CVE-2022-49688: afs: Fix dynamic root getattr
In the Linux kernel, the following vulnerability has been resolved:
afs: Fix dynamic root getattr
The recent patch to make afsgetattr consult the server didn't account for the pseudo-inodes employed by the dynamic root-type afs superblock not having a volume or a server to access, and thus an oops occurs if such a directory is stat'd.
Fix this by checking to see if the vnode->volume pointer actually points anywhere before following it in afsgetattr().
This can be tested by stat'ing a directory in /afs. It may be sufficient just to do "ls /afs" and the oops looks something like:
BUG: kernel NULL pointer dereference, address: 0000000000000020 ... RIP: 0010:afsgetattr+0x8b/0x14b ... Call Trace: <TASK> vfsstatx+0x79/0xf5 vfsfstatat+0x49/0x62
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2022-49688?
CVE-2022-49688 has a high severity rating due to the potential for unauthorized access in the Linux kernel.
How do I fix CVE-2022-49688?
You can fix CVE-2022-49688 by applying the latest patches from the Linux kernel that address this vulnerability.
What systems are affected by CVE-2022-49688?
CVE-2022-49688 affects all versions of the Linux kernel that include the AFS file system implementation.
What type of vulnerability is CVE-2022-49688?
CVE-2022-49688 is a security vulnerability related to improper handling of dynamic root attributes in the AFS file system.
When was CVE-2022-49688 disclosed?
CVE-2022-49688 was disclosed as part of a Linux kernel patch in early 2023.