CVE-2022-49170: f2fs: fix to do sanity check on curseg->alloc_type
In the Linux kernel, the following vulnerability has been resolved:
f2fs: fix to do sanity check on curseg->alloctype
As Wenqing Liu reported in bugzilla:
https://bugzilla.kernel.org/showbug.cgi?id=215657
- Overview UBSAN: array-index-out-of-bounds in fs/f2fs/segment.c:3460:2 when mount and operate a corrupted image
- Reproduce tested on kernel 5.17-rc4, 5.17-rc6
1. mkdir testcrash 2. cd testcrash 3. unzip tmp2.zip 4. mkdir mnt 5. ./singletest.sh f2fs 2
- Kernel dump [ 46.434454] loop0: detected capacity change from 0 to 131072 [ 46.529839] F2FS-fs (loop0): Mounted with checkpoint version = 7548c2d9 [ 46.738319] ================================================================================ [ 46.738412] UBSAN: array-index-out-of-bounds in fs/f2fs/segment.c:3460:2 [ 46.738475] index 231 is out of range for type 'unsigned int [2]' [ 46.738539] CPU: 2 PID: 939 Comm: umount Not tainted 5.17.0-rc6 #1 [ 46.738547] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.13.0-1ubuntu1.1 04/01/2014 [ 46.738551] Call Trace: [ 46.738556] <TASK> [ 46.738563] dumpstacklvl+0x47/0x5c [ 46.738581] ubsanepilogue+0x5/0x50 [ 46.738592] ubsanhandleoutofbounds+0x68/0x80 [ 46.738604] f2fsallocatedatablock+0xdff/0xe60 [f2fs] [ 46.738819] dowritepage+0xef/0x210 [f2fs] [ 46.738934] f2fsdowritenodepage+0x3f/0x80 [f2fs] [ 46.739038] writenodepage+0x2b7/0x920 [f2fs] [ 46.739162] f2fssyncnodepages+0x943/0xb00 [f2fs] [ 46.739293] f2fswritecheckpoint+0x7bb/0x1030 [f2fs] [ 46.739405] killf2fssuper+0x125/0x150 [f2fs] [ 46.739507] deactivatelockedsuper+0x60/0xc0 [ 46.739517] deactivatesuper+0x70/0xb0 [ 46.739524] cleanupmnt+0x11a/0x200 [ 46.739532] cleanupmnt+0x16/0x20 [ 46.739538] taskworkrun+0x67/0xa0 [ 46.739547] exittousermodeprepare+0x18c/0x1a0 [ 46.739559] syscallexittousermode+0x26/0x40 [ 46.739568] dosyscall64+0x46/0xb0 [ 46.739584] entrySYSCALL64afterhwframe+0x44/0xae
The root cause is we missed to do sanity check on curseg->alloctype, result in out-of-bound accessing on sbi->blockcount[] array, fix it.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernel f2fsto a version that resolves this vulnerability.Fixed in 5.17.0-rc6 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch https://bugzilla.kernel.org/show_bug.cgi?id=215657
Event History
Frequently Asked Questions
What is the severity of CVE-2022-49170?
CVE-2022-49170 is considered a moderate severity vulnerability affecting the Linux kernel due to the potential for out-of-bounds access.
How do I fix CVE-2022-49170?
To fix CVE-2022-49170, upgrade to a patched version of the Linux kernel that addresses this vulnerability.
Which versions of the Linux kernel are affected by CVE-2022-49170?
CVE-2022-49170 affects Linux kernel versions from 3.8 to 5.17-rc6.
What type of vulnerability is CVE-2022-49170?
CVE-2022-49170 is categorized as an out-of-bounds write vulnerability in the f2fs filesystem of the Linux kernel.
Who reported the CVE-2022-49170 vulnerability?
CVE-2022-49170 was reported by Wenqing Liu in the Linux bug tracking system.