CVE-2022-48631

Source
https://nvd.nist.gov/vuln/detail/CVE-2022-48631
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-48631.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-48631
Related
Published
2024-04-28T13:15:06Z
Modified
2024-09-18T03:22:29.562896Z
Summary
[none]
Details

In the Linux kernel, the following vulnerability has been resolved:

ext4: fix bug in extents parsing when ehentries == 0 and ehdepth > 0

When walking through an inode extents, the ext4extbinsearchidx() function assumes that the extent header has been previously validated. However, there are no checks that verify that the number of entries (eh->ehentries) is non-zero when depth is > 0. And this will lead to problems because the EXTFIRSTINDEX() and EXTLASTINDEX() will return garbage and result in this:

[ 135.245946] ------------[ cut here ]------------ [ 135.247579] kernel BUG at fs/ext4/extents.c:2258! [ 135.249045] invalid opcode: 0000 [#1] PREEMPT SMP [ 135.250320] CPU: 2 PID: 238 Comm: tmp118 Not tainted 5.19.0-rc8+ #4 [ 135.252067] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.15.0-0-g2dd4b9b-rebuilt.opensuse.org 04/01/2014 [ 135.255065] RIP: 0010:ext4extmapblocks+0xc20/0xcb0 [ 135.256475] Code: [ 135.261433] RSP: 0018:ffffc900005939f8 EFLAGS: 00010246 [ 135.262847] RAX: 0000000000000024 RBX: ffffc90000593b70 RCX: 0000000000000023 [ 135.264765] RDX: ffff8880038e5f10 RSI: 0000000000000003 RDI: ffff8880046e922c [ 135.266670] RBP: ffff8880046e9348 R08: 0000000000000001 R09: ffff888002ca580c [ 135.268576] R10: 0000000000002602 R11: 0000000000000000 R12: 0000000000000024 [ 135.270477] R13: 0000000000000000 R14: 0000000000000024 R15: 0000000000000000 [ 135.272394] FS: 00007fdabdc56740(0000) GS:ffff88807dd00000(0000) knlGS:0000000000000000 [ 135.274510] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 135.276075] CR2: 00007ffc26bd4f00 CR3: 0000000006261004 CR4: 0000000000170ea0 [ 135.277952] Call Trace: [ 135.278635] <TASK> [ 135.279247] ? preemptcountadd+0x6d/0xa0 [ 135.280358] ? percpucounteraddbatch+0x55/0xb0 [ 135.281612] ? rawreadunlock+0x18/0x30 [ 135.282704] ext4mapblocks+0x294/0x5a0 [ 135.283745] ? xaload+0x6f/0xa0 [ 135.284562] ext4mpagereadpages+0x3d6/0x770 [ 135.285646] readpages+0x67/0x1d0 [ 135.286492] ? folioaddlru+0x51/0x80 [ 135.287441] pagecacheraunbounded+0x124/0x170 [ 135.288510] filemapgetpages+0x23d/0x5a0 [ 135.289457] ? pathopenat+0xa72/0xdd0 [ 135.290332] filemapread+0xbf/0x300 [ 135.291158] ? rawspinlockirqsave+0x17/0x40 [ 135.292192] newsyncread+0x103/0x170 [ 135.293014] vfsread+0x15d/0x180 [ 135.293745] ksysread+0xa1/0xe0 [ 135.294461] dosyscall64+0x3c/0x80 [ 135.295284] entrySYSCALL64afterhwframe+0x46/0xb0

This patch simply adds an extra check in _ext4extcheck(), verifying that ehentries is not 0 when eh_depth is > 0.

References

Affected packages

Debian:11 / linux

Package

Name
linux
Purl
pkg:deb/debian/linux?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
5.10.148-1

Affected versions

5.*

5.10.46-4
5.10.46-5
5.10.70-1~bpo10+1
5.10.70-1
5.10.84-1
5.10.92-1~bpo10+1
5.10.92-1
5.10.92-2
5.10.103-1~bpo10+1
5.10.103-1
5.10.106-1
5.10.113-1
5.10.120-1~bpo10+1
5.10.120-1
5.10.127-1
5.10.127-2~bpo10+1
5.10.127-2
5.10.136-1
5.10.140-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:12 / linux

Package

Name
linux
Purl
pkg:deb/debian/linux?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
6.0.2-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:13 / linux

Package

Name
linux
Purl
pkg:deb/debian/linux?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
6.0.2-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}