CVE-2022-49739

Summary

In the Linux kernel, the following vulnerability has been resolved:

gfs2: Always check inode size of inline inodes

Check if the inode size of stuffed (inline) inodes is within the allowed range when reading inodes from disk (gfs2_dinode_in()). This prevents us from on-disk corruption.

The two checks in stuffed_readpage() and gfs2_unstuffer_page() that just truncate inline data to the maximum allowed size don't actually make sense, and they can be removed now as well.

Affected Software

VendorProductVersion RangeStatus
LinuxLinuxb3b94faa5fe5968827ba0640ee9fba4b3e7f736e < 45df749f827c286adbc951f2a4865b67f0442ba9affected
LinuxLinuxb3b94faa5fe5968827ba0640ee9fba4b3e7f736e < 4d4cb76636134bf9a0c9c3432dae936f99954586affected
LinuxLinuxb3b94faa5fe5968827ba0640ee9fba4b3e7f736e < 7c414f6f06e9a3934901b6edc3177ae5a1e07094affected
LinuxLinuxb3b94faa5fe5968827ba0640ee9fba4b3e7f736e < 46c9088cabd4d0469fdb61ac2a9c5003057fe94daffected
LinuxLinuxb3b94faa5fe5968827ba0640ee9fba4b3e7f736e < d458a0984429c2d47e60254f5bc4119cbafe83a2affected
LinuxLinuxb3b94faa5fe5968827ba0640ee9fba4b3e7f736e < 70376c7ff31221f1d21db5611d8209e677781d3aaffected
LinuxLinux2.6.19affected
LinuxLinux0 < 2.6.19unaffected
LinuxLinux4.19.280 <= 4.19.*unaffected
LinuxLinux5.4.240 <= 5.4.*unaffected
LinuxLinux5.10.177 <= 5.10.*unaffected
LinuxLinux5.15.93 <= 5.15.*unaffected
LinuxLinux6.1.11 <= 6.1.*unaffected
LinuxLinux6.2 <= *unaffected

Weaknesses

References