CVE-2022-50009: f2fs: fix null-ptr-deref in f2fs_get_dnode_of_data
f2fs: fix null-ptr-deref in f2fsgetdnodeofdata
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernel f2fs atomic write fix (f2fs_get_dnode_of_data null-ptr-deref)to a version that resolves this vulnerability.Patch 3db1de0e582c - Configuration
Update the f2fs atomic write implementation to introduce the FI_COW_FILE flag for the COW inode, and in f2fs_do_write_data_page when using the cow_inode, set/propagate the FI_ATOMIC_FILE flag on the cow_inode as described to prevent the null-ptr-deref in f2fs_get_dnode_of_data.
f2fs FI_COW_FILE / FI_ATOMIC_FILE (COW inode flags used during atomic write paths) = Introduce FI_COW_FILE flag for COW inode; when f2fs_do_write_data_page uses cow_inode, use cow_inode's cow_inode and mark cow_inode as FI_ATOMIC_FILE
Event History
Frequently Asked Questions
What is the severity of CVE-2022-50009?
CVE-2022-50009 is classified as a high-severity vulnerability due to its potential to cause a null pointer dereference in the f2fs file system.
How do I fix CVE-2022-50009?
To fix CVE-2022-50009, users should upgrade their Linux kernel to a version that resolves the null pointer dereference issue.
Which versions of the Linux kernel are affected by CVE-2022-50009?
CVE-2022-50009 affects Linux kernel versions between 3.8 and 5.18.18 and versions between 5.19 to 5.19.4.
What component of the Linux kernel is impacted by CVE-2022-50009?
CVE-2022-50009 impacts the f2fs (Flash-Friendly File System) component of the Linux kernel.
What type of vulnerability is CVE-2022-50009?
CVE-2022-50009 is a null pointer dereference vulnerability that can lead to system crashes or unexpected behavior.