In the Linux kernel, the following vulnerability has been resolved:
fs: fix UAF/GPF bug in nilfsmdtdestroy
In allocinode, inodeinitalways() could return -ENOMEM if securityinodealloc() fails, which causes inode->iprivate uninitialized. Then nilfsismetadatafileinode() returns true and nilfsfreeinode() wrongly calls nilfsmdtdestroy(), which frees the uninitialized inode->i_private and leads to crashes(e.g., UAF/GPF).
Fix this by moving securityinodealloc just prior to thiscpuinc(nr_inodes)
{
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/50xxx/CVE-2022-50367.json",
"cna_assigner": "Linux"
}"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-50367.json"
[
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"259371844237925505311728971462430972633",
"302477268631548863546470827823647643585",
"62549927365163696642464972525164138266",
"110564242086912074442004793046122633415",
"243980154566729059279386346173810888121",
"222279145132786325682664862863148026598",
"332782912439890468782710603640226062753",
"297250975218129356498713439865512893949",
"16630130526809352319050193166987119916",
"171310487771494547406378172829838792251",
"154667850069164512330416921022418744756",
"123317682108227159979259814462014042972",
"242941110578931442677159361825016652309"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2e488f13755ffbb60f307e991b27024716a33b29",
"signature_type": "Line",
"id": "CVE-2022-50367-54a7e9be",
"target": {
"file": "fs/inode.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "276192898758919881245932079490017831989",
"length": 2188.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2e488f13755ffbb60f307e991b27024716a33b29",
"signature_type": "Function",
"id": "CVE-2022-50367-9f3bf959",
"target": {
"file": "fs/inode.c",
"function": "inode_init_always"
}
}
]