CVE-2022-49170

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

f2fs: fix to do sanity check on curseg->alloc_type

As Wenqing Liu reported in bugzilla:

https://bugzilla.kernel.org/show_bug.cgi?id=215657

- Overview

UBSAN: array-index-out-of-bounds in fs/f2fs/segment.c:3460:2 when mount and operate a corrupted image

- Reproduce

tested on kernel 5.17-rc4, 5.17-rc6

1. mkdir test_crash

2. cd test_crash

3. unzip tmp2.zip

4. mkdir mnt

5. ./single_test.sh f2fs 2

- Kernel dump

[ 46.434454] loop0: detected capacity change from 0 to 131072

[ 46.529839] F2FS-fs (loop0): Mounted with checkpoint version = 7548c2d9

[ 46.738319] ================================================================================

[ 46.738412] UBSAN: array-index-out-of-bounds in fs/f2fs/segment.c:3460:2

[ 46.738475] index 231 is out of range for type 'unsigned int [2]'

[ 46.738539] CPU: 2 PID: 939 Comm: umount Not tainted 5.17.0-rc6 #1

[ 46.738547] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009),

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References