CVE-2022-49763
published 2025-05-01CVE-2022-49763: In the Linux kernel, the following vulnerability has been resolved: ntfs: fix use-after-free in ntfs_attr_find() Patch series "ntfs: fix bugs about Attribute"…
PriorityP339high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.19%
9.5th percentile
In the Linux kernel, the following vulnerability has been resolved:
ntfs: fix use-after-free in ntfs_attr_find()
Patch series "ntfs: fix bugs about Attribute", v2.
This patchset fixes three bugs relative to Attribute in record:
Patch 1 adds a sanity check to ensure that, attrs_offset field in first
mft record loading from disk is within bounds.
Patch 2 moves the ATTR_RECORD's bounds checking earlier, to avoid
dereferencing ATTR_RECORD before checking this ATTR_RECORD is within
bounds.
Patch 3 adds an overflow checking to avoid possible forever loop in
ntfs_attr_find().
Without patch 1 and patch 2, the kernel triggersa KASAN use-after-free
detection as reported by Syzkaller.
Although one of patch 1 or patch 2 can fix this, we still need both of
them. Because patch 1 fixes the root cause, and patch 2 not only fixes
the direct cause, but also fixes the potential out-of-bounds bug.
This patch (of 3):
Syzkaller reported use-after-free read as follows:
BUG: KASAN: use-after-free in ntfs_attr_find+0xc02/0xce0 fs/ntfs/attrib.c:597
Read of size 2 at addr ffff88807e352009 by task syz-executor153/3607
[...]
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
print_address_description mm/kasan/report.c:317 [inline]
print_report.cold+0x2ba/0x719 mm/kasan/report.c:433
kasan_report+0xb1/0x1e0 mm/kasan/report.c:495
ntfs_attr_find+0xc02/0xce0 fs/ntfs/attrib.c:597
ntfs_attr_lookup+0x1056/0x2070 fs/ntfs/attrib.c:1193
ntfs_read_inode_mount+0x89a/0x2580 fs/ntfs/inode.c:1845
ntfs_fill_super+0x1799/0x9320 fs/ntfs/super.c:2854
mount_bdev+0x34d/0x410 fs/super.c:1400
legacy_get_tree+0x105/0x220 fs/fs_context.c:610
vfs_get_tree+0x89/0x2f0 fs/super.c:1530
do_new_mount fs/namespace.c:3040 [inline]
path_mount+0x1326/0x1e20 fs/namespace.c:3370
do_mount fs/namespace.c:3383 [inline]
__do_sys_mount fs/namespace.c:3591 [inline]
__se_sys_mount fs/namespace.c:3568 [inline]
__x64_sys_mount+0x27f/0x300 fs/namespace.c:3568
do_syscall_x64 arch/x
Affected
21 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.0.10-1 (bookworm) | linux 6.0.10-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 79f3ac7dcd12c05b7539239a4c6fa229a50d786c | 79f3ac7dcd12c05b7539239a4c6fa229a50d786c |
| linux | linux | >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < fb2004bafd1932e08d21ca604ee5844f2b7f212d | fb2004bafd1932e08d21ca604ee5844f2b7f212d |
| linux | linux | >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < d0006d739738a658a9c29b438444259d9f71dfa0 | d0006d739738a658a9c29b438444259d9f71dfa0 |
| linux | linux | >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 266bd5306286316758e6246ea0345133427b0f62 | 266bd5306286316758e6246ea0345133427b0f62 |
| linux | linux | >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < b825bfbbaafbe8da2037e3a778ad660c59f9e054 | b825bfbbaafbe8da2037e3a778ad660c59f9e054 |
| linux | linux | >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 5330c423b86263ac7883fef0260b9e2229cb531e | 5330c423b86263ac7883fef0260b9e2229cb531e |
| linux | linux | >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 4863f815463034f588a035cfd99cdca97a4f1069 | 4863f815463034f588a035cfd99cdca97a4f1069 |
| linux | linux | >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < d85a1bec8e8d552ab13163ca1874dcd82f3d1550 | d85a1bec8e8d552ab13163ca1874dcd82f3d1550 |
| linux | linux_kernel | < 4.9.334 | 4.9.334 |
| linux | linux_kernel | >= 0 < 5.10.158-1 | 5.10.158-1 |
| linux | linux_kernel | >= 0 < 6.0.10-1 | 6.0.10-1 |
| linux | linux_kernel | >= 0 < 6.0.10-1 | 6.0.10-1 |
| linux | linux_kernel | >= 0 < 6.0.10-1 | 6.0.10-1 |
| linux | linux_kernel | >= 4.10 < 4.14.300 | 4.14.300 |
| linux | linux_kernel | >= 4.15 < 4.19.267 | 4.19.267 |
| linux | linux_kernel | >= 4.20 < 5.4.225 | 5.4.225 |
| linux | linux_kernel | >= 5.11 < 5.15.80 | 5.15.80 |
| linux | linux_kernel | >= 5.16 < 6.0.10 | 6.0.10 |
| linux | linux_kernel | >= 5.5 < 5.10.156 | 5.10.156 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2022-49763: In the Linux kernel, the following vulnerability has been resolved: ntfs: fix use-after-free in ntfs_attr_find() Patch series "ntfs: fix bugs about At
osv·2025-05-01·CVSS 7.8
CVE-2022-49763 [HIGH] CVE-2022-49763: In the Linux kernel, the following vulnerability has been resolved: ntfs: fix use-after-free in ntfs_attr_find() Patch series "ntfs: fix bugs about At
In the Linux kernel, the following vulnerability has been resolved: ntfs: fix use-after-free in ntfs_attr_find() Patch series "ntfs: fix bugs about Attribute", v2. This patchset fixes three bugs relative to Attribute in record: Patch 1 adds a sanity check to ensure that, attrs_offset field in first mft record loading from disk is within bounds. Patch 2 moves the ATTR_RECORD's bounds checking earlier, to avoid dereferencing ATTR_RECORD before checking this ATTR_RECORD is within bounds. Patch 3 adds an overflow checking to avoid possible forever loop in ntfs_attr_find(). Without patch 1 and patch 2, the kernel triggersa KASAN use-after-free detection as reported by Syzkaller. Although one of patch 1 or patch 2 can fix this, we still need both of them. Because patch 1 fixes the root cause, an
GHSA
GHSA-h4jf-hv6r-g8qq: In the Linux kernel, the following vulnerability has been resolved:
ntfs: fix use-after-free in ntfs_attr_find()
Patch series "ntfs: fix bugs about
ghsa_unreviewed·2025-05-01
CVE-2022-49763 [HIGH] CWE-416 GHSA-h4jf-hv6r-g8qq: In the Linux kernel, the following vulnerability has been resolved:
ntfs: fix use-after-free in ntfs_attr_find()
Patch series "ntfs: fix bugs about
In the Linux kernel, the following vulnerability has been resolved:
ntfs: fix use-after-free in ntfs_attr_find()
Patch series "ntfs: fix bugs about Attribute", v2.
This patchset fixes three bugs relative to Attribute in record:
Patch 1 adds a sanity check to ensure that, attrs_offset field in first
mft record loading from disk is within bounds.
Patch 2 moves the ATTR_RECORD's bounds checking earlier, to avoid
dereferencing ATTR_RECORD before checking this ATTR_RECORD is within
bounds.
Patch 3 adds an overflow checking to avoid possible forever loop in
ntfs_attr_find().
Without patch 1 and patch 2, the kernel triggersa KASAN use-after-free
detection as reported by Syzkaller.
Although one of patch 1 or patch 2 can fix this, we still need both of
them. Because patch 1 fixes the root c
Red Hat
kernel: ntfs: fix use-after-free in ntfs_attr_find()
vendor_redhat·2025-05-01·CVSS 7.8
CVE-2022-49763 [HIGH] CWE-416 kernel: ntfs: fix use-after-free in ntfs_attr_find()
kernel: ntfs: fix use-after-free in ntfs_attr_find()
In the Linux kernel, the following vulnerability has been resolved:
ntfs: fix use-after-free in ntfs_attr_find()
Patch series "ntfs: fix bugs about Attribute", v2.
This patchset fixes three bugs relative to Attribute in record:
Patch 1 adds a sanity check to ensure that, attrs_offset field in first
mft record loading from disk is within bounds.
Patch 2 moves the ATTR_RECORD's bounds checking earlier, to avoid
dereferencing ATTR_RECORD before checking this ATTR_RECORD is within
bounds.
Patch 3 adds an overflow checking to avoid possible forever loop in
ntfs_attr_find().
Without patch 1 and patch 2, the kernel triggersa KASAN use-after-free
detection as reported by Syzkaller.
Although one of patch 1 or patch 2 can fix this, we still need
Debian
CVE-2022-49763: linux - In the Linux kernel, the following vulnerability has been resolved: ntfs: fix u...
vendor_debian·2022·CVSS 7.8
CVE-2022-49763 [HIGH] CVE-2022-49763: linux - In the Linux kernel, the following vulnerability has been resolved: ntfs: fix u...
In the Linux kernel, the following vulnerability has been resolved: ntfs: fix use-after-free in ntfs_attr_find() Patch series "ntfs: fix bugs about Attribute", v2. This patchset fixes three bugs relative to Attribute in record: Patch 1 adds a sanity check to ensure that, attrs_offset field in first mft record loading from disk is within bounds. Patch 2 moves the ATTR_RECORD's bounds checking earlier, to avoid dereferencing ATTR_RECORD before checking this ATTR_RECORD is within bounds. Patch 3 adds an overflow checking to avoid possible forever loop in ntfs_attr_find(). Without patch 1 and patch 2, the kernel triggersa KASAN use-after-free detection as reported by Syzkaller. Although one of patch 1 or patch 2 can fix this, we still need both of them. Because patch 1 fixes the root cause, an
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/266bd5306286316758e6246ea0345133427b0f62https://git.kernel.org/stable/c/4863f815463034f588a035cfd99cdca97a4f1069https://git.kernel.org/stable/c/5330c423b86263ac7883fef0260b9e2229cb531ehttps://git.kernel.org/stable/c/79f3ac7dcd12c05b7539239a4c6fa229a50d786chttps://git.kernel.org/stable/c/b825bfbbaafbe8da2037e3a778ad660c59f9e054https://git.kernel.org/stable/c/d0006d739738a658a9c29b438444259d9f71dfa0https://git.kernel.org/stable/c/d85a1bec8e8d552ab13163ca1874dcd82f3d1550https://git.kernel.org/stable/c/fb2004bafd1932e08d21ca604ee5844f2b7f212d
2025-05-01
Published