In the Linux kernel, the following vulnerability has been resolved:
ext4: fix BUGON() when directory entry has invalid reclen
The reclen field in the directory entry has to be a multiple of 4. A corrupted filesystem image can be used to hit a BUG() in ext4reclentodisk(), called from makeindexed_dir().
------------[ cut here ]------------ kernel BUG at fs/ext4/ext4.h:2413! ... RIP: 0010:makeindexeddir+0x53f/0x5f0 ... Call Trace: <TASK> ? adddirenttobuf+0x1b2/0x200 ext4addentry+0x36e/0x480 ext4addnondir+0x2b/0xc0 ext4create+0x163/0x200 pathopenat+0x635/0xe90 dofilpopen+0xb4/0x160 ? _createobject.isra.0+0x1de/0x3b0 ? _rawspinunlock+0x12/0x30 dosysopenat2+0x91/0x150 _x64sysopen+0x6c/0xa0 dosyscall64+0x3c/0x80 entrySYSCALL64afterhwframe+0x46/0xb0
The fix simply adds a call to ext4checkdir_entry() to validate the directory entry, returning -EFSCORRUPTED if the entry is invalid.
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@17a0bc9bd697f75cfdf9b378d5eb2d7409c91340",
"target": {
"file": "fs/ext4/namei.c"
},
"deprecated": false,
"id": "CVE-2022-49879-16188b43",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"165067666980717526645497975039336784303",
"32264494554214617628616755344749608576",
"311317344829676554688849635630386474098",
"213660711681536935099665177435869424635",
"177943568859678942507372855908540432723"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@17a0bc9bd697f75cfdf9b378d5eb2d7409c91340",
"target": {
"function": "make_indexed_dir",
"file": "fs/ext4/namei.c"
},
"deprecated": false,
"id": "CVE-2022-49879-2a5b2977",
"signature_version": "v1",
"digest": {
"length": 2966.0,
"function_hash": "287451438054444231134550866265026311875"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@156451a67b93986fb07c274ef6995ff40766c5ad",
"target": {
"function": "make_indexed_dir",
"file": "fs/ext4/namei.c"
},
"deprecated": false,
"id": "CVE-2022-49879-3e7cd45e",
"signature_version": "v1",
"digest": {
"length": 2792.0,
"function_hash": "6305364615006279860215594366093117577"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2fa24d0274fbf913b56ee31f15bc01168669d909",
"target": {
"file": "fs/ext4/namei.c"
},
"deprecated": false,
"id": "CVE-2022-49879-3f6ad22c",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"154124003170373180943149346354495277790",
"32264494554214617628616755344749608576",
"311317344829676554688849635630386474098",
"213660711681536935099665177435869424635",
"177943568859678942507372855908540432723"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2fa24d0274fbf913b56ee31f15bc01168669d909",
"target": {
"function": "make_indexed_dir",
"file": "fs/ext4/namei.c"
},
"deprecated": false,
"id": "CVE-2022-49879-42755517",
"signature_version": "v1",
"digest": {
"length": 2792.0,
"function_hash": "6305364615006279860215594366093117577"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ce1ee2c8827fb6493e91acbd50f664cf2a972c3d",
"target": {
"function": "make_indexed_dir",
"file": "fs/ext4/namei.c"
},
"deprecated": false,
"id": "CVE-2022-49879-54eb8de0",
"signature_version": "v1",
"digest": {
"length": 2966.0,
"function_hash": "287451438054444231134550866265026311875"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ce1ee2c8827fb6493e91acbd50f664cf2a972c3d",
"target": {
"file": "fs/ext4/namei.c"
},
"deprecated": false,
"id": "CVE-2022-49879-8d3700a0",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"165067666980717526645497975039336784303",
"32264494554214617628616755344749608576",
"311317344829676554688849635630386474098",
"213660711681536935099665177435869424635",
"177943568859678942507372855908540432723"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@999cff2b6ce3b45c08abf793bf55534777421327",
"target": {
"function": "make_indexed_dir",
"file": "fs/ext4/namei.c"
},
"deprecated": false,
"id": "CVE-2022-49879-b46698b6",
"signature_version": "v1",
"digest": {
"length": 2966.0,
"function_hash": "287451438054444231134550866265026311875"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@156451a67b93986fb07c274ef6995ff40766c5ad",
"target": {
"file": "fs/ext4/namei.c"
},
"deprecated": false,
"id": "CVE-2022-49879-c1d7ab69",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"154124003170373180943149346354495277790",
"32264494554214617628616755344749608576",
"311317344829676554688849635630386474098",
"213660711681536935099665177435869424635",
"177943568859678942507372855908540432723"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@999cff2b6ce3b45c08abf793bf55534777421327",
"target": {
"file": "fs/ext4/namei.c"
},
"deprecated": false,
"id": "CVE-2022-49879-f511de30",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"165067666980717526645497975039336784303",
"32264494554214617628616755344749608576",
"311317344829676554688849635630386474098",
"213660711681536935099665177435869424635",
"177943568859678942507372855908540432723"
]
},
"signature_type": "Line"
}
]