CVE-2022-49361: f2fs: fix to do sanity check for inline inode
In the Linux kernel, the following vulnerability has been resolved:
f2fs: fix to do sanity check for inline inode
Yanming reported a kernel bug in Bugzilla kernel [1], which can be reproduced. The bug message is:
The kernel message is shown below:
kernel BUG at fs/inode.c:611! Call Trace: evict+0x282/0x4e0 dentrykill+0x2b2/0x4d0 dput+0x2dd/0x720 dorenameat2+0x596/0x970 x64sysrename+0x78/0x90 dosyscall64+0x3b/0x90
[1] https://bugzilla.kernel.org/showbug.cgi?id=215895
The bug is due to fuzzed inode has both inlinedata and encrypted flags. During f2fsevictinode(), as the inode was deleted by rename(), it will cause inline data conversion due to conflicting flags. The page cache will be polluted and the panic will be triggered in clearinode().
Try fixing the bug by doing more sanity checks for inline data inode in sanitycheckinode().
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-49361?
CVE-2022-49361 has a severity rating that is determined by its impact on system stability and data integrity, though specific numerical values will depend on the assessment at the time.
How do I fix CVE-2022-49361?
To fix CVE-2022-49361, you should update your Linux kernel to a version that includes the patched code addressing the vulnerability.
What systems are affected by CVE-2022-49361?
CVE-2022-49361 affects multiple versions of the Linux kernel, specifically those between 3.8 to 5.10.121, 5.11 to 5.15.46, 5.16 to 5.17.14, and 5.18 to 5.18.3.
Who reported CVE-2022-49361?
CVE-2022-49361 was reported by a researcher named Yanming, highlighting a kernel bug in the f2fs module.
What impact does CVE-2022-49361 have on systems?
CVE-2022-49361 can lead to kernel panic or a system crash due to the failure of sanity checks for inline inodes.