CVE-2022-49428

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

f2fs: fix to do sanity check on inline_dots inode

As Wenqing reported in bugzilla:

https://bugzilla.kernel.org/show_bug.cgi?id=215765

It will cause a kernel panic with steps:

- mkdir mnt

- mount tmp40.img mnt

- ls mnt

folio_mark_dirty+0x33/0x50

f2fs_add_regular_entry+0x541/0xad0 [f2fs]

f2fs_add_dentry+0x6c/0xb0 [f2fs]

f2fs_do_add_link+0x182/0x230 [f2fs]

__recover_dot_dentries+0x2d6/0x470 [f2fs]

f2fs_lookup+0x5af/0x6a0 [f2fs]

__lookup_slow+0xac/0x200

lookup_slow+0x45/0x70

walk_component+0x16c/0x250

path_lookupat+0x8b/0x1f0

filename_lookup+0xef/0x250

user_path_at_empty+0x46/0x70

vfs_statx+0x98/0x190

__do_sys_newlstat+0x41/0x90

__x64_sys_newlstat+0x1a/0x30

do_syscall_64+0x37/0xb0

entry_SYSCALL_64_after_hwframe+0x44/0xae

The root cause is for special file: e.g. character, block, fifo or

socket file, f2fs doesn't assign address space operations pointer array

for mapping->a_ops field, so, in a fuzzed image, if inline_d

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References