CVE-2022-50367: fs: fix UAF/GPF bug in nilfs_mdt_destroy
In the Linux kernel, the following vulnerability has been resolved:
fs: fix UAF/GPF bug in nilfsmdtdestroy
In allocinode, inodeinitalways() could return -ENOMEM if securityinodealloc() fails, which causes inode->iprivate uninitialized. Then nilfsismetadatafileinode() returns true and nilfsfreeinode() wrongly calls nilfsmdtdestroy(), which frees the uninitialized inode->iprivate and leads to crashes(e.g., UAF/GPF).
Fix this by moving securityinodealloc just prior to thiscpuinc(nrinodes)
Other sources
In the Linux kernel, the following vulnerability has been resolved:
fs: fix UAF/GPF bug in nilfsmdtdestroy
In allocinode, inodeinitalways() could return -ENOMEM if securityinodealloc() fails, which causes inode-iprivate uninitialized. Then nilfsismetadatafileinode() returns true and nilfsfreeinode() wrongly calls nilfsmdtdestroy(), which frees the uninitialized inode-iprivate and leads to crashes(e.g., UAF/GPF).
Fix this by moving securityinodealloc just prior to thiscpuinc(nrinodes)
— IBM
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-50367?
CVE-2022-50367 has been classified as a medium severity vulnerability in the Linux kernel.
How do I fix CVE-2022-50367?
To resolve CVE-2022-50367, update to the latest patched version of the Linux kernel provided by your distribution.
What components are affected by CVE-2022-50367?
CVE-2022-50367 affects the Linux kernel specifically related to inode handling during nilfs_mdt_destroy.
What are the potential risks associated with CVE-2022-50367?
The risks associated with CVE-2022-50367 include possible use-after-free and general protection faults that could lead to system instability.
When was CVE-2022-50367 disclosed?
CVE-2022-50367 was disclosed as part of security updates to the Linux kernel in 2022.