the following commands: kernel BUG at fs/f2fs/segment.c:2291! Call Trace: f2fs_invalidate_blocks+0x193/0x2d0 f2fs_fallocate+0x2593/0x4a70 vfs_fallocate+0x2a5/0xac0 ksys_fallocate+0x35/0x70 __x64_sys_fallocate+0x8e/0xf0 do_syscall_64+0x3b/0x90 entry_SYSCALL_64_after_hwframe+0x44/0xae The root cause is, after image was fuzzed, block mapping info in inode will be inconsistent with SIT table, so in f2fs_fallocate(), it will cause panic when updating SIT with invalid blkaddr. Let's fix the issue by adding sanity check on block address before updating SIT table with it.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/25f8236213a91efdf708b9d77e9e51b6fc3e141c Patch
https://git.kernel.org/stable/c/470493be19a5730ed432e3ac0f29a2ee7fc6c557 Patch
https://git.kernel.org/stable/c/7361c9f2bd6a8f0cbb41cdea9aff04765ff23f67 Patch
https://git.kernel.org/stable/c/805b48b234a2803cb7daec7f158af12f0fbaefac Patch
https://git.kernel.org/stable/c/a34d7b49894b0533222188a52e2958750f830efd Patch
https://git.kernel.org/stable/c/f2e1c38b5ac64eb1a16a89c52fb419409d12c25b Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

21 Oct 2025, 12:16

Type Values Removed Values Added
CWE NVD-CWE-noinfo
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: f2fs: corrección para realizar una comprobación de cordura en la dirección de bloque en f2fs_do_zero_range() Como informó Yanming en bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=215894 He encontrado un error en el sistema de archivos F2FS en el kernel v5.17. He subido la secuencia de llamada del sistema como case.c, y se puede encontrar una imagen difusa en google net disk El kernel debe habilitar CONFIG_KASAN=y y CONFIG_KASAN_INLINE=y. Puede reproducir el error ejecutando los siguientes comandos: kernel BUG at fs/f2fs/segment.c:2291! Rastreo de llamadas: f2fs_invalidate_blocks+0x193/0x2d0 f2fs_fallocate+0x2593/0x4a70 vfs_fallocate+0x2a5/0xac0 ksys_fallocate+0x35/0x70 __x64_sys_fallocate+0x8e/0xf0 do_syscall_64+0x3b/0x90 entry_SYSCALL_64_after_hwframe+0x44/0xae La causa raíz es que, después de que se realizó el análisis difuso de la imagen, la información de mapeo de bloques en el inodo será inconsistente con la tabla SIT, por lo que en f2fs_fallocate(), causará pánico al actualizar SIT con blkaddr no válido. Solucionemos el problema agregando una verificación de cordura en la dirección del bloque antes de actualizar la tabla SIT con ella.
References () https://git.kernel.org/stable/c/25f8236213a91efdf708b9d77e9e51b6fc3e141c - () https://git.kernel.org/stable/c/25f8236213a91efdf708b9d77e9e51b6fc3e141c - Patch
References () https://git.kernel.org/stable/c/470493be19a5730ed432e3ac0f29a2ee7fc6c557 - () https://git.kernel.org/stable/c/470493be19a5730ed432e3ac0f29a2ee7fc6c557 - Patch
References () https://git.kernel.org/stable/c/7361c9f2bd6a8f0cbb41cdea9aff04765ff23f67 - () https://git.kernel.org/stable/c/7361c9f2bd6a8f0cbb41cdea9aff04765ff23f67 - Patch
References () https://git.kernel.org/stable/c/805b48b234a2803cb7daec7f158af12f0fbaefac - () https://git.kernel.org/stable/c/805b48b234a2803cb7daec7f158af12f0fbaefac - Patch
References () https://git.kernel.org/stable/c/a34d7b49894b0533222188a52e2958750f830efd - () https://git.kernel.org/stable/c/a34d7b49894b0533222188a52e2958750f830efd - Patch
References () https://git.kernel.org/stable/c/f2e1c38b5ac64eb1a16a89c52fb419409d12c25b - () https://git.kernel.org/stable/c/f2e1c38b5ac64eb1a16a89c52fb419409d12c25b - Patch
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
First Time Linux
Linux linux Kernel
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5

26 Feb 2025, 07:01

Type Values Removed Values Added
New CVE
Information

Published : 2025-02-26 07:01

Updated : 2025-10-21 12:16

NVD link : CVE-2022-49363

Mitre link : CVE-2022-49363

CVE.ORG link : CVE-2022-49363

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
NVD-CWE-noinfo