CVE-2022-49879: ext4: fix BUG_ON() when directory entry has invalid rec_len
In the Linux kernel, the following vulnerability has been resolved:
ext4: fix BUGON() when directory entry has invalid reclen
The reclen field in the directory entry has to be a multiple of 4. A corrupted filesystem image can be used to hit a BUG() in ext4reclentodisk(), called from makeindexeddir().
------------[ cut here ]------------ kernel BUG at fs/ext4/ext4.h:2413! ... RIP: 0010:makeindexeddir+0x53f/0x5f0 ... Call Trace: <TASK> ? adddirenttobuf+0x1b2/0x200 ext4addentry+0x36e/0x480 ext4addnondir+0x2b/0xc0 ext4create+0x163/0x200 pathopenat+0x635/0xe90 dofilpopen+0xb4/0x160 ? createobject.isra.0+0x1de/0x3b0 ? rawspinunlock+0x12/0x30 dosysopenat2+0x91/0x150 x64sysopen+0x6c/0xa0 dosyscall64+0x3c/0x80 entrySYSCALL64afterhwframe+0x46/0xb0
The fix simply adds a call to ext4checkdirentry() to validate the directory entry, returning -EFSCORRUPTED if the entry is invalid.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2022-49879?
CVE-2022-49879 is considered a critical vulnerability due to its potential to cause a system crash and corruption of filesystem data.
How do I fix CVE-2022-49879?
To fix CVE-2022-49879, upgrade to the latest version of the Linux kernel where the vulnerability has been patched.
What versions of the Linux kernel are affected by CVE-2022-49879?
CVE-2022-49879 affects multiple versions of the Linux kernel prior to the application's fix.
What does CVE-2022-49879 exploit in the Linux kernel?
CVE-2022-49879 exploits an issue in the ext4 filesystem where an invalid rec_len field can trigger a bug.
Can CVE-2022-49879 be exploited remotely?
CVE-2022-49879 requires a corrupted filesystem image, making it less likely to be exploited remotely without prior access.