CVE-2022-49688
Description
In the Linux kernel, the following vulnerability has been resolved: afs: Fix dynamic root getattr The recent patch to make afs_getattr consult the server didn't account for the pseudo-inodes employed by the dynamic root-type afs superblock not having a volume or a server to access, and thus an oops occurs if such a directory is stat'd. Fix this by checking to see if the vnode->volume pointer actually points anywhere before following it in afs_getattr(). This can be tested by stat'ing a directory in /afs. It may be sufficient just to do "ls /afs" and the oops looks something like: BUG: kernel NULL pointer dereference, address: 0000000000000020 ... RIP: 0010:afs_getattr+0x8b/0x14b ... Call Trace: <TASK> vfs_statx+0x79/0xf5 vfs_fstatat+0x49/0x62
How to fix
- linux linux_kernel4.19.250, 5.4.202, 5.10.127, 5.15.51, 5.18, 5.18.8 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| linux linux_kernel | 4.19.245 ≤ v < 4.19.250, 5.4.196 ≤ v < 5.4.202, 5.10.118 ≤ v < 5.10.127, 5.15.42 ≤ v < 5.15.51, 5.17.10 ≤ v < 5.18, 5.18.1 ≤ v < 5.18.8, 5.18, 5.19 | 4.19.250, 5.4.202, 5.10.127, 5.15.51, 5.18, 5.18.8 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.