CVE-2022-50478

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

nilfs2: fix shift-out-of-bounds/overflow in nilfs_sb2_bad_offset()

Patch series "nilfs2: fix UBSAN shift-out-of-bounds warnings on mount

time".

The first patch fixes a bug reported by syzbot, and the second one fixes

the remaining bug of the same kind. Although they are triggered by the

same super block data anomaly, I divided it into the above two because the

details of the issues and how to fix it are different.

Both are required to eliminate the shift-out-of-bounds issues at mount

time.

This patch (of 2):

If the block size exponent information written in an on-disk superblock is

corrupted, nilfs_sb2_bad_offset helper function can trigger

shift-out-of-bounds warning followed by a kernel panic (if panic_on_warn

is set):

shift exponent 38983 is too large for 64-bit type 'unsigned long long'

Call Trace:

<TASK>

__dump_stack lib/dump_stack.c:88 [inline]

dump_stack_lvl+0x1b1/0x28e lib/dump_stack.c:106

ub

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References