In the Linux kernel, the following vulnerability has been resolved:
f2fs: fix dereference of stale list iterator after loop body
The list iterator variable will be a bogus pointer if no break was hit. Dereferencing it (cur->page in this case) could load an out-of-bounds/undefined value making it unsafe to use that in the comparision to determine if the specific element was found.
Since 'cur->page' can be out-ouf-bounds it cannot be guaranteed that by chance (or intention of an attacker) it matches the value of 'page' even though the correct element was not found.
This is fixed by using a separate list iterator variable for the loop and only setting the original variable if a suitable element was found. Then determing if the element was found is simply checking if the variable is set.
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49425.json"
}[
{
"digest": {
"length": 649.0,
"function_hash": "143179377632372545536046847934019818738"
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2022-49425-03e82277",
"target": {
"function": "f2fs_drop_inmem_page",
"file": "fs/f2fs/segment.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@51d584704d18e60fa473823654f35611c777b291"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"322394896616536620853338213376414213760",
"263921503009744518120421667601918599621",
"105899753138168871840017059318008789149",
"288330318664786748700124842832388090156",
"233515947815273242917088371508691996497",
"295494775448054205146246240854572336138",
"212298366121831563037409383588354567026",
"213830423239471933696480334459497302401",
"328277729030879156307596793198714360351",
"157535018570798278890145216583808075796",
"50256910772562510659674380436978252422"
]
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line",
"id": "CVE-2022-49425-534bdb72",
"target": {
"file": "fs/f2fs/segment.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b26e1c777890e4b938136deb8ec07a29f33862e4"
},
{
"digest": {
"length": 695.0,
"function_hash": "230864824801224338925378468685463465067"
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2022-49425-576094b7",
"target": {
"function": "f2fs_drop_inmem_page",
"file": "fs/f2fs/segment.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b26e1c777890e4b938136deb8ec07a29f33862e4"
},
{
"digest": {
"length": 695.0,
"function_hash": "230864824801224338925378468685463465067"
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2022-49425-6a68b719",
"target": {
"function": "f2fs_drop_inmem_page",
"file": "fs/f2fs/segment.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2aaf51dd39afb6d01d13f1e6fe20b684733b37d5"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"322394896616536620853338213376414213760",
"135035135942006831031051527700349292952",
"139779931088339258165308901367496115388",
"331019540771937646006773490622714582593",
"87188239688510535955690398088644047137",
"295494775448054205146246240854572336138",
"212298366121831563037409383588354567026",
"213830423239471933696480334459497302401",
"328277729030879156307596793198714360351",
"157535018570798278890145216583808075796",
"50256910772562510659674380436978252422"
]
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line",
"id": "CVE-2022-49425-6ce7f394",
"target": {
"file": "fs/f2fs/segment.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5e47a7add3dda7f236548c5ec3017776dc2a729f"
},
{
"digest": {
"length": 674.0,
"function_hash": "21720124352406591839274121394172190040"
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2022-49425-77f42606",
"target": {
"function": "f2fs_drop_inmem_page",
"file": "fs/f2fs/segment.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@385edd3ce5b4b1e9d31f474a5e35a39779ec1110"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"322394896616536620853338213376414213760",
"263921503009744518120421667601918599621",
"105899753138168871840017059318008789149",
"288330318664786748700124842832388090156",
"233515947815273242917088371508691996497",
"295494775448054205146246240854572336138",
"212298366121831563037409383588354567026",
"213830423239471933696480334459497302401",
"328277729030879156307596793198714360351",
"157535018570798278890145216583808075796",
"50256910772562510659674380436978252422"
]
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line",
"id": "CVE-2022-49425-82aaa13d",
"target": {
"file": "fs/f2fs/segment.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@45b2b7d7108ae1e25a5036cab04ab9273e792332"
},
{
"digest": {
"length": 649.0,
"function_hash": "143179377632372545536046847934019818738"
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2022-49425-a6bdb3ba",
"target": {
"function": "f2fs_drop_inmem_page",
"file": "fs/f2fs/segment.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5e47a7add3dda7f236548c5ec3017776dc2a729f"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"322394896616536620853338213376414213760",
"263921503009744518120421667601918599621",
"105899753138168871840017059318008789149",
"288330318664786748700124842832388090156",
"233515947815273242917088371508691996497",
"295494775448054205146246240854572336138",
"212298366121831563037409383588354567026",
"213830423239471933696480334459497302401",
"328277729030879156307596793198714360351",
"157535018570798278890145216583808075796",
"50256910772562510659674380436978252422"
]
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line",
"id": "CVE-2022-49425-dd327196",
"target": {
"file": "fs/f2fs/segment.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2aaf51dd39afb6d01d13f1e6fe20b684733b37d5"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"322394896616536620853338213376414213760",
"263921503009744518120421667601918599621",
"105899753138168871840017059318008789149",
"288330318664786748700124842832388090156",
"233515947815273242917088371508691996497",
"295494775448054205146246240854572336138",
"212298366121831563037409383588354567026",
"213830423239471933696480334459497302401",
"328277729030879156307596793198714360351",
"157535018570798278890145216583808075796",
"50256910772562510659674380436978252422"
]
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line",
"id": "CVE-2022-49425-e1a4446e",
"target": {
"file": "fs/f2fs/segment.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ed7efc472c00986dcd6903ab6ed165c7fa167674"
},
{
"digest": {
"length": 695.0,
"function_hash": "230864824801224338925378468685463465067"
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2022-49425-e1c39ba5",
"target": {
"function": "f2fs_drop_inmem_page",
"file": "fs/f2fs/segment.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ed7efc472c00986dcd6903ab6ed165c7fa167674"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"322394896616536620853338213376414213760",
"135035135942006831031051527700349292952",
"139779931088339258165308901367496115388",
"331019540771937646006773490622714582593",
"87188239688510535955690398088644047137",
"295494775448054205146246240854572336138",
"212298366121831563037409383588354567026",
"213830423239471933696480334459497302401",
"328277729030879156307596793198714360351",
"157535018570798278890145216583808075796",
"50256910772562510659674380436978252422"
]
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line",
"id": "CVE-2022-49425-ea07a1e4",
"target": {
"file": "fs/f2fs/segment.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@385edd3ce5b4b1e9d31f474a5e35a39779ec1110"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"322394896616536620853338213376414213760",
"135035135942006831031051527700349292952",
"139779931088339258165308901367496115388",
"331019540771937646006773490622714582593",
"87188239688510535955690398088644047137",
"295494775448054205146246240854572336138",
"212298366121831563037409383588354567026",
"213830423239471933696480334459497302401",
"328277729030879156307596793198714360351",
"157535018570798278890145216583808075796",
"50256910772562510659674380436978252422"
]
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line",
"id": "CVE-2022-49425-ed53e9b3",
"target": {
"file": "fs/f2fs/segment.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@51d584704d18e60fa473823654f35611c777b291"
},
{
"digest": {
"length": 695.0,
"function_hash": "230864824801224338925378468685463465067"
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2022-49425-f780cc55",
"target": {
"function": "f2fs_drop_inmem_page",
"file": "fs/f2fs/segment.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@45b2b7d7108ae1e25a5036cab04ab9273e792332"
}
]
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-49425.json"