CVE-2022-49762

ntfs: check overflow when iterating ATTR_RECORDs

State: Published
Severity: Not scored
Published: May 1, 2025
Updated: May 11, 2026
Reserved: Mar 27, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

ntfs: check overflow when iterating ATTR_RECORDs

Kernel iterates over ATTR_RECORDs in mft record in ntfs_attr_find(). Because the ATTR_RECORDs are next to each other, kernel can get the next ATTR_RECORD from end address of current ATTR_RECORD, through current ATTR_RECORD length field.

The problem is that during iteration, when kernel calculates the end address of current ATTR_RECORD, kernel may trigger an integer overflow bug in executing `a = (ATTR_RECORD*)((u8*)a + le32_to_cpu(a->length))`. This may wrap, leading to a forever iteration on 32bit systems.

This patch solves it by adding some checks on calculating end address of current ATTR_RECORD during iteration.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 5559eb5809353a83a40a1e4e7f066431c7b83020Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 86f36de14dce5802856bb7a5921d74439db00b64Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 45683723f6b53e39e8a4cec0894e61fd6ec71989Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before b612f924f296408d7d02fb4cd01218afd4ed7184Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 957732a09c3828267c2819d31c425aa793dd475bAffected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before b63ddb3ba61e2d3539f87e095c881e552bc45dabAffected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 785b2af9654b8beac55644e36da0085c5d776361Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 63095f4f3af59322bea984a6ae44337439348fe0Affected
LinuxLinux	2.6.12Affected before 2.6.12Not affected 4.9.334 through 4.9.Not affected 4.14.300 through 4.14.Not affected 4.19.267 through 4.19.Not affected 5.4.225 through 5.4.Not affected 5.10.156 through 5.10.Not affected 5.15.80 through 5.15.Not affected 6.0.10 through 6.0.*Not affected 6.1 and laterNot affected

Product

Versions

LinuxLinux

1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 5559eb5809353a83a40a1e4e7f066431c7b83020Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 86f36de14dce5802856bb7a5921d74439db00b64Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 45683723f6b53e39e8a4cec0894e61fd6ec71989Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before b612f924f296408d7d02fb4cd01218afd4ed7184Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 957732a09c3828267c2819d31c425aa793dd475bAffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before b63ddb3ba61e2d3539f87e095c881e552bc45dabAffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 785b2af9654b8beac55644e36da0085c5d776361Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 63095f4f3af59322bea984a6ae44337439348fe0Affected

LinuxLinux

2.6.12Affected
before 2.6.12Not affected
4.9.334 through 4.9.*Not affected
4.14.300 through 4.14.*Not affected
4.19.267 through 4.19.*Not affected
5.4.225 through 5.4.*Not affected
5.10.156 through 5.10.*Not affected
5.15.80 through 5.15.*Not affected
6.0.10 through 6.0.*Not affected
6.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.