182 lines
9.9 KiB
JSON
182 lines
9.9 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2022-49274",
|
|
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "Linux",
|
|
"dateReserved": "2025-02-26T01:49:39.297Z",
|
|
"datePublished": "2025-02-26T01:56:19.586Z",
|
|
"dateUpdated": "2026-08-05T08:54:31.739Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"providerMetadata": {
|
|
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"shortName": "Linux",
|
|
"dateUpdated": "2026-08-05T08:54:31.739Z"
|
|
},
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: fix crash when mount with quota enabled\n\nThere is a reported crash when mounting ocfs2 with quota enabled.\n\n RIP: 0010:ocfs2_qinfo_lock_res_init+0x44/0x50 [ocfs2]\n Call Trace:\n ocfs2_local_read_info+0xb9/0x6f0 [ocfs2]\n dquot_load_quota_sb+0x216/0x470\n dquot_load_quota_inode+0x85/0x100\n ocfs2_enable_quotas+0xa0/0x1c0 [ocfs2]\n ocfs2_fill_super.cold+0xc8/0x1bf [ocfs2]\n mount_bdev+0x185/0x1b0\n legacy_get_tree+0x27/0x40\n vfs_get_tree+0x25/0xb0\n path_mount+0x465/0xac0\n __x64_sys_mount+0x103/0x140\n\nIt is caused by when initializing dqi_gqlock, the corresponding dqi_type\nand dqi_sb are not properly initialized.\n\nThis issue is introduced by commit 6c85c2c72819, which wants to avoid\naccessing uninitialized variables in error cases. So make global quota\ninfo properly initialized."
|
|
}
|
|
],
|
|
"metrics": [
|
|
{
|
|
"cvssV3_1": {
|
|
"version": "3.1",
|
|
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
|
|
"baseScore": 7.8,
|
|
"baseSeverity": "HIGH"
|
|
},
|
|
"scenarios": [
|
|
{
|
|
"lang": "en",
|
|
"value": "AV:L - The bug is reached only via the local mount path (mount → ocfs2_fill_super → ocfs2_enable_quotas → ocfs2_local_read_info); ocfs2 lacks a network-facing packet handler that triggers this code.\nAC:L - Mounting any ocfs2 volume with the on-disk usrquota/grpquota RO_COMPAT features enabled reliably hits ocfs2_qinfo_lock_res_init with uninitialized dqi_gi fields; no race or attacker-uncontrollable condition is required.\nPR:N - An unprivileged attacker can supply a quota-enabled ocfs2 image (e.g., via mkfs.ocfs2 on a file) without credentials on the target; ocfs2 is not FS_USERNS_MOUNT, so the privileged mount itself is performed by the victim.\nUI:R - Exploitation requires a user/administrator to mount (or remount RW) the attacker-supplied or quota-enabled ocfs2 filesystem to reach ocfs2_enable_quotas.\nS:U - Impact is confined to the host kernel's own privilege boundary (oops or memory corruption in-kernel); there is no VM/IOMMU/sandbox escape.\nC:H - kmalloc'd ocfs2_mem_dqinfo leaves dqi_gi.dqi_sb uninitialized, so OCFS2_SB() dereferences attacker-influencable heap contents; with local heap grooming this yields a controlled read-through of kernel memory, and when uncertain the higher impact is required.\nI:H - The same uninitialized super_block pointer flows into ocfs2_lock_res_init_common → ocfs2_add_lockres_tracking → list_add on osb->osb_dlm_debug, giving a write primitive if the pointer is groomed, so integrity impact is High.\nA:H - The reported and expected outcome is a kernel oops in ocfs2_qinfo_lock_res_init when the garbage pointer is unmapped, which is a full availability loss."
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "unaffected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"fs/ocfs2/quota_global.c",
|
|
"fs/ocfs2/quota_local.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "6c85c2c728193d19d6a908ae9fb312d0325e65ca",
|
|
"lessThan": "7c5312fdb1dcfdc1951b018669af88d5d6420b31",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "6c85c2c728193d19d6a908ae9fb312d0325e65ca",
|
|
"lessThan": "01931e1c4e3de5d777253acae64c0e8fd071a1dd",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "6c85c2c728193d19d6a908ae9fb312d0325e65ca",
|
|
"lessThan": "eda31f77317647b9fbf889779ee1fb6907651865",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "6c85c2c728193d19d6a908ae9fb312d0325e65ca",
|
|
"lessThan": "de19433423c7bedabbd4f9a25f7dbc62c5e78921",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "affected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"fs/ocfs2/quota_global.c",
|
|
"fs/ocfs2/quota_local.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "5.15",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "0",
|
|
"lessThan": "5.15",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "5.15.33",
|
|
"lessThanOrEqual": "5.15.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "5.16.19",
|
|
"lessThanOrEqual": "5.16.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "5.17.2",
|
|
"lessThanOrEqual": "5.17.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "5.18",
|
|
"lessThanOrEqual": "*",
|
|
"status": "unaffected",
|
|
"versionType": "original_commit_for_fix"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"cpeApplicability": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.15",
|
|
"versionEndExcluding": "5.15.33"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.15",
|
|
"versionEndExcluding": "5.16.19"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.15",
|
|
"versionEndExcluding": "5.17.2"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.15",
|
|
"versionEndExcluding": "5.18"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/7c5312fdb1dcfdc1951b018669af88d5d6420b31"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/01931e1c4e3de5d777253acae64c0e8fd071a1dd"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/eda31f77317647b9fbf889779ee1fb6907651865"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/de19433423c7bedabbd4f9a25f7dbc62c5e78921"
|
|
}
|
|
],
|
|
"title": "ocfs2: fix crash when mount with quota enabled",
|
|
"x_generator": {
|
|
"engine": "bippy-1.2.0"
|
|
}
|
|
}
|
|
}
|
|
} |