Skip to content
Heist/ feed
High

ext4: fix ext4_mb_mark_bb() with flex_bg with fast_commit

Type: advisorySource: Official CVE List1 source record

In the Linux kernel, the following vulnerability has been resolved: ext4: fix ext4_mb_mark_bb() with flex_bg with fast_commit In case of flex_bg feature (which is by default enabled), extents for any given inode might span across blocks from two different block group. ext4_mb_mark_bb() only reads the buffer_head of block bitmap once for the starting block group, but it fails to read it again when the extent length boundary overflows to another block group. Then in this below loop it accesses memory beyond the block group bitmap buffer_head and results into a data abort. for (i = 0; i < clen; i++) if (!mb_test_bit(blkoff + i, bitmap_bh->b_data) == !state) already++; This patch adds this functionality for checking block group boundary in ext4_mb_mark_bb() and update the buffer_head(bitmap_bh) for every different block group. w/o this patch, I was easily able to hit a data access abort using Power platform. <...> [ 74.327662] EXT4-fs error (device loop3): ext4_mb_generate_buddy:1141: group 11, block bitmap and bg descriptor inconsistent: 21248 vs 23294 free clusters [ 74.533214] EXT4-fs (loop3): shut down requested (2) [ 74.536705] Aborting journal on device loop3-8. [ 74.702705] BUG: Unable to handle kernel data access on read at 0xc00000005e980000 [ 74.703727] Faulting instruction address: 0xc0000000007bffb8 cpu 0xd: Vector: 300 (Data Access) at [c000000015db7060] pc: c0000000007bffb8: ext4_mb_mark_bb+0x198/0x5a0 lr: c0000000007bfeec: ext4_mb_mark_bb+0xcc/0x5a0 sp: c000000015d

Announced Source revision 1
Original source ↗

CVE-2022-49174

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2022-49174

Linux

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Linux

Source reference: /containers/cna/affected/1/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "8016e29f4362e285f0f7e38fadc61a5b7bdfdfa2",
        "lessThan": "cd6d719534af993210306f8a13f9cb3e615f7c8d",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "8016e29f4362e285f0f7e38fadc61a5b7bdfdfa2",
        "lessThan": "6a6beb074186a0452368a023a261c7d0eaebe838",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "8016e29f4362e285f0f7e38fadc61a5b7bdfdfa2",
        "lessThan": "b07eedd0222e9548ffc568ec429bb1f61d21a39c",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "8016e29f4362e285f0f7e38fadc61a5b7bdfdfa2",
        "lessThan": "803fb0e8240cc16585a5c9df76add1dfaa781773",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "8016e29f4362e285f0f7e38fadc61a5b7bdfdfa2",
        "lessThan": "bfdc502a4a4c058bf4cbb1df0c297761d528f54d",
        "versionType": "git"
      }
    ],
    "programFiles": [
      "fs/ext4/mballoc.c"
    ],
    "defaultStatus": "unaffected"
  },
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "5.10"
      },
      {
        "status": "unaffected",
        "version": "0",
        "lessThan": "5.10",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "5.10.110",
        "versionType": "semver",
        "lessThanOrEqual": "5.10.*"
      },
      {
        "status": "unaffected",
        "version": "5.15.33",
        "versionType": "semver",
        "lessThanOrEqual": "5.15.*"
      },
      {
        "status": "unaffected",
        "version": "5.16.19",
        "versionType": "semver",
        "lessThanOrEqual": "5.16.*"
      },
      {
        "status": "unaffected",
        "version": "5.17.2",
        "versionType": "semver",
        "lessThanOrEqual": "5.17.*"
      },
      {
        "status": "unaffected",
        "version": "5.18",
        "versionType": "original_commit_for_fix",
        "lessThanOrEqual": "*"
      }
    ],
    "programFiles": [
      "fs/ext4/mballoc.c"
    ],
    "defaultStatus": "affected"
  }
]
Related CVEs
CVE-2022-49174

Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event
#30183 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement