CVE-2022-49769

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-49769
In the Linux kernel, the following vulnerability has been resolved: gfs2: Check sb_bsize_shift after reading superblock Fuzzers like to scribble over sb_bsize_shift but in reality it's very unlikely that this field would be corrupted on its own. Nevertheless it should be checked to avoid the possibility of messy mount errors due to bad calculations. It's always a fixed value based on the block size so we can just check that it's the expected value. Tested with: mkfs.gfs2 -O -p lock_nolock /dev/vdb for i in 0 -1 64 65 32 33; do gfs2_edit -p sb field sb_bsize_shift $i /dev/vdb mount /dev/vdb /mnt/test && umount /mnt/test done Before this patch we get a withdraw after [ 76.413681] gfs2: fsid=loop0.0: fatal: invalid metadata block [ 76.413681] bh = 19 (type: exp=5, found=4) [ 76.413681] function = gfs2_meta_buffer, file = fs/gfs2/meta_io.c, line = 492 and with UBSAN configured we also get complaints like [ 76.373395] UBSAN: shift-out-of-bounds in fs/gfs2/ops_fstype.c:295:19 [ 76.373815] shift exponent 4294967287 is too large for 64-bit type 'long unsigned int' After the patch, these complaints don't appear, mount fails immediately and we get an explanation in dmesg.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/15c83fa0fd659dd9fbdc940a560b61236e876a80 Patch
https://git.kernel.org/stable/c/16670534c7cff1acd918a6a5ec751b14e7436b76 Patch
https://git.kernel.org/stable/c/1ad197097343568066a8ffaa27ee7d0ae6d9f476 Patch
https://git.kernel.org/stable/c/28275a7c84d21c55ab3282d897f284d8d527173c Patch
https://git.kernel.org/stable/c/5fa30be7ba81191b0a0c7239a89befc0c94286d5 Patch
https://git.kernel.org/stable/c/670f8ce56dd0632dc29a0322e188cc73ce3c6b92 Patch
https://git.kernel.org/stable/c/8b6534c9ae9dba5489703a19d8ba6c8f2cfa33c2 Patch
https://git.kernel.org/stable/c/d6b1e8ea6f3418c3b461ad5a35cdc93c996b2c87 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

06 Nov 2025, 21:46

Type Values Removed Values Added
CWE NVD-CWE-noinfo
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: gfs2: Comprobación de sb_bsize_shift tras leer el superbloque. A los fuzzers les gusta manipular sb_bsize_shift, pero en realidad es muy improbable que este campo se corrompa por sí solo. Sin embargo, conviene comprobarlo para evitar errores de montaje problemáticos debido a cálculos erróneos. Siempre es un valor fijo basado en el tamaño del bloque, por lo que podemos comprobar que sea el valor esperado. Probado con: mkfs.gfs2 -O -p lock_nolock /dev/vdb for i in 0 -1 64 65 32 33; Antes de este parche obtenemos una retirada después de [ 76.413681] gfs2: fsid=loop0.0: fatal: bloque de metadatos no válido [ 76.413681] bh = 19 (tipo: exp=5, encontrado=4) [ 76.413681] función = gfs2_meta_buffer, archivo = fs/gfs2/meta_io.c, línea = 492 y con UBSAN configurado también obtenemos quejas como [ 76.373395] UBSAN: cambio fuera de los límites en fs/gfs2/ops_fstype.c:295:19 [ 76.373815] cambio El exponente 4294967287 es demasiado grande para el tipo de 64 bits 'long unsigned int'. Después del parche, estas quejas no aparecen, el montaje falla inmediatamente y obtenemos una explicación en dmesg.
First Time Linux
Linux linux Kernel
References () https://git.kernel.org/stable/c/15c83fa0fd659dd9fbdc940a560b61236e876a80 - () https://git.kernel.org/stable/c/15c83fa0fd659dd9fbdc940a560b61236e876a80 - Patch
References () https://git.kernel.org/stable/c/16670534c7cff1acd918a6a5ec751b14e7436b76 - () https://git.kernel.org/stable/c/16670534c7cff1acd918a6a5ec751b14e7436b76 - Patch
References () https://git.kernel.org/stable/c/1ad197097343568066a8ffaa27ee7d0ae6d9f476 - () https://git.kernel.org/stable/c/1ad197097343568066a8ffaa27ee7d0ae6d9f476 - Patch
References () https://git.kernel.org/stable/c/28275a7c84d21c55ab3282d897f284d8d527173c - () https://git.kernel.org/stable/c/28275a7c84d21c55ab3282d897f284d8d527173c - Patch
References () https://git.kernel.org/stable/c/5fa30be7ba81191b0a0c7239a89befc0c94286d5 - () https://git.kernel.org/stable/c/5fa30be7ba81191b0a0c7239a89befc0c94286d5 - Patch
References () https://git.kernel.org/stable/c/670f8ce56dd0632dc29a0322e188cc73ce3c6b92 - () https://git.kernel.org/stable/c/670f8ce56dd0632dc29a0322e188cc73ce3c6b92 - Patch
References () https://git.kernel.org/stable/c/8b6534c9ae9dba5489703a19d8ba6c8f2cfa33c2 - () https://git.kernel.org/stable/c/8b6534c9ae9dba5489703a19d8ba6c8f2cfa33c2 - Patch
References () https://git.kernel.org/stable/c/d6b1e8ea6f3418c3b461ad5a35cdc93c996b2c87 - () https://git.kernel.org/stable/c/d6b1e8ea6f3418c3b461ad5a35cdc93c996b2c87 - Patch

01 May 2025, 15:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-05-01 15:15

Updated : 2025-11-06 21:46

NVD link : CVE-2022-49769

Mitre link : CVE-2022-49769

CVE.ORG link : CVE-2022-49769

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
NVD-CWE-noinfo