CVE-2022-49363

published 2025-02-26

CVE-2022-49363: In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to do sanity check on block address in f2fs_do_zero_range() As Yanming reported…

Priority P4 20 medium 5.5 CVSS 3.1

AV L AC L PR L UI N S U C N I N A H

In the Linux kernel, the following vulnerability has been resolved:

f2fs: fix to do sanity check on block address in f2fs_do_zero_range()

As Yanming reported in bugzilla:

https://bugzilla.kernel.org/show_bug.cgi?id=215894

I have encountered a bug in F2FS file system in kernel v5.17.

I have uploaded the system call sequence as case.c, and a fuzzed image can
be found in google net disk

The kernel should enable CONFIG_KASAN=y and CONFIG_KASAN_INLINE=y. You can
reproduce the bug by running the following commands:

kernel BUG at fs/f2fs/segment.c:2291!
Call Trace:
f2fs_invalidate_blocks+0x193/0x2d0
f2fs_fallocate+0x2593/0x4a70
vfs_fallocate+0x2a5/0xac0
ksys_fallocate+0x35/0x70
__x64_sys_fallocate+0x8e/0xf0
do_syscall_64+0x3b/0x90
entry_SYSCALL_64_after_hwframe+0x44/0xae

The root cause is, after image was fuzzed, block mapping info in inode
will be inconsistent with SIT table, so in f2fs_fallocate(), it will cause
panic when updating SIT with invalid blkaddr.

Let's fix the issue by adding sanity check on block address before updating
SIT table with it.

Affected

17 ranges

Vendor	Product	Version range	Fixed in
debian	linux	< linux 5.18.5-1 (bookworm)	linux 5.18.5-1 (bookworm)
linux	linux	—	—
linux	linux	>= 98e4da8ca301e062d79ae168c67e56f3c3de3ce4 < 7361c9f2bd6a8f0cbb41cdea9aff04765ff23f67	7361c9f2bd6a8f0cbb41cdea9aff04765ff23f67
linux	linux	>= 98e4da8ca301e062d79ae168c67e56f3c3de3ce4 < a34d7b49894b0533222188a52e2958750f830efd	a34d7b49894b0533222188a52e2958750f830efd
linux	linux	>= 98e4da8ca301e062d79ae168c67e56f3c3de3ce4 < f2e1c38b5ac64eb1a16a89c52fb419409d12c25b	f2e1c38b5ac64eb1a16a89c52fb419409d12c25b
linux	linux	>= 98e4da8ca301e062d79ae168c67e56f3c3de3ce4 < 470493be19a5730ed432e3ac0f29a2ee7fc6c557	470493be19a5730ed432e3ac0f29a2ee7fc6c557
linux	linux	>= 98e4da8ca301e062d79ae168c67e56f3c3de3ce4 < 805b48b234a2803cb7daec7f158af12f0fbaefac	805b48b234a2803cb7daec7f158af12f0fbaefac
linux	linux	>= 98e4da8ca301e062d79ae168c67e56f3c3de3ce4 < 25f8236213a91efdf708b9d77e9e51b6fc3e141c	25f8236213a91efdf708b9d77e9e51b6fc3e141c
linux	linux_kernel	>= 0 < 5.10.127-1	5.10.127-1
linux	linux_kernel	>= 0 < 5.18.5-1	5.18.5-1
linux	linux_kernel	>= 0 < 5.18.5-1	5.18.5-1
linux	linux_kernel	>= 0 < 5.18.5-1	5.18.5-1
linux	linux_kernel	>= 3.8 < 5.4.198	5.4.198
linux	linux_kernel	>= 5.11 < 5.15.46	5.15.46
linux	linux_kernel	>= 5.16 < 5.17.14	5.17.14
linux	linux_kernel	>= 5.18 < 5.18.3	5.18.3
linux	linux_kernel	>= 5.5 < 5.10.121	5.10.121

CVSS provenance

nvd v3.1 5.5 MEDIUM CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

osv 5.5 MEDIUM

vendor_debian 5.5 MEDIUM

vendor_redhat 5.5 MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.