In the Linux kernel, the following vulnerability has been resolved:
fs: fix UAF/GPF bug in nilfsmdtdestroy
In allocinode, inodeinitalways() could return -ENOMEM if securityinodealloc() fails, which causes inode->iprivate uninitialized. Then nilfsismetadatafileinode() returns true and nilfsfreeinode() wrongly calls nilfsmdtdestroy(), which frees the uninitialized inode->i_private and leads to crashes(e.g., UAF/GPF).
Fix this by moving securityinodealloc just prior to thiscpuinc(nr_inodes)
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2a96b532098284ecf8e4849b8b9e5fc7a28bdee9",
"target": {
"file": "fs/inode.c"
},
"id": "CVE-2022-50367-02d459e3",
"deprecated": false,
"digest": {
"line_hashes": [
"259371844237925505311728971462430972633",
"302477268631548863546470827823647643585",
"62549927365163696642464972525164138266",
"110564242086912074442004793046122633415",
"243980154566729059279386346173810888121",
"222279145132786325682664862863148026598",
"332782912439890468782710603640226062753",
"297250975218129356498713439865512893949",
"16630130526809352319050193166987119916",
"171310487771494547406378172829838792251",
"154667850069164512330416921022418744756",
"123317682108227159979259814462014042972",
"242941110578931442677159361825016652309"
],
"threshold": 0.9
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2a96b532098284ecf8e4849b8b9e5fc7a28bdee9",
"target": {
"function": "inode_init_always",
"file": "fs/inode.c"
},
"id": "CVE-2022-50367-051a11c8",
"deprecated": false,
"digest": {
"function_hash": "276192898758919881245932079490017831989",
"length": 2188.0
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@64b79e632869ad3ef6c098a4731d559381da1115",
"target": {
"file": "fs/inode.c"
},
"id": "CVE-2022-50367-157d25a0",
"deprecated": false,
"digest": {
"line_hashes": [
"259371844237925505311728971462430972633",
"302477268631548863546470827823647643585",
"62549927365163696642464972525164138266",
"110564242086912074442004793046122633415",
"243980154566729059279386346173810888121",
"222279145132786325682664862863148026598",
"332782912439890468782710603640226062753",
"297250975218129356498713439865512893949",
"16630130526809352319050193166987119916",
"171310487771494547406378172829838792251",
"154667850069164512330416921022418744756",
"123317682108227159979259814462014042972",
"242941110578931442677159361825016652309"
],
"threshold": 0.9
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c0aa76b0f17f59dd9c9d3463550a2986a1d592e4",
"target": {
"file": "fs/inode.c"
},
"id": "CVE-2022-50367-1b98cc59",
"deprecated": false,
"digest": {
"line_hashes": [
"259371844237925505311728971462430972633",
"302477268631548863546470827823647643585",
"62549927365163696642464972525164138266",
"110564242086912074442004793046122633415",
"243980154566729059279386346173810888121",
"222279145132786325682664862863148026598",
"332782912439890468782710603640226062753",
"297250975218129356498713439865512893949",
"16630130526809352319050193166987119916",
"171310487771494547406378172829838792251",
"154667850069164512330416921022418744756",
"123317682108227159979259814462014042972",
"106754685019643103911767809451345879654"
],
"threshold": 0.9
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1e555c3ed1fce4b278aaebe18a64a934cece57d8",
"target": {
"file": "fs/inode.c"
},
"id": "CVE-2022-50367-1c66e8ac",
"deprecated": false,
"digest": {
"line_hashes": [
"259371844237925505311728971462430972633",
"302477268631548863546470827823647643585",
"62549927365163696642464972525164138266",
"110564242086912074442004793046122633415",
"243980154566729059279386346173810888121",
"222279145132786325682664862863148026598",
"332782912439890468782710603640226062753",
"297250975218129356498713439865512893949",
"16630130526809352319050193166987119916",
"171310487771494547406378172829838792251",
"154667850069164512330416921022418744756",
"123317682108227159979259814462014042972",
"242941110578931442677159361825016652309"
],
"threshold": 0.9
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ec2aab115eb38ac4992ea2fcc2a02fbe7af5cf48",
"target": {
"file": "fs/inode.c"
},
"id": "CVE-2022-50367-29a8e2f9",
"deprecated": false,
"digest": {
"line_hashes": [
"259371844237925505311728971462430972633",
"302477268631548863546470827823647643585",
"62549927365163696642464972525164138266",
"110564242086912074442004793046122633415",
"243980154566729059279386346173810888121",
"222279145132786325682664862863148026598",
"332782912439890468782710603640226062753",
"297250975218129356498713439865512893949",
"16630130526809352319050193166987119916",
"171310487771494547406378172829838792251",
"154667850069164512330416921022418744756",
"123317682108227159979259814462014042972",
"106754685019643103911767809451345879654"
],
"threshold": 0.9
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@70e4f70d54e0225f91814e8610477d65f33cefe4",
"target": {
"file": "fs/inode.c"
},
"id": "CVE-2022-50367-3378f11b",
"deprecated": false,
"digest": {
"line_hashes": [
"259371844237925505311728971462430972633",
"302477268631548863546470827823647643585",
"62549927365163696642464972525164138266",
"110564242086912074442004793046122633415",
"243980154566729059279386346173810888121",
"222279145132786325682664862863148026598",
"332782912439890468782710603640226062753",
"297250975218129356498713439865512893949",
"16630130526809352319050193166987119916",
"171310487771494547406378172829838792251",
"154667850069164512330416921022418744756",
"123317682108227159979259814462014042972",
"242941110578931442677159361825016652309"
],
"threshold": 0.9
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@81de80330fa6907aec32eb54c5619059e6e36452",
"target": {
"file": "fs/inode.c"
},
"id": "CVE-2022-50367-53be5964",
"deprecated": false,
"digest": {
"line_hashes": [
"259371844237925505311728971462430972633",
"302477268631548863546470827823647643585",
"62549927365163696642464972525164138266",
"110564242086912074442004793046122633415",
"243980154566729059279386346173810888121",
"222279145132786325682664862863148026598",
"332782912439890468782710603640226062753",
"297250975218129356498713439865512893949",
"16630130526809352319050193166987119916",
"171310487771494547406378172829838792251",
"154667850069164512330416921022418744756",
"123317682108227159979259814462014042972",
"242941110578931442677159361825016652309"
],
"threshold": 0.9
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2e488f13755ffbb60f307e991b27024716a33b29",
"target": {
"file": "fs/inode.c"
},
"id": "CVE-2022-50367-54a7e9be",
"deprecated": false,
"digest": {
"line_hashes": [
"259371844237925505311728971462430972633",
"302477268631548863546470827823647643585",
"62549927365163696642464972525164138266",
"110564242086912074442004793046122633415",
"243980154566729059279386346173810888121",
"222279145132786325682664862863148026598",
"332782912439890468782710603640226062753",
"297250975218129356498713439865512893949",
"16630130526809352319050193166987119916",
"171310487771494547406378172829838792251",
"154667850069164512330416921022418744756",
"123317682108227159979259814462014042972",
"242941110578931442677159361825016652309"
],
"threshold": 0.9
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@81de80330fa6907aec32eb54c5619059e6e36452",
"target": {
"function": "inode_init_always",
"file": "fs/inode.c"
},
"id": "CVE-2022-50367-5cf46a1a",
"deprecated": false,
"digest": {
"function_hash": "276192898758919881245932079490017831989",
"length": 2188.0
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@70e4f70d54e0225f91814e8610477d65f33cefe4",
"target": {
"function": "inode_init_always",
"file": "fs/inode.c"
},
"id": "CVE-2022-50367-77c4fd64",
"deprecated": false,
"digest": {
"function_hash": "248553913896601482435741262652104714652",
"length": 2033.0
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2e488f13755ffbb60f307e991b27024716a33b29",
"target": {
"function": "inode_init_always",
"file": "fs/inode.c"
},
"id": "CVE-2022-50367-9f3bf959",
"deprecated": false,
"digest": {
"function_hash": "276192898758919881245932079490017831989",
"length": 2188.0
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d1ff475d7c83289d0a7faef346ea3bbf90818bad",
"target": {
"function": "inode_init_always",
"file": "fs/inode.c"
},
"id": "CVE-2022-50367-a0c5d57d",
"deprecated": false,
"digest": {
"function_hash": "61245310942390507949376587151592300664",
"length": 1880.0
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1e555c3ed1fce4b278aaebe18a64a934cece57d8",
"target": {
"function": "inode_init_always",
"file": "fs/inode.c"
},
"id": "CVE-2022-50367-c3d4c741",
"deprecated": false,
"digest": {
"function_hash": "326905623213754644862510232517369653460",
"length": 2136.0
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ec2aab115eb38ac4992ea2fcc2a02fbe7af5cf48",
"target": {
"function": "inode_init_always",
"file": "fs/inode.c"
},
"id": "CVE-2022-50367-cb93f04b",
"deprecated": false,
"digest": {
"function_hash": "244344416099905454836151664343025461555",
"length": 1949.0
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c0aa76b0f17f59dd9c9d3463550a2986a1d592e4",
"target": {
"function": "inode_init_always",
"file": "fs/inode.c"
},
"id": "CVE-2022-50367-e03e6f2b",
"deprecated": false,
"digest": {
"function_hash": "244344416099905454836151664343025461555",
"length": 1949.0
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@64b79e632869ad3ef6c098a4731d559381da1115",
"target": {
"function": "inode_init_always",
"file": "fs/inode.c"
},
"id": "CVE-2022-50367-eb4b1936",
"deprecated": false,
"digest": {
"function_hash": "202877661937601512385399543917953227581",
"length": 2291.0
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d1ff475d7c83289d0a7faef346ea3bbf90818bad",
"target": {
"file": "fs/inode.c"
},
"id": "CVE-2022-50367-edb4fab2",
"deprecated": false,
"digest": {
"line_hashes": [
"259371844237925505311728971462430972633",
"302477268631548863546470827823647643585",
"62549927365163696642464972525164138266",
"110564242086912074442004793046122633415",
"243980154566729059279386346173810888121",
"222279145132786325682664862863148026598",
"332782912439890468782710603640226062753",
"297250975218129356498713439865512893949",
"16630130526809352319050193166987119916",
"171310487771494547406378172829838792251",
"154667850069164512330416921022418744756",
"123317682108227159979259814462014042972",
"106754685019643103911767809451345879654"
],
"threshold": 0.9
},
"signature_type": "Line",
"signature_version": "v1"
}
]