CVE-2022-49170: f2fs: fix to do sanity check on curseg->alloc_type

Q: What is the severity of CVE-2022-49170?

CVE-2022-49170 is considered a moderate severity vulnerability affecting the Linux kernel due to the potential for out-of-bounds access.

Q: How do I fix CVE-2022-49170?

To fix CVE-2022-49170, upgrade to a patched version of the Linux kernel that addresses this vulnerability.

Q: Which versions of the Linux kernel are affected by CVE-2022-49170?

CVE-2022-49170 affects Linux kernel versions from 3.8 to 5.17-rc6.

Q: What type of vulnerability is CVE-2022-49170?

CVE-2022-49170 is categorized as an out-of-bounds write vulnerability in the f2fs filesystem of the Linux kernel.

Q: Who reported the CVE-2022-49170 vulnerability?

CVE-2022-49170 was reported by Wenqing Liu in the Linux bug tracking system.

Published Feb 26, 2025

Updated

In the Linux kernel, the following vulnerability has been resolved:

Affected Software

157 affected componentsFixes available

Linux Linux kernel>=5.17-rc4<5.17-rc6

Linux Linux kernel>=3.8<5.10.110

Linux Linux kernel>=5.11<5.15.33

Linux Linux kernel>=5.16<5.16.19

Linux Linux kernel>=5.17<5.17.2

debian/linux<5.17.3-1

5.17.3-1

debian/linux<5.17.3-1

5.17.3-1

debian/linux<5.17.3-1

5.17.3-1

debian/linux

6.1.176-16.1.190-16.12.107-16.12.115-27.2.12-17.2.15-1

ubuntu/linux*

ubuntu/linux-aws*

ubuntu/linux-azure*

ubuntu/linux-lts-xenial*

ubuntu/linux*

ubuntu/linux-aws*

ubuntu/linux-aws-hwe*

ubuntu/linux-azure*

ubuntu/linux-gcp*

ubuntu/linux-hwe*

ubuntu/linux-hwe-edge*

ubuntu/linux-kvm*

ubuntu/linux-oracle*

ubuntu/linux-fips*

ubuntu/linux*

ubuntu/linux-aws*

ubuntu/linux-aws-5.0*

ubuntu/linux-aws-5.3*

ubuntu/linux-aws-5.4<5.4.0-1165.176~18.04.1

5.4.0-1165.176~18.04.1

ubuntu/linux-azure*

ubuntu/linux-azure-4.15*

ubuntu/linux-azure-5.3*

ubuntu/linux-azure-5.4<5.4.0-1170.176~18.04.1

5.4.0-1170.176~18.04.1

ubuntu/linux-azure-edge*

ubuntu/linux-gcp*

ubuntu/linux-gcp-4.15*

ubuntu/linux-gcp-5.3*

ubuntu/linux-gcp-5.4<5.4.0-1168.178~18.04.1

5.4.0-1168.178~18.04.1

ubuntu/linux-gke-4.15*

ubuntu/linux-gke-5.4*

ubuntu/linux-gkeop-5.4*

ubuntu/linux-hwe*

ubuntu/linux-hwe-5.4<5.4.0-242.262~18.04.1

5.4.0-242.262~18.04.1

ubuntu/linux-hwe-edge*

ubuntu/linux-ibm-5.4<5.4.0-1111.116~18.04.1

5.4.0-1111.116~18.04.1

ubuntu/linux-kvm*

ubuntu/linux-oem*

ubuntu/linux-oracle*

ubuntu/linux-oracle-5.0*

ubuntu/linux-oracle-5.3*

ubuntu/linux-oracle-5.4<5.4.0-1163.173~18.04.1

5.4.0-1163.173~18.04.1

ubuntu/linux-raspi-5.4<5.4.0-1148.161~18.04.1

5.4.0-1148.161~18.04.1

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux-azure-5.15<5.15.0-1008.9~20.04.1

5.15.0-1008.9~20.04.1

ubuntu/linux-hwe-5.15<5.15.0-41.44~20.04.1

5.15.0-41.44~20.04.1

ubuntu/linux-intel-iotg-5.15<5.15.0-1008.11~20.04.1

5.15.0-1008.11~20.04.1

ubuntu/linux-lowlatency-hwe-5.15<5.15.0-42.45~20.04.1

5.15.0-42.45~20.04.1

ubuntu/linux<5.4.0-242.262

5.4.0-242.262

ubuntu/linux-aws<5.4.0-1165.176

5.4.0-1165.176

ubuntu/linux-aws-5.11*

ubuntu/linux-aws-5.13*

ubuntu/linux-aws-5.8*

ubuntu/linux-azure<5.4.0-1170.176

5.4.0-1170.176

ubuntu/linux-azure-5.11*

ubuntu/linux-azure-5.13*

ubuntu/linux-azure-5.8*

ubuntu/linux-azure-fde*

ubuntu/linux-bluefield<5.4.0-1125.132

5.4.0-1125.132

ubuntu/linux-gcp<5.4.0-1168.178

5.4.0-1168.178

ubuntu/linux-gcp-5.11*

ubuntu/linux-gcp-5.13*

ubuntu/linux-gcp-5.8*

ubuntu/linux-gke*

ubuntu/linux-gke-5.15*

ubuntu/linux-gkeop*

ubuntu/linux-gkeop-5.15*

ubuntu/linux-hwe-5.11*

ubuntu/linux-hwe-5.13*

ubuntu/linux-hwe-5.8*

ubuntu/linux-ibm<5.4.0-1111.116

5.4.0-1111.116

ubuntu/linux-intel-5.13*

ubuntu/linux-iot<5.4.0-1069.72

5.4.0-1069.72

ubuntu/linux-kvm<5.4.0-1152.161

5.4.0-1152.161

ubuntu/linux-oem-5.10*

ubuntu/linux-oem-5.13*

ubuntu/linux-oem-5.6*

ubuntu/linux-oracle<5.4.0-1163.173

5.4.0-1163.173

ubuntu/linux-oracle-5.11*

ubuntu/linux-oracle-5.13*

ubuntu/linux-oracle-5.8*

ubuntu/linux-raspi<5.4.0-1148.161

5.4.0-1148.161

ubuntu/linux-raspi2*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.11*

ubuntu/linux-riscv-5.8*

ubuntu/linux-xilinx-zynqmp<5.4.0-1083.87

5.4.0-1083.87

ubuntu/linux-aws-fips<5.4.0-1165.176+fips1

5.4.0-1165.176+fips1

ubuntu/linux-azure-fips<5.4.0-1170.176+fips1

5.4.0-1170.176+fips1

ubuntu/linux-fips<5.4.0-1139.149

5.4.0-1139.149

ubuntu/linux-gcp-fips<5.4.0-1168.178+fips1

5.4.0-1168.178+fips1

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux<5.15.0-37.39

5.15.0-37.39

ubuntu/linux-allwinner-5.19*

ubuntu/linux-aws<5.15.0-1011.14

5.15.0-1011.14

ubuntu/linux-aws-5.19*

ubuntu/linux-aws-6.2*

ubuntu/linux-aws-6.5*

ubuntu/linux-azure<5.15.0-1010.12

5.15.0-1010.12

ubuntu/linux-azure-5.19*

ubuntu/linux-azure-6.2*

ubuntu/linux-azure-6.5*

ubuntu/linux-azure-fde-5.19*

ubuntu/linux-azure-fde-6.2*

ubuntu/linux-gcp<5.15.0-1008.12

5.15.0-1008.12

ubuntu/linux-gcp-5.19*

ubuntu/linux-gcp-6.2*

ubuntu/linux-gcp-6.5*

ubuntu/linux-gke<5.15.0-1008.10

5.15.0-1008.10

ubuntu/linux-hwe-5.19*

ubuntu/linux-hwe-6.2*

ubuntu/linux-hwe-6.5*

ubuntu/linux-ibm<5.15.0-1007.8

5.15.0-1007.8

ubuntu/linux-intel-iot-realtime*

ubuntu/linux-intel-iotg<5.15.0-1008.11

5.15.0-1008.11

ubuntu/linux-kvm<5.15.0-1010.11

5.15.0-1010.11

ubuntu/linux-lowlatency<5.15.0-37.39

5.15.0-37.39

ubuntu/linux-lowlatency-hwe-5.19*

ubuntu/linux-lowlatency-hwe-6.2*

ubuntu/linux-lowlatency-hwe-6.5*

ubuntu/linux-nvidia-6.2*

ubuntu/linux-nvidia-6.5*

ubuntu/linux-oem-5.17*

ubuntu/linux-oem-6.0*

ubuntu/linux-oem-6.1*

ubuntu/linux-oem-6.5*

ubuntu/linux-oracle<5.15.0-1009.12

5.15.0-1009.12

ubuntu/linux-oracle-6.5*

ubuntu/linux-raspi<5.15.0-1011.13

5.15.0-1011.13

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.19*

ubuntu/linux-riscv-6.5*

ubuntu/linux-starfive-5.19*

ubuntu/linux-starfive-6.2*

ubuntu/linux-starfive-6.5*

ubuntu/linux-realtime<5.15.0-1014.14

5.15.0-1014.14

ubuntu/linux-raspi-realtime*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/linux to a version that resolves this vulnerability.
Fixed in 6.1.176-1Fixed in 6.1.187-1Fixed in 6.12.107-1Fixed in 6.12.111-1Fixed in 7.2.9-1Fixed in 7.2.10-1

Event History

Feb 26, 2025

CVE Published

via MITRE·01:55 AM

Data Sourced

via MITRE·01:55 AM

DescriptionSeverity

Data Sourced

via OSV·07:00 AM

DescriptionSeverityAffected Software

Data Sourced

via NVD·07:00 AM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2022-49170?

CVE-2022-49170 is considered a moderate severity vulnerability affecting the Linux kernel due to the potential for out-of-bounds access.

How do I fix CVE-2022-49170?

To fix CVE-2022-49170, upgrade to a patched version of the Linux kernel that addresses this vulnerability.

Which versions of the Linux kernel are affected by CVE-2022-49170?

CVE-2022-49170 affects Linux kernel versions from 3.8 to 5.17-rc6.

What type of vulnerability is CVE-2022-49170?

CVE-2022-49170 is categorized as an out-of-bounds write vulnerability in the f2fs filesystem of the Linux kernel.

Who reported the CVE-2022-49170 vulnerability?

CVE-2022-49170 was reported by Wenqing Liu in the Linux bug tracking system.

CVE-2022-49170: f2fs: fix to do sanity check on curseg->alloc_type

Affected Software

Remediation

Event History

Frequently Asked Questions

What is the severity of CVE-2022-49170?

How do I fix CVE-2022-49170?

Which versions of the Linux kernel are affected by CVE-2022-49170?

What type of vulnerability is CVE-2022-49170?

Who reported the CVE-2022-49170 vulnerability?

Company

Resources

Contact