CVE-2022-50864: nilfs2: fix shift-out-of-bounds due to too large exponent of block size
In the Linux kernel, the following vulnerability has been resolved:
nilfs2: fix shift-out-of-bounds due to too large exponent of block size
If field slogblocksize of superblock data is corrupted and too large, initnilfs() and loadnilfs() still can trigger a shift-out-of-bounds warning followed by a kernel panic (if paniconwarn is set):
shift exponent 38973 is too large for 32-bit type 'int' Call Trace: <TASK> dumpstacklvl+0xcd/0x134 ubsanepilogue+0xb/0x50 ubsanhandleshiftoutofbounds.cold.12+0x17b/0x1f5 initnilfs.cold.11+0x18/0x1d [nilfs2] nilfsmount+0x9b5/0x12b0 [nilfs2] ...
This fixes the issue by adding and using a new helper function for getting block size with sanity check.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-50864?
CVE-2022-50864 has a medium severity rating due to the potential for a shift-out-of-bounds condition in the nilfs2 filesystem.
How does CVE-2022-50864 impact the Linux kernel?
CVE-2022-50864 can lead to a denial of service if the block size exponent in the superblock is corrupted.
How do I fix CVE-2022-50864?
To fix CVE-2022-50864, update to the latest stable version of the Linux kernel that includes the patch addressing this vulnerability.
Which versions of the Linux kernel are affected by CVE-2022-50864?
CVE-2022-50864 affects versions of the Linux kernel that utilize the nilfs2 filesystem with a corrupted block size exponent.
What are the potential consequences of not addressing CVE-2022-50864?
Failure to address CVE-2022-50864 could result in system instability or denial of service due to crashes related to the nilfs2 filesystem.