CVE-2022-49343

Summary

In the Linux kernel, the following vulnerability has been resolved:

ext4: avoid cycles in directory h-tree

A maliciously corrupted filesystem can contain cycles in the h-tree stored inside a directory. That can easily lead to the kernel corrupting tree nodes that were already verified under its hands while doing a node split and consequently accessing unallocated memory. Fix the problem by verifying traversed block numbers are unique.

Affected Software

VendorProductVersion RangeStatus
LinuxLinuxac27a0ec112a089f1a5102bc8dffc79c8c815571 < 24b8206fec1db21d7e82f21f0b2ff5e5672cf5b3affected
LinuxLinuxac27a0ec112a089f1a5102bc8dffc79c8c815571 < b3ad9ff6f06c1dc6abf7437691c88ca3d6da3ac0affected
LinuxLinuxac27a0ec112a089f1a5102bc8dffc79c8c815571 < e157c8f87e8fac112d6c955e69a60cdb9bc80a60affected
LinuxLinuxac27a0ec112a089f1a5102bc8dffc79c8c815571 < ff4cafa51762da3824881a9000ca421d4b78b138affected
LinuxLinuxac27a0ec112a089f1a5102bc8dffc79c8c815571 < 3a3ce941645407cd0b0b7f01ad9e2ea3770f46ccaffected
LinuxLinuxac27a0ec112a089f1a5102bc8dffc79c8c815571 < d5a16a6df2c16eaf4de04948553ef0089dee463faffected
LinuxLinuxac27a0ec112a089f1a5102bc8dffc79c8c815571 < 6084240bfc44bf265ab6ae7d96980469b05be0f1affected
LinuxLinuxac27a0ec112a089f1a5102bc8dffc79c8c815571 < 3ba733f879c2a88910744647e41edeefbc0d92b2affected
LinuxLinux2.6.19affected
LinuxLinux0 < 2.6.19unaffected
LinuxLinux4.14.283 <= 4.14.*unaffected
LinuxLinux4.19.247 <= 4.19.*unaffected
LinuxLinux5.4.198 <= 5.4.*unaffected
LinuxLinux5.10.121 <= 5.10.*unaffected
LinuxLinux5.15.46 <= 5.15.*unaffected
LinuxLinux5.17.14 <= 5.17.*unaffected
LinuxLinux5.18.3 <= 5.18.*unaffected
LinuxLinux5.19 <= *unaffected

Weaknesses

References