CVE-2022-49834

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

nilfs2: fix use-after-free bug of ns_writer on remount

If a nilfs2 filesystem is downgraded to read-only due to metadata

corruption on disk and is remounted read/write, or if emergency read-only

remount is performed, detaching a log writer and synchronizing the

filesystem can be done at the same time.

In these cases, use-after-free of the log writer (hereinafter

nilfs->ns_writer) can happen as shown in the scenario below:

Task1 Task2

-------------------------------- ------------------------------

nilfs_construct_segment

nilfs_segctor_sync

init_wait

init_waitqueue_entry

add_wait_queue

schedule

nilfs_remount (R/W remount case)

nilfs_attach_log_writer

nilfs_detach_log_writer

nilfs_segctor_destroy

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References