In the Linux kernel, the following vulnerability has been resolved:
afs: Fix dynamic root getattr
The recent patch to make afs_getattr consult the server didn't account for the pseudo-inodes employed by the dynamic root-type afs superblock not having a volume or a server to access, and thus an oops occurs if such a directory is stat'd.
Fix this by checking to see if the vnode->volume pointer actually points anywhere before following it in afs_getattr().
This can be tested by stat'ing a directory in /afs. It may be sufficient just to do "ls /afs" and the oops looks something like:
BUG: kernel NULL pointer dereference, address: 0000000000000020
...
RIP: 0010:afs_getattr+0x8b/0x14b
...
Call Trace:
<TASK>
vfs_statx+0x79/0xf5
vfs_fstatat+0x49/0x62
[
{
"signature_version": "v1",
"id": "CVE-2022-49688-40cc9225",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"330011052491787644330412624826695489711",
"119323730918352270985088229201840183486",
"41901998969537362022852419439128419224",
"291367518907771381481832766445438514926"
]
},
"target": {
"file": "fs/afs/inode.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@65c24caf1b9f5b08397c6e805ec24ebc390c6e4d",
"deprecated": false
},
{
"signature_version": "v1",
"id": "CVE-2022-49688-40d05118",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"330011052491787644330412624826695489711",
"119323730918352270985088229201840183486",
"41901998969537362022852419439128419224",
"291367518907771381481832766445438514926"
]
},
"target": {
"file": "fs/afs/inode.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7b564e3254b7db5fbfbf11a824627a6c31b932b4",
"deprecated": false
},
{
"signature_version": "v1",
"id": "CVE-2022-49688-4280eec2",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"330011052491787644330412624826695489711",
"119323730918352270985088229201840183486",
"41901998969537362022852419439128419224",
"291367518907771381481832766445438514926"
]
},
"target": {
"file": "fs/afs/inode.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e3a232e5767051483ffad4cef7d0a89d292a192b",
"deprecated": false
},
{
"signature_version": "v1",
"id": "CVE-2022-49688-4d518d64",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"330011052491787644330412624826695489711",
"119323730918352270985088229201840183486",
"41901998969537362022852419439128419224",
"291367518907771381481832766445438514926"
]
},
"target": {
"file": "fs/afs/inode.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cb78d1b5efffe4cf97e16766329dd7358aed3deb",
"deprecated": false
},
{
"signature_version": "v1",
"id": "CVE-2022-49688-75f10899",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"330011052491787644330412624826695489711",
"119323730918352270985088229201840183486",
"41901998969537362022852419439128419224",
"291367518907771381481832766445438514926"
]
},
"target": {
"file": "fs/afs/inode.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2b2bba96526f25f2eba74ecadb031de2e05a83ce",
"deprecated": false
},
{
"signature_version": "v1",
"id": "CVE-2022-49688-9c5ae706",
"signature_type": "Function",
"digest": {
"length": 828.0,
"function_hash": "303196797824282560655103072148666067529"
},
"target": {
"file": "fs/afs/inode.c",
"function": "afs_getattr"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7b564e3254b7db5fbfbf11a824627a6c31b932b4",
"deprecated": false
},
{
"signature_version": "v1",
"id": "CVE-2022-49688-aa7e24f0",
"signature_type": "Function",
"digest": {
"length": 861.0,
"function_hash": "207704007910821861074650301664141943774"
},
"target": {
"file": "fs/afs/inode.c",
"function": "afs_getattr"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7844ceada44eca740d31beb3d97b8511b1ca0a9b",
"deprecated": false
},
{
"signature_version": "v1",
"id": "CVE-2022-49688-b7ab155c",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"330011052491787644330412624826695489711",
"119323730918352270985088229201840183486",
"41901998969537362022852419439128419224",
"291367518907771381481832766445438514926"
]
},
"target": {
"file": "fs/afs/inode.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7844ceada44eca740d31beb3d97b8511b1ca0a9b",
"deprecated": false
},
{
"signature_version": "v1",
"id": "CVE-2022-49688-cc3203fa",
"signature_type": "Function",
"digest": {
"length": 861.0,
"function_hash": "207704007910821861074650301664141943774"
},
"target": {
"file": "fs/afs/inode.c",
"function": "afs_getattr"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cb78d1b5efffe4cf97e16766329dd7358aed3deb",
"deprecated": false
},
{
"signature_version": "v1",
"id": "CVE-2022-49688-dc0986cc",
"signature_type": "Function",
"digest": {
"length": 861.0,
"function_hash": "207704007910821861074650301664141943774"
},
"target": {
"file": "fs/afs/inode.c",
"function": "afs_getattr"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2b2bba96526f25f2eba74ecadb031de2e05a83ce",
"deprecated": false
},
{
"signature_version": "v1",
"id": "CVE-2022-49688-f0d9e954",
"signature_type": "Function",
"digest": {
"length": 723.0,
"function_hash": "220048036879224463262804889248315678619"
},
"target": {
"file": "fs/afs/inode.c",
"function": "afs_getattr"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e3a232e5767051483ffad4cef7d0a89d292a192b",
"deprecated": false
},
{
"signature_version": "v1",
"id": "CVE-2022-49688-f77985fe",
"signature_type": "Function",
"digest": {
"length": 723.0,
"function_hash": "220048036879224463262804889248315678619"
},
"target": {
"file": "fs/afs/inode.c",
"function": "afs_getattr"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@65c24caf1b9f5b08397c6e805ec24ebc390c6e4d",
"deprecated": false
}
]