In the Linux kernel, the following vulnerability has been resolved:
f2fs: fix dereference of stale list iterator after loop body
The list iterator variable will be a bogus pointer if no break was hit. Dereferencing it (cur->page in this case) could load an out-of-bounds/undefined value making it unsafe to use that in the comparision to determine if the specific element was found.
Since 'cur->page' can be out-ouf-bounds it cannot be guaranteed that by chance (or intention of an attacker) it matches the value of 'page' even though the correct element was not found.
This is fixed by using a separate list iterator variable for the loop and only setting the original variable if a suitable element was found. Then determing if the element was found is simply checking if the variable is set.
[
{
"digest": {
"function_hash": "143179377632372545536046847934019818738",
"length": 649.0
},
"target": {
"file": "fs/f2fs/segment.c",
"function": "f2fs_drop_inmem_page"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@51d584704d18e60fa473823654f35611c777b291",
"id": "CVE-2022-49425-03e82277"
},
{
"digest": {
"line_hashes": [
"322394896616536620853338213376414213760",
"263921503009744518120421667601918599621",
"105899753138168871840017059318008789149",
"288330318664786748700124842832388090156",
"233515947815273242917088371508691996497",
"295494775448054205146246240854572336138",
"212298366121831563037409383588354567026",
"213830423239471933696480334459497302401",
"328277729030879156307596793198714360351",
"157535018570798278890145216583808075796",
"50256910772562510659674380436978252422"
],
"threshold": 0.9
},
"target": {
"file": "fs/f2fs/segment.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b26e1c777890e4b938136deb8ec07a29f33862e4",
"id": "CVE-2022-49425-534bdb72"
},
{
"digest": {
"function_hash": "230864824801224338925378468685463465067",
"length": 695.0
},
"target": {
"file": "fs/f2fs/segment.c",
"function": "f2fs_drop_inmem_page"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b26e1c777890e4b938136deb8ec07a29f33862e4",
"id": "CVE-2022-49425-576094b7"
},
{
"digest": {
"function_hash": "230864824801224338925378468685463465067",
"length": 695.0
},
"target": {
"file": "fs/f2fs/segment.c",
"function": "f2fs_drop_inmem_page"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2aaf51dd39afb6d01d13f1e6fe20b684733b37d5",
"id": "CVE-2022-49425-6a68b719"
},
{
"digest": {
"line_hashes": [
"322394896616536620853338213376414213760",
"135035135942006831031051527700349292952",
"139779931088339258165308901367496115388",
"331019540771937646006773490622714582593",
"87188239688510535955690398088644047137",
"295494775448054205146246240854572336138",
"212298366121831563037409383588354567026",
"213830423239471933696480334459497302401",
"328277729030879156307596793198714360351",
"157535018570798278890145216583808075796",
"50256910772562510659674380436978252422"
],
"threshold": 0.9
},
"target": {
"file": "fs/f2fs/segment.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5e47a7add3dda7f236548c5ec3017776dc2a729f",
"id": "CVE-2022-49425-6ce7f394"
},
{
"digest": {
"function_hash": "21720124352406591839274121394172190040",
"length": 674.0
},
"target": {
"file": "fs/f2fs/segment.c",
"function": "f2fs_drop_inmem_page"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@385edd3ce5b4b1e9d31f474a5e35a39779ec1110",
"id": "CVE-2022-49425-77f42606"
},
{
"digest": {
"line_hashes": [
"322394896616536620853338213376414213760",
"263921503009744518120421667601918599621",
"105899753138168871840017059318008789149",
"288330318664786748700124842832388090156",
"233515947815273242917088371508691996497",
"295494775448054205146246240854572336138",
"212298366121831563037409383588354567026",
"213830423239471933696480334459497302401",
"328277729030879156307596793198714360351",
"157535018570798278890145216583808075796",
"50256910772562510659674380436978252422"
],
"threshold": 0.9
},
"target": {
"file": "fs/f2fs/segment.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@45b2b7d7108ae1e25a5036cab04ab9273e792332",
"id": "CVE-2022-49425-82aaa13d"
},
{
"digest": {
"function_hash": "143179377632372545536046847934019818738",
"length": 649.0
},
"target": {
"file": "fs/f2fs/segment.c",
"function": "f2fs_drop_inmem_page"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5e47a7add3dda7f236548c5ec3017776dc2a729f",
"id": "CVE-2022-49425-a6bdb3ba"
},
{
"digest": {
"line_hashes": [
"322394896616536620853338213376414213760",
"263921503009744518120421667601918599621",
"105899753138168871840017059318008789149",
"288330318664786748700124842832388090156",
"233515947815273242917088371508691996497",
"295494775448054205146246240854572336138",
"212298366121831563037409383588354567026",
"213830423239471933696480334459497302401",
"328277729030879156307596793198714360351",
"157535018570798278890145216583808075796",
"50256910772562510659674380436978252422"
],
"threshold": 0.9
},
"target": {
"file": "fs/f2fs/segment.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2aaf51dd39afb6d01d13f1e6fe20b684733b37d5",
"id": "CVE-2022-49425-dd327196"
},
{
"digest": {
"line_hashes": [
"322394896616536620853338213376414213760",
"263921503009744518120421667601918599621",
"105899753138168871840017059318008789149",
"288330318664786748700124842832388090156",
"233515947815273242917088371508691996497",
"295494775448054205146246240854572336138",
"212298366121831563037409383588354567026",
"213830423239471933696480334459497302401",
"328277729030879156307596793198714360351",
"157535018570798278890145216583808075796",
"50256910772562510659674380436978252422"
],
"threshold": 0.9
},
"target": {
"file": "fs/f2fs/segment.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ed7efc472c00986dcd6903ab6ed165c7fa167674",
"id": "CVE-2022-49425-e1a4446e"
},
{
"digest": {
"function_hash": "230864824801224338925378468685463465067",
"length": 695.0
},
"target": {
"file": "fs/f2fs/segment.c",
"function": "f2fs_drop_inmem_page"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ed7efc472c00986dcd6903ab6ed165c7fa167674",
"id": "CVE-2022-49425-e1c39ba5"
},
{
"digest": {
"line_hashes": [
"322394896616536620853338213376414213760",
"135035135942006831031051527700349292952",
"139779931088339258165308901367496115388",
"331019540771937646006773490622714582593",
"87188239688510535955690398088644047137",
"295494775448054205146246240854572336138",
"212298366121831563037409383588354567026",
"213830423239471933696480334459497302401",
"328277729030879156307596793198714360351",
"157535018570798278890145216583808075796",
"50256910772562510659674380436978252422"
],
"threshold": 0.9
},
"target": {
"file": "fs/f2fs/segment.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@385edd3ce5b4b1e9d31f474a5e35a39779ec1110",
"id": "CVE-2022-49425-ea07a1e4"
},
{
"digest": {
"line_hashes": [
"322394896616536620853338213376414213760",
"135035135942006831031051527700349292952",
"139779931088339258165308901367496115388",
"331019540771937646006773490622714582593",
"87188239688510535955690398088644047137",
"295494775448054205146246240854572336138",
"212298366121831563037409383588354567026",
"213830423239471933696480334459497302401",
"328277729030879156307596793198714360351",
"157535018570798278890145216583808075796",
"50256910772562510659674380436978252422"
],
"threshold": 0.9
},
"target": {
"file": "fs/f2fs/segment.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@51d584704d18e60fa473823654f35611c777b291",
"id": "CVE-2022-49425-ed53e9b3"
},
{
"digest": {
"function_hash": "230864824801224338925378468685463465067",
"length": 695.0
},
"target": {
"file": "fs/f2fs/segment.c",
"function": "f2fs_drop_inmem_page"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@45b2b7d7108ae1e25a5036cab04ab9273e792332",
"id": "CVE-2022-49425-f780cc55"
}
]