CVE-2022-49352

Source
https://nvd.nist.gov/vuln/detail/CVE-2022-49352
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-49352.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2022-49352
Related
Published
2025-02-26T07:01:11Z
Modified
2025-02-26T19:03:02.695310Z
Summary
[none]
Details

In the Linux kernel, the following vulnerability has been resolved:

ext4: fix warning in ext4handleinode_extension

We got issue as follows: EXT4-fs error (device loop0) in ext4reserveinodewrite:5741: Out of memory EXT4-fs error (device loop0): ext4setattr:5462: inode #13: comm syz-executor.0: markinodedirty error EXT4-fs error (device loop0) in ext4setattr:5519: Out of memory EXT4-fs error (device loop0): ext4indmapblocks:595: inode #13: comm syz-executor.0: Can't allocate blocks for non-extent mapped inodes with bigalloc ------------[ cut here ]------------ WARNING: CPU: 1 PID: 4361 at fs/ext4/file.c:301 ext4filewriteiter+0x11c9/0x1220 Modules linked in: CPU: 1 PID: 4361 Comm: syz-executor.0 Not tainted 5.10.0+ #1 RIP: 0010:ext4filewriteiter+0x11c9/0x1220 RSP: 0018:ffff924d80b27c00 EFLAGS: 00010282 RAX: ffffffff815a3379 RBX: 0000000000000000 RCX: 000000003b000000 RDX: ffff924d81601000 RSI: 00000000000009cc RDI: 00000000000009cd RBP: 000000000000000d R08: ffffffffbc5a2c6b R09: 0000902e0e52a96f R10: ffff902e2b7c1b40 R11: ffff902e2b7c1b40 R12: 000000000000000a R13: 0000000000000001 R14: ffff902e0e52aa10 R15: ffffffffffffff8b FS: 00007f81a7f65700(0000) GS:ffff902e3bc80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffffff600400 CR3: 000000012db88001 CR4: 00000000003706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: doiterreadvwritev+0x2e5/0x360 doiterwrite+0x112/0x4c0 dopwritev+0x1e5/0x390 _x64syspwritev2+0x7e/0xa0 dosyscall64+0x37/0x50 entrySYSCALL64after_hwframe+0x44/0xa9

Above issue may happen as follows: Assume inode.isize=4096 EXT4I(inode)->i_disksize=4096

step 1: set inode->iisize = 8192 ext4setattr if (attr->iasize != inode->isize) EXT4I(inode)->idisksize = attr->iasize; rc = ext4markinodedirty ext4reserveinodewrite ext4getinodeloc _ext4getinodeloc sbgetblk --> return -ENOMEM ... if (!error) ->will not update isize isizewrite(inode, attr->iasize); Now: inode.isize=4096 EXT4I(inode)->idisksize=8192

step 2: Direct write 4096 bytes ext4filewriteiter ext4diowriteiter iomapdiorw ->return error if (extend) ext4handleinodeextension WARNONONCE(isizeread(inode) < EXT4I(inode)->i_disksize); ->Then trigger warning.

To solve above issue, if mark inode dirty failed in ext4setattr just set 'EXT4I(inode)->i_disksize' with old value.

References

Affected packages

Debian:11 / linux

Package

Name
linux
Purl
pkg:deb/debian/linux?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
5.10.127-1

Affected versions

5.*

5.10.46-4
5.10.46-5
5.10.70-1~bpo10+1
5.10.70-1
5.10.84-1
5.10.92-1~bpo10+1
5.10.92-1
5.10.92-2
5.10.103-1~bpo10+1
5.10.103-1
5.10.106-1
5.10.113-1
5.10.120-1~bpo10+1
5.10.120-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:12 / linux

Package

Name
linux
Purl
pkg:deb/debian/linux?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
5.18.5-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:13 / linux

Package

Name
linux
Purl
pkg:deb/debian/linux?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
5.18.5-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}