CVE-2022-49170
Published: 26 February 2025
Description
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to do sanity check on curseg->alloc_type As Wenqing Liu reported in bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=215657 - Overview UBSAN: array-index-out-of-bounds in fs/f2fs/segment.c:3460:2 when mount and operate a corrupted image - Reproduce tested on kernel 5.17-rc4, 5.17-rc6 1. mkdir test_crash 2. cd test_crash 3. unzip tmp2.zip 4. mkdir mnt 5. ./single_test.sh f2fs 2 - Kernel dump [ 46.434454] loop0: detected capacity change from 0 to 131072 [ 46.529839] F2FS-fs (loop0): Mounted with checkpoint version = 7548c2d9 [ 46.738319] ================================================================================ [ 46.738412] UBSAN: array-index-out-of-bounds in fs/f2fs/segment.c:3460:2 [ 46.738475] index 231 is out of range for type 'unsigned int [2]' [ 46.738539] CPU: 2 PID: 939 Comm: umount Not tainted 5.17.0-rc6 #1 [ 46.738547] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.13.0-1ubuntu1.1 04/01/2014 [ 46.738551] Call Trace: [ 46.738556] <TASK> [ 46.738563] dump_stack_lvl+0x47/0x5c [ 46.738581] ubsan_epilogue+0x5/0x50 [ 46.738592] __ubsan_handle_out_of_bounds+0x68/0x80 [ 46.738604] f2fs_allocate_data_block+0xdff/0xe60 [f2fs] [ 46.738819] do_write_page+0xef/0x210 [f2fs] [ 46.738934] f2fs_do_write_node_page+0x3f/0x80 [f2fs] [ 46.739038] __write_node_page+0x2b7/0x920 [f2fs] [ 46.739162] f2fs_sync_node_pages+0x943/0xb00 [f2fs] [ 46.739293] f2fs_write_checkpoint+0x7bb/0x1030 [f2fs] [ 46.739405] kill_f2fs_super+0x125/0x150 [f2fs] [ 46.739507] deactivate_locked_super+0x60/0xc0 [ 46.739517] deactivate_super+0x70/0xb0 [ 46.739524] cleanup_mnt+0x11a/0x200 [ 46.739532] __cleanup_mnt+0x16/0x20 [ 46.739538] task_work_run+0x67/0xa0 [ 46.739547] exit_to_user_mode_prepare+0x18c/0x1a0 [ 46.739559] syscall_exit_to_user_mode+0x26/0x40 [ 46.739568] do_syscall_64+0x46/0xb0 [ 46.739584] entry_SYSCALL_64_after_hwframe+0x44/0xae The root cause is we missed to do sanity check on curseg->alloc_type, result in out-of-bound accessing on sbi->block_count[] array, fix it.
Security Summary
CVE-2022-49170 is an array-index-out-of-bounds vulnerability in the Linux kernel's F2FS (Flash-Friendly File System) implementation. The flaw stems from a missing sanity check on the curseg->alloc_type field, which leads to invalid out-of-bounds access of the sbi->block_count[] array in fs/f2fs/segment.c at line 3460. This issue was reported via Bugzilla (ID 215657) and observed via UBSAN during mount and operation of a corrupted F2FS image on kernels such as 5.17-rc4 and 5.17-rc6.
A local attacker with low privileges can exploit the vulnerability by mounting and performing operations on a specially crafted corrupted F2FS image, such as during umount processes involving f2fs_write_checkpoint and f2fs_allocate_data_block. This triggers the out-of-bounds access, with a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicating high impacts on confidentiality, integrity, and availability, classified under CWE-129 (Improper Validation of Array Index).
Mitigation requires updating to patched Linux kernel versions via stable backports, including commits such as 0748a0f7dcb9d9dddc80302d73ebcecef6782ef0, 498b7088db71f9707359448cd6800bbb1882f4c3, c12765e3f129b144421c80d3383df885f85ee290, f41ee8b91c00770d718be2ff4852a80017ae9ab3, and f68caedf264a95c0b02dfd0d9f92ac2637d5848a from kernel.org stable trees. These patches add the required sanity check on curseg->alloc_type to prevent the invalid access.
Details
- CWE(s)