CVE-2022-50021
ext4: block range must be validated before use in ext4_mb_clear_bb()
In the Linux kernel, the following vulnerability has been resolved: ext4: block range must be validated before use in ext4_mb_clear_bb() Block range to free is validated in ext4_free_blocks() using ext4_inode_block_valid() and then it's passed to ext4_mb_clear_bb(). However in some situations on bigalloc file system the range might be adjusted after the validation in ext4_free_blocks() which can lead to troubles on corrupted file systems such as one found by syzkaller that resulted in the following BUG kernel BUG at fs/ext4/ext4.h:3319! PREEMPT SMP NOPTI CPU: 28 PID: 4243 Comm: repro Kdump: loaded Not tainted 5.19.0-rc6+ #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1.fc35 04/01/2014 RIP: 0010:ext4_free_blocks+0x95e/0xa90 Call Trace: <TASK> ? lock_timer_base+0x61/0x80 ? __es_remove_extent+0x5a/0x760 ? __mod_timer+0x256/0x380 ? ext4_ind_truncate_ensure_credits+0x90/0x220 ext4_clear_blocks+0x107/0x1b0 ext4_free_data+0x15b/0x170 ext4_ind_truncate+0x214/0x2c0 ? _raw_spin_unlock+0x15/0x30 ? ext4_discard_preallocations+0x15a/0x410 ? ext4_journal_check_start+0xe/0x90 ? __ext4_journal_start_sb+0x2f/0x110 ext4_truncate+0x1b5/0x460 ? __ext4_journal_start_sb+0x2f/0x110 ext4_evict_inode+0x2b4/0x6f0 evict+0xd0/0x1d0 ext4_enable_quotas+0x11f/0x1f0 ext4_orphan_cleanup+0x3de/0x430 ? proc_create_seq_private+0x43/0x50 ext4_fill_super+0x295f/0x3ae0 ? snprintf+0x39/0x40 ? sget_fc+0x19c/0x330 ? ext4_reconfigure+0x850/0x850 get_tree_bdev+0x16d/0x260 vfs_get_tree+0x25/0xb0 path_mount+0x431/0xa70 __x64_sys_mount+0xe2/0x120 do_syscall_64+0x5b/0x80 ? do_user_addr_fault+0x1e2/0x670 ? exc_page_fault+0x70/0x170 entry_SYSCALL_64_after_hwframe+0x46/0xb0 RIP: 0033:0x7fdf4e512ace Fix it by making sure that the block range is properly validated before used every time it changes in ext4_free_blocks() or ext4_mb_clear_bb().
Fixes and workarounds
No remediation reported in collected sources.
Missing remediation information is not evidence that no patch exists.
Affected products and versions
| Product | Versions | Authority |
|---|---|---|
| Linux Linux |
≥ 84130193e0e6568dfdfb823f0e1e19aec80aff6e; < 7550aade978371ac582f6d43b14c4cb89ca54463 (affected, git) ≥ 84130193e0e6568dfdfb823f0e1e19aec80aff6e; < 560a2744cbbf03cac65a6394f9b0d99aa437c867 (affected, git) ≥ 84130193e0e6568dfdfb823f0e1e19aec80aff6e; < a2522041d248a8c969cbbc97e1fc2cd8b4de120d (affected, git) ≥ 84130193e0e6568dfdfb823f0e1e19aec80aff6e; < 1e1c2b86ef86a8477fd9b9a4f48a6bfe235606f6 (affected, git) Other versions: unaffected |
CNA: Linux |
| Linux Linux |
3.2 (affected) ≥ 0; < 3.2 (unaffected, semver) ≥ 5.10.175; ≤ 5.10.* (unaffected, semver) ≥ 5.15.103; ≤ 5.15.* (unaffected, semver) ≥ 5.19.4; ≤ 5.19.* (unaffected, semver) ≥ 6.0; ≤ * (unaffected, original_commit_for_fix) Other versions: affected |
CNA: Linux |
Version ranges are source assertions. Check the vendor advisory and your installed configuration before determining exposure.
CVSS assessments
No CVSS assessment reported. An unscored record is not a low-severity determination.
Exploit evidence
No exploit evidence in collected sources. This is not proof of no exploitation.
References
- https://git.kernel.org/stable/c/7550aade978371ac582f6d43b14c4cb89ca54463CNA: Linux
- https://git.kernel.org/stable/c/560a2744cbbf03cac65a6394f9b0d99aa437c867CNA: Linux
- https://git.kernel.org/stable/c/a2522041d248a8c969cbbc97e1fc2cd8b4de120dCNA: Linux
- https://git.kernel.org/stable/c/1e1c2b86ef86a8477fd9b9a4f48a6bfe235606f6CNA: Linux
For agents and automation
Read public disclosures for free as Markdown or JSON. Compatible browsers also expose native WebMCP tools to search disclosures, read this page, and discover API access.
Use the ontology-linked Cyber API with x402 pay per request, or a Y2 Pro or Elite API key with the intel:cyber scope.
Endpoints and access details
https://api.y2.dev/api/v2/cyber/cveshttps://api.y2.dev/api/v2/cyber/cves/{cveId}
A workspace owner or admin can create a Pro or Elite API key. Send Authorization: Bearer <Y2_API_KEY> from your trusted agent runtime.
For x402, omit Authorization and read the HTTP 402 payment challenge before signing a retry. Public browser tools do not make payments.