CVE-2022-49007
published 2024-10-21CVE-2022-49007: In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix NULL pointer dereference in nilfs_palloc_commit_free_entry() Syzbot reported a…
PriorityP421medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.25%
16.2th percentile
In the Linux kernel, the following vulnerability has been resolved:
nilfs2: fix NULL pointer dereference in nilfs_palloc_commit_free_entry()
Syzbot reported a null-ptr-deref bug:
NILFS (loop0): segctord starting. Construction interval = 5 seconds, CP
frequency 3c 02
00 0f 85 26 05 00 00 49 8b 46 10 be a6 00 00 00 48 c7 c7
RSP: 0018:ffffc90003dff830 EFLAGS: 00010212
RAX: dffffc0000000000 RBX: ffff88802594e218 RCX: 000000000000000d
RDX: 0000000000000002 RSI: 0000000000002000 RDI: 0000000000000010
RBP: ffff888071880222 R08: 0000000000000005 R09: 000000000000003f
R10: 000000000000000d R11: 0000000000000000 R12: ffff888071880158
R13: ffff88802594e220 R14: 0000000000000000 R15: 0000000000000004
FS: 0000000000000000(0000) GS:ffff8880b9b00000(0000)
knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fb1c08316a8 CR3: 0000000018560000 CR4: 0000000000350ee0
Call Trace:
nilfs_dat_commit_free fs/nilfs2/dat.c:114 [inline]
nilfs_dat_commit_end+0x464/0x5f0 fs/nilfs2/dat.c:193
nilfs_dat_commit_update+0x26/0x40 fs/nilfs2/dat.c:236
nilfs_btree_commit_update_v+0x87/0x4a0 fs/nilfs2/btree.c:1940
nilfs_btree_commit_propagate_v fs/nilfs2/btree.c:2016 [inline]
nilfs_btree_propagate_v fs/nilfs2/btree.c:2046 [inline]
nilfs_btree_propagate+0xa00/0xd60 fs/nilfs2/btree.c:2088
nilfs_bmap_propagate+0x73/0x170 fs/nilfs2/bmap.c:337
nilfs_collect_file_data+0x45/0xd0 fs/nilfs2/segment.c:568
nilfs_segctor_apply_buffers+0x14a/0x470 fs/nilfs2/segment.c:1018
nilfs_segctor_scan_file+0x3f4/0x6f0 fs/nilfs2/segment.c:1067
nilfs_segctor_collect_blocks fs/nilfs2/segment.c:1197 [inline]
nilfs_segctor_collect fs/nilfs2/segment.c:1503 [inline]
nilfs_segctor_do_construct+0x12fc/0x6af0 fs/nilfs2/segment.c:2045
nilfs_segctor_construct+0x8e3/0xb30 fs/nilfs2/segment.c:2379
nilfs_segctor_thread_construct fs/nilfs2/segment.c:2487 [inline]
nilfs_segctor_thread+0x3c3/0xf30 fs/nilfs2/segment.c:2570
kthread+0x2e4/0x3a0 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:30
Affected
23 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.0.12-1 (bookworm) | linux 6.0.12-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= a17564f58b11476c011d623fa1f268602a81c27c < 2f2c59506ae39496588ceb8b88bdbdbaed895d63 | 2f2c59506ae39496588ceb8b88bdbdbaed895d63 |
| linux | linux | >= a17564f58b11476c011d623fa1f268602a81c27c < 165c7a3b27a3857ebf57f626b9f38b48b6792e68 | 165c7a3b27a3857ebf57f626b9f38b48b6792e68 |
| linux | linux | >= a17564f58b11476c011d623fa1f268602a81c27c < bc3fd3293887b4cf84a9109700faeb82de533c89 | bc3fd3293887b4cf84a9109700faeb82de533c89 |
| linux | linux | >= a17564f58b11476c011d623fa1f268602a81c27c < 9a130b72e6bd1fb07fc3cde839dc6fb53da76f07 | 9a130b72e6bd1fb07fc3cde839dc6fb53da76f07 |
| linux | linux | >= a17564f58b11476c011d623fa1f268602a81c27c < e858917ab785afe83c14f5ac141301216ccda847 | e858917ab785afe83c14f5ac141301216ccda847 |
| linux | linux | >= a17564f58b11476c011d623fa1f268602a81c27c < 33021419fd81efd3d729a7f19341ba4b98fe66ce | 33021419fd81efd3d729a7f19341ba4b98fe66ce |
| linux | linux | >= a17564f58b11476c011d623fa1f268602a81c27c < 381b84f60e549ea98cec4666c6c728b1b3318756 | 381b84f60e549ea98cec4666c6c728b1b3318756 |
| linux | linux | >= a17564f58b11476c011d623fa1f268602a81c27c < f0a0ccda18d6fd826d7c7e7ad48a6ed61c20f8b4 | f0a0ccda18d6fd826d7c7e7ad48a6ed61c20f8b4 |
| linux | linux_kernel | < 4.9.335 | 4.9.335 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 5.10.158-1 | 5.10.158-1 |
| linux | linux_kernel | >= 0 < 6.0.12-1 | 6.0.12-1 |
| linux | linux_kernel | >= 0 < 6.0.12-1 | 6.0.12-1 |
| linux | linux_kernel | >= 0 < 6.0.12-1 | 6.0.12-1 |
| linux | linux_kernel | >= 4.10 < 4.14.301 | 4.14.301 |
| linux | linux_kernel | >= 4.15 < 4.19.268 | 4.19.268 |
| linux | linux_kernel | >= 4.20 < 5.4.226 | 5.4.226 |
| linux | linux_kernel | >= 5.11 < 5.15.82 | 5.15.82 |
| linux | linux_kernel | >= 5.16 < 6.0.12 | 6.0.12 |
| linux | linux_kernel | >= 5.5 < 5.10.158 | 5.10.158 |
| rack | rack | >= 3.1.0 < 3.1.16 | 3.1.16 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
ghsa7.5HIGH
osv5.5MEDIUM
vendor_redhat7.5HIGH
vendor_debian5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: nilfs2: fix NULL pointer dereference in nilfs_palloc_commit_free_entry()
vendor_redhat·2024-10-21·CVSS 5.5
CVE-2022-49007 [MEDIUM] CWE-476 kernel: nilfs2: fix NULL pointer dereference in nilfs_palloc_commit_free_entry()
kernel: nilfs2: fix NULL pointer dereference in nilfs_palloc_commit_free_entry()
In the Linux kernel, the following vulnerability has been resolved:
nilfs2: fix NULL pointer dereference in nilfs_palloc_commit_free_entry()
Syzbot reported a null-ptr-deref bug:
NILFS (loop0): segctord starting. Construction interval = 5 seconds, CP
frequency 3c 02
00 0f 85 26 05 00 00 49 8b 46 10 be a6 00 00 00 48 c7 c7
RSP: 0018:ffffc90003dff830 EFLAGS: 00010212
RAX: dffffc0000000000 RBX: ffff88802594e218 RCX: 000000000000000d
RDX: 0000000000000002 RSI: 0000000000002000 RDI: 0000000000000010
RBP: ffff888071880222 R08: 0000000000000005 R09: 000000000000003f
R10: 000000000000000d R11: 0000000000000000 R12: ffff888071880158
R13: ffff88802594e220 R14: 0000000000000000 R15: 0000000000000004
FS: 0000000000000000
Debian
CVE-2022-49007: linux - In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix...
vendor_debian·2022·CVSS 5.5
CVE-2022-49007 [MEDIUM] CVE-2022-49007: linux - In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix...
In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix NULL pointer dereference in nilfs_palloc_commit_free_entry() Syzbot reported a null-ptr-deref bug: NILFS (loop0): segctord starting. Construction interval = 5 seconds, CP frequency 3c 02 00 0f 85 26 05 00 00 49 8b 46 10 be a6 00 00 00 48 c7 c7 RSP: 0018:ffffc90003dff830 EFLAGS: 00010212 RAX: dffffc0000000000 RBX: ffff88802594e218 RCX: 000000000000000d RDX: 0000000000000002 RSI: 0000000000002000 RDI: 0000000000000010 RBP: ffff888071880222 R08: 0000000000000005 R09: 000000000000003f R10: 000000000000000d R11: 0000000000000000 R12: ffff888071880158 R13: ffff88802594e220 R14: 0000000000000000 R15: 0000000000000004 FS: 0000000000000000(0000) GS:ffff8880b9b00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000
GHSA
ReDoS Vulnerability in Rack::Multipart handle_mime_head
ghsa·2025-06-05·CVSS 7.5
CVE-2025-49007 [HIGH] CWE-770 ReDoS Vulnerability in Rack::Multipart handle_mime_head
ReDoS Vulnerability in Rack::Multipart handle_mime_head
### Summary
There is a denial of service vulnerability in the Content-Disposition parsing component of Rack. This is very similar to the previous security issue CVE-2022-44571.
### Details
Carefully crafted input can cause Content-Disposition header parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. This header is used typically used in multipart parsing. Any applications that parse multipart posts using Rack (virtually all Rails applications) are impacted.
### Credits
Thanks to [scyoon](https://hackerone.com/scyoon) for reporting this to the Rails security team
OSV
CVE-2022-49007: In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix NULL pointer dereference in nilfs_palloc_commit_free_entry() Syzbot re
osv·2024-10-21·CVSS 5.5
CVE-2022-49007 [MEDIUM] CVE-2022-49007: In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix NULL pointer dereference in nilfs_palloc_commit_free_entry() Syzbot re
In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix NULL pointer dereference in nilfs_palloc_commit_free_entry() Syzbot reported a null-ptr-deref bug: NILFS (loop0): segctord starting. Construction interval = 5 seconds, CP frequency 3c 02 00 0f 85 26 05 00 00 49 8b 46 10 be a6 00 00 00 48 c7 c7 RSP: 0018:ffffc90003dff830 EFLAGS: 00010212 RAX: dffffc0000000000 RBX: ffff88802594e218 RCX: 000000000000000d RDX: 0000000000000002 RSI: 0000000000002000 RDI: 0000000000000010 RBP: ffff888071880222 R08: 0000000000000005 R09: 000000000000003f R10: 000000000000000d R11: 0000000000000000 R12: ffff888071880158 R13: ffff88802594e220 R14: 0000000000000000 R15: 0000000000000004 FS: 0000000000000000(0000) GS:ffff8880b9b00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000
GHSA
GHSA-9mmp-2f66-mf43: In the Linux kernel, the following vulnerability has been resolved:
nilfs2: fix NULL pointer dereference in nilfs_palloc_commit_free_entry()
Syzbot
ghsa_unreviewed·2024-10-21
CVE-2022-49007 [MEDIUM] CWE-476 GHSA-9mmp-2f66-mf43: In the Linux kernel, the following vulnerability has been resolved:
nilfs2: fix NULL pointer dereference in nilfs_palloc_commit_free_entry()
Syzbot
In the Linux kernel, the following vulnerability has been resolved:
nilfs2: fix NULL pointer dereference in nilfs_palloc_commit_free_entry()
Syzbot reported a null-ptr-deref bug:
NILFS (loop0): segctord starting. Construction interval = 5 seconds, CP
frequency 3c 02
00 0f 85 26 05 00 00 49 8b 46 10 be a6 00 00 00 48 c7 c7
RSP: 0018:ffffc90003dff830 EFLAGS: 00010212
RAX: dffffc0000000000 RBX: ffff88802594e218 RCX: 000000000000000d
RDX: 0000000000000002 RSI: 0000000000002000 RDI: 0000000000000010
RBP: ffff888071880222 R08: 0000000000000005 R09: 000000000000003f
R10: 000000000000000d R11: 0000000000000000 R12: ffff888071880158
R13: ffff88802594e220 R14: 0000000000000000 R15: 0000000000000004
FS: 0000000000000000(0000) GS:ffff8880b9b00000(0000)
knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://git.kernel.org/stable/c/165c7a3b27a3857ebf57f626b9f38b48b6792e68https://git.kernel.org/stable/c/2f2c59506ae39496588ceb8b88bdbdbaed895d63https://git.kernel.org/stable/c/33021419fd81efd3d729a7f19341ba4b98fe66cehttps://git.kernel.org/stable/c/381b84f60e549ea98cec4666c6c728b1b3318756https://git.kernel.org/stable/c/9a130b72e6bd1fb07fc3cde839dc6fb53da76f07https://git.kernel.org/stable/c/bc3fd3293887b4cf84a9109700faeb82de533c89https://git.kernel.org/stable/c/e858917ab785afe83c14f5ac141301216ccda847https://git.kernel.org/stable/c/f0a0ccda18d6fd826d7c7e7ad48a6ed61c20f8b4
2024-10-21
Published