CVE-2022-50864
Description
In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix shift-out-of-bounds due to too large exponent of block size If field s_log_block_size of superblock data is corrupted and too large, init_nilfs() and load_nilfs() still can trigger a shift-out-of-bounds warning followed by a kernel panic (if panic_on_warn is set): shift exponent 38973 is too large for 32-bit type 'int' Call Trace: <TASK> dump_stack_lvl+0xcd/0x134 ubsan_epilogue+0xb/0x50 __ubsan_handle_shift_out_of_bounds.cold.12+0x17b/0x1f5 init_nilfs.cold.11+0x18/0x1d [nilfs2] nilfs_mount+0x9b5/0x12b0 [nilfs2] ... This fixes the issue by adding and using a new helper function for getting block size with sanity check.
How to fix
- Linux Linuxec93b5430ec0f60877a5388bb023d60624f9ab9f, 8b6ef451b5701b37d9a5905534595776a662edfc, ddb6615a168f97b91175e00eda4c644741cf531c, a16731fa1b96226c75bbf18e73513b14fc318360, ebeccaaef67a4895d2496ab8d9c2fb8d89201211 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | 8a9d2191e9f43bbcd256a9a6871bd73434c83f2f ≤ v < ec93b5430ec0f60877a5388bb023d60624f9ab9f, 8a9d2191e9f43bbcd256a9a6871bd73434c83f2f ≤ v < 8b6ef451b5701b37d9a5905534595776a662edfc, 8a9d2191e9f43bbcd256a9a6871bd73434c83f2f ≤ v < ddb6615a168f97b91175e00eda4c644741cf531c, 8a9d2191e9f43bbcd256a9a6871bd73434c83f2f ≤ v < a16731fa1b96226c75bbf18e73513b14fc318360, 8a9d2191e9f43bbcd256a9a6871bd73434c83f2f ≤ v < ebeccaaef67a4895d2496ab8d9c2fb8d89201211, 2.6.30 | ec93b5430ec0f60877a5388bb023d60624f9ab9f, 8b6ef451b5701b37d9a5905534595776a662edfc, ddb6615a168f97b91175e00eda4c644741cf531c, a16731fa1b96226c75bbf18e73513b14fc318360, ebeccaaef67a4895d2496ab8d9c2fb8d89201211 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.