In the Linux kernel, the following vulnerability has been resolved:
nilfs2: fix shift-out-of-bounds due to too large exponent of block size
If field slogblocksize of superblock data is corrupted and too large, initnilfs() and loadnilfs() still can trigger a shift-out-of-bounds warning followed by a kernel panic (if panicon_warn is set):
shift exponent 38973 is too large for 32-bit type 'int' Call Trace: <TASK> dumpstacklvl+0xcd/0x134 ubsanepilogue+0xb/0x50 _ubsanhandleshiftoutofbounds.cold.12+0x17b/0x1f5 initnilfs.cold.11+0x18/0x1d [nilfs2] nilfs_mount+0x9b5/0x12b0 [nilfs2] ...
This fixes the issue by adding and using a new helper function for getting block size with sanity check.
{
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/50xxx/CVE-2022-50864.json",
"cna_assigner": "Linux"
}