CVE-2022-49318: f2fs: remove WARN_ON in f2fs_is_valid_blkaddr
In the Linux kernel, the following vulnerability has been resolved:
f2fs: remove WARNON in f2fsisvalidblkaddr
Syzbot triggers two WARNs in f2fsisvalidblkaddr and isbitmapvalid. For example, in f2fsisvalidblkaddr, if type is DATAGENERICENHANCE or DATAGENERICENHANCEREAD, it invokes WARNON if blkaddr is not in the right range. The call trace is as follows:
f2fsgetnodeinfo+0x45f/0x1070 readnodepage+0x577/0x1190 getnodepage.part.0+0x9e/0x10e0 getnodepage f2fsgetnodepage+0x109/0x180 doreadinode f2fsiget+0x2a5/0x58b0 f2fsfillsuper+0x3b39/0x7ca0
Fix these two WARNs by replacing WARNON with dumpstack.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In the Linux kernel f2fs codepath, remove the WARN_ON usage in f2fs_is_valid_blkaddr (for DATA_GENERIC_ENHANCE and DATA_GENERIC_ENHANCE_READ when blkaddr is out of the expected range) and replace it with dump_stack.
Linux kernel (f2fs) WARN_ON in f2fs_is_valid_blkaddr = replace with dump_stack
Event History
Frequently Asked Questions
What is the severity of CVE-2022-49318?
CVE-2022-49318 has a medium severity rating due to potential impacts on system stability.
How do I fix CVE-2022-49318?
To fix CVE-2022-49318, update the Linux kernel to at least version 5.4.198 or one of the versions between 5.5 and 5.18.4.
What versions of the Linux kernel are affected by CVE-2022-49318?
CVE-2022-49318 affects multiple versions of the Linux kernel, specifically those below version 5.4.198 and between versions 5.5 and 5.18.4.
What is the nature of CVE-2022-49318?
CVE-2022-49318 involves the removal of a WARN_ON statement related to f2fs's block address validation, which could lead to unexpected behavior.
Is CVE-2022-49318 exploitable?
While CVE-2022-49318 is primarily a warning removal, it could indirectly affect the integrity of data management in f2fs.