In the Linux kernel, the following vulnerability has been resolved:
ext4: block range must be validated before use in ext4mbclear_bb()
Block range to free is validated in ext4freeblocks() using ext4inodeblockvalid() and then it's passed to ext4mbclearbb(). However in some situations on bigalloc file system the range might be adjusted after the validation in ext4freeblocks() which can lead to troubles on corrupted file systems such as one found by syzkaller that resulted in the following BUG
kernel BUG at fs/ext4/ext4.h:3319! PREEMPT SMP NOPTI CPU: 28 PID: 4243 Comm: repro Kdump: loaded Not tainted 5.19.0-rc6+ #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1.fc35 04/01/2014 RIP: 0010:ext4freeblocks+0x95e/0xa90 Call Trace: <TASK> ? locktimerbase+0x61/0x80 ? __esremoveextent+0x5a/0x760 ? __modtimer+0x256/0x380 ? ext4indtruncateensurecredits+0x90/0x220 ext4clearblocks+0x107/0x1b0 ext4freedata+0x15b/0x170 ext4indtruncate+0x214/0x2c0 ? rawspinunlock+0x15/0x30 ? ext4discardpreallocations+0x15a/0x410 ? ext4journalcheck_start+0xe/0x90 ? __ext4journalstartsb+0x2f/0x110 ext4truncate+0x1b5/0x460 ? __ext4journalstart_sb+0x2f/0x110 ext4evictinode+0x2b4/0x6f0 evict+0xd0/0x1d0 ext4enablequotas+0x11f/0x1f0 ext4orphancleanup+0x3de/0x430 ? proccreateseqprivate+0x43/0x50 ext4fillsuper+0x295f/0x3ae0 ? snprintf+0x39/0x40 ? sgetfc+0x19c/0x330 ? ext4reconfigure+0x850/0x850 gettreebdev+0x16d/0x260 vfsgettree+0x25/0xb0 pathmount+0x431/0xa70 _x64sysmount+0xe2/0x120 dosyscall64+0x5b/0x80 ? douseraddrfault+0x1e2/0x670 ? excpagefault+0x70/0x170 entrySYSCALL64afterhwframe+0x46/0xb0 RIP: 0033:0x7fdf4e512ace
Fix it by making sure that the block range is properly validated before used every time it changes in ext4freeblocks() or ext4mbclear_bb().
{
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/50xxx/CVE-2022-50021.json",
"cna_assigner": "Linux"
}[
{
"signature_type": "Line",
"digest": {
"line_hashes": [
"82642557759694018744808983703025484578",
"165637540616091920621469277615396197138",
"48904540314051442843378220723797283710",
"15863784715237663217045217776905191350",
"63206688932814381957035916423525050206",
"198637868794052648519448579123556423379",
"295478523730720367958230451139744124303",
"296408884536941940941790901437472617563",
"63065728437871324698735542385191011462",
"115046928597486047922798767646243104610",
"255117118117423883787750531352590948960",
"125263631591283897912713981578914776041",
"65725913631862917101996659324078346349",
"144152666758051604457388374319800764476",
"132318095572109897792884147008193732477",
"338685201658998290948950722677131972809",
"248223445937344185263643836067219772551",
"140451516338373689369889010891724389242",
"121668667725560943449420788933579047674",
"72226447570876828292016548193536078407",
"277689307060001373902408994700163128188",
"147286719252281020355510945414766536163",
"201179535527921273954671064991295819365",
"215964270725234924444987137865391373611",
"228604296067285887758683687569653670069",
"24987025504569526459324557844298185505",
"37207116714286145997992579115239021232"
],
"threshold": 0.9
},
"signature_version": "v1",
"id": "CVE-2022-50021-0c71f6ea",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@560a2744cbbf03cac65a6394f9b0d99aa437c867",
"target": {
"file": "fs/ext4/mballoc.c"
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"target": {
"file": "fs/ext4/mballoc.c",
"function": "ext4_free_blocks"
},
"id": "CVE-2022-50021-164d97fe",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7550aade978371ac582f6d43b14c4cb89ca54463",
"digest": {
"function_hash": "255652373028107362926983354583685655208",
"length": 1685.0
}
},
{
"signature_type": "Line",
"digest": {
"line_hashes": [
"82642557759694018744808983703025484578",
"165637540616091920621469277615396197138",
"48904540314051442843378220723797283710",
"15863784715237663217045217776905191350",
"63206688932814381957035916423525050206",
"198637868794052648519448579123556423379",
"295478523730720367958230451139744124303",
"296408884536941940941790901437472617563",
"63065728437871324698735542385191011462",
"115046928597486047922798767646243104610",
"255117118117423883787750531352590948960",
"125263631591283897912713981578914776041",
"65725913631862917101996659324078346349",
"144152666758051604457388374319800764476",
"132318095572109897792884147008193732477",
"338685201658998290948950722677131972809",
"248223445937344185263643836067219772551",
"140451516338373689369889010891724389242",
"121668667725560943449420788933579047674",
"72226447570876828292016548193536078407",
"277689307060001373902408994700163128188",
"147286719252281020355510945414766536163",
"201179535527921273954671064991295819365",
"215964270725234924444987137865391373611",
"228604296067285887758683687569653670069",
"24987025504569526459324557844298185505",
"37207116714286145997992579115239021232"
],
"threshold": 0.9
},
"deprecated": false,
"id": "CVE-2022-50021-22f981b6",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7550aade978371ac582f6d43b14c4cb89ca54463",
"target": {
"file": "fs/ext4/mballoc.c"
}
},
{
"signature_type": "Line",
"digest": {
"line_hashes": [
"82642557759694018744808983703025484578",
"165637540616091920621469277615396197138",
"48904540314051442843378220723797283710",
"15863784715237663217045217776905191350",
"63206688932814381957035916423525050206",
"198637868794052648519448579123556423379",
"295478523730720367958230451139744124303",
"296408884536941940941790901437472617563",
"63065728437871324698735542385191011462",
"115046928597486047922798767646243104610",
"255117118117423883787750531352590948960",
"125263631591283897912713981578914776041",
"65725913631862917101996659324078346349",
"144152666758051604457388374319800764476",
"132318095572109897792884147008193732477",
"338685201658998290948950722677131972809",
"248223445937344185263643836067219772551",
"140451516338373689369889010891724389242",
"121668667725560943449420788933579047674",
"72226447570876828292016548193536078407",
"277689307060001373902408994700163128188",
"147286719252281020355510945414766536163",
"201179535527921273954671064991295819365",
"215964270725234924444987137865391373611",
"228604296067285887758683687569653670069",
"24987025504569526459324557844298185505",
"37207116714286145997992579115239021232"
],
"threshold": 0.9
},
"signature_version": "v1",
"id": "CVE-2022-50021-267ca206",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a2522041d248a8c969cbbc97e1fc2cd8b4de120d",
"target": {
"file": "fs/ext4/mballoc.c"
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"target": {
"file": "fs/ext4/mballoc.c",
"function": "ext4_free_blocks"
},
"id": "CVE-2022-50021-35a8d9bc",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a2522041d248a8c969cbbc97e1fc2cd8b4de120d",
"digest": {
"function_hash": "255652373028107362926983354583685655208",
"length": 1685.0
}
},
{
"signature_type": "Function",
"digest": {
"function_hash": "255652373028107362926983354583685655208",
"length": 1685.0
},
"deprecated": false,
"id": "CVE-2022-50021-3e41e298",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@560a2744cbbf03cac65a6394f9b0d99aa437c867",
"target": {
"file": "fs/ext4/mballoc.c",
"function": "ext4_free_blocks"
}
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"function_hash": "274273515702835650617535325829494296666",
"length": 3294.0
},
"id": "CVE-2022-50021-45597b1d",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a2522041d248a8c969cbbc97e1fc2cd8b4de120d",
"target": {
"file": "fs/ext4/mballoc.c",
"function": "ext4_mb_clear_bb"
}
},
{
"signature_type": "Function",
"target": {
"file": "fs/ext4/mballoc.c",
"function": "ext4_mb_clear_bb"
},
"deprecated": false,
"id": "CVE-2022-50021-50ecbc1b",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@560a2744cbbf03cac65a6394f9b0d99aa437c867",
"digest": {
"function_hash": "274273515702835650617535325829494296666",
"length": 3294.0
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"target": {
"file": "fs/ext4/mballoc.c",
"function": "ext4_mb_clear_bb"
},
"id": "CVE-2022-50021-937e1686",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1e1c2b86ef86a8477fd9b9a4f48a6bfe235606f6",
"digest": {
"function_hash": "274273515702835650617535325829494296666",
"length": 3294.0
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"target": {
"file": "fs/ext4/mballoc.c",
"function": "ext4_free_blocks"
},
"id": "CVE-2022-50021-b6292372",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1e1c2b86ef86a8477fd9b9a4f48a6bfe235606f6",
"digest": {
"function_hash": "255652373028107362926983354583685655208",
"length": 1685.0
}
},
{
"signature_type": "Function",
"digest": {
"function_hash": "90851507344784248703367551978728226707",
"length": 3250.0
},
"signature_version": "v1",
"id": "CVE-2022-50021-d4cbc05d",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7550aade978371ac582f6d43b14c4cb89ca54463",
"target": {
"file": "fs/ext4/mballoc.c",
"function": "ext4_mb_clear_bb"
}
},
{
"signature_type": "Line",
"signature_version": "v1",
"target": {
"file": "fs/ext4/mballoc.c"
},
"id": "CVE-2022-50021-f6cf4c7f",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1e1c2b86ef86a8477fd9b9a4f48a6bfe235606f6",
"digest": {
"line_hashes": [
"82642557759694018744808983703025484578",
"165637540616091920621469277615396197138",
"48904540314051442843378220723797283710",
"15863784715237663217045217776905191350",
"63206688932814381957035916423525050206",
"198637868794052648519448579123556423379",
"295478523730720367958230451139744124303",
"296408884536941940941790901437472617563",
"63065728437871324698735542385191011462",
"115046928597486047922798767646243104610",
"255117118117423883787750531352590948960",
"125263631591283897912713981578914776041",
"65725913631862917101996659324078346349",
"144152666758051604457388374319800764476",
"132318095572109897792884147008193732477",
"338685201658998290948950722677131972809",
"248223445937344185263643836067219772551",
"140451516338373689369889010891724389242",
"121668667725560943449420788933579047674",
"72226447570876828292016548193536078407",
"277689307060001373902408994700163128188",
"147286719252281020355510945414766536163",
"201179535527921273954671064991295819365",
"215964270725234924444987137865391373611",
"228604296067285887758683687569653670069",
"24987025504569526459324557844298185505",
"37207116714286145997992579115239021232"
],
"threshold": 0.9
}
}
]
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-50021.json"