CVE-2022-49363

f2fs: fix to do sanity check on block address in f2fs_do_zero_range()

State: Published
Severity: 7.8 High
Published: Feb 26, 2025
Updated: Aug 15, 2026
Reserved: Feb 26, 2025

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

f2fs: fix to do sanity check on block address in f2fs_do_zero_range()

As Yanming reported in bugzilla:

https://bugzilla.kernel.org/show_bug.cgi?id=215894

I have encountered a bug in F2FS file system in kernel v5.17.

I have uploaded the system call sequence as case.c, and a fuzzed image can be found in google net disk

The kernel should enable CONFIG_KASAN=y and CONFIG_KASAN_INLINE=y. You can reproduce the bug by running the following commands:

kernel BUG at fs/f2fs/segment.c:2291! Call Trace: f2fs_invalidate_blocks+0x193/0x2d0 f2fs_fallocate+0x2593/0x4a70 vfs_fallocate+0x2a5/0xac0 ksys_fallocate+0x35/0x70 __x64_sys_fallocate+0x8e/0xf0 do_syscall_64+0x3b/0x90 entry_SYSCALL_64_after_hwframe+0x44/0xae

The root cause is, after image was fuzzed, block mapping info in inode will be inconsistent with SIT table, so in f2fs_fallocate(), it will cause panic when updating SIT with invalid blkaddr.

Let's fix the issue by adding sanity check on block address before updating SIT table with it.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	75cd4e098d178433436abce08146a21647bb4585 to before 7361c9f2bd6a8f0cbb41cdea9aff04765ff23f67Affected 75cd4e098d178433436abce08146a21647bb4585 to before a34d7b49894b0533222188a52e2958750f830efdAffected 75cd4e098d178433436abce08146a21647bb4585 to before f2e1c38b5ac64eb1a16a89c52fb419409d12c25bAffected 75cd4e098d178433436abce08146a21647bb4585 to before 470493be19a5730ed432e3ac0f29a2ee7fc6c557Affected 75cd4e098d178433436abce08146a21647bb4585 to before 805b48b234a2803cb7daec7f158af12f0fbaefacAffected 75cd4e098d178433436abce08146a21647bb4585 to before 25f8236213a91efdf708b9d77e9e51b6fc3e141cAffected
LinuxLinux	4.2Affected before 4.2Not affected 5.4.198 through 5.4.Not affected 5.10.121 through 5.10.Not affected 5.15.46 through 5.15.Not affected 5.17.14 through 5.17.Not affected 5.18.3 through 5.18.*Not affected 5.19 and laterNot affected

Product

Versions

LinuxLinux

75cd4e098d178433436abce08146a21647bb4585 to before 7361c9f2bd6a8f0cbb41cdea9aff04765ff23f67Affected
75cd4e098d178433436abce08146a21647bb4585 to before a34d7b49894b0533222188a52e2958750f830efdAffected
75cd4e098d178433436abce08146a21647bb4585 to before f2e1c38b5ac64eb1a16a89c52fb419409d12c25bAffected
75cd4e098d178433436abce08146a21647bb4585 to before 470493be19a5730ed432e3ac0f29a2ee7fc6c557Affected
75cd4e098d178433436abce08146a21647bb4585 to before 805b48b234a2803cb7daec7f158af12f0fbaefacAffected
75cd4e098d178433436abce08146a21647bb4585 to before 25f8236213a91efdf708b9d77e9e51b6fc3e141cAffected

LinuxLinux

4.2Affected
before 4.2Not affected
5.4.198 through 5.4.*Not affected
5.10.121 through 5.10.*Not affected
5.15.46 through 5.15.*Not affected
5.17.14 through 5.17.*Not affected
5.18.3 through 5.18.*Not affected
5.19 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.