Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

CVE-2022-49834— nilfs2: fix use-after-free bug of ns_writer on remount

EPSS 0.04% · P12

Affected Version Matrix 18

VendorProductVersion RangeStatus
LinuxLinuxfe5f171bb272946ce5fbf843ce2f8467d0d41b9a< b2fbf10040216ef5ee270773755fc2f5da65b749affected
fe5f171bb272946ce5fbf843ce2f8467d0d41b9a< 39a3ed68270b079c6b874d4e4727a512b9b4882caffected
fe5f171bb272946ce5fbf843ce2f8467d0d41b9a< b4736ab5542112fe0a40f140a0a0b072954f34daaffected
fe5f171bb272946ce5fbf843ce2f8467d0d41b9a< 9b162e81045266a2d5b44df9dffdf05c54de9ccaaffected
fe5f171bb272946ce5fbf843ce2f8467d0d41b9a< 4feedde5486c07ea79787839153a71ca71329c7daffected
fe5f171bb272946ce5fbf843ce2f8467d0d41b9a< afbd1188382a75f6cfe22c0b68533f7f9664f182affected
fe5f171bb272946ce5fbf843ce2f8467d0d41b9a< b152300d5a1ba4258dacf9916bff20e6a8c7603baffected
fe5f171bb272946ce5fbf843ce2f8467d0d41b9a< 8cccf05fe857a18ee26e20d11a8455a73ffd4efdaffected
… +10 more rows
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2022-49834

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
nilfs2: fix use-after-free bug of ns_writer on remount
Source: NVD (National Vulnerability Database)
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix use-after-free bug of ns_writer on remount If a nilfs2 filesystem is downgraded to read-only due to metadata corruption on disk and is remounted read/write, or if emergency read-only remount is performed, detaching a log writer and synchronizing the filesystem can be done at the same time. In these cases, use-after-free of the log writer (hereinafter nilfs->ns_writer) can happen as shown in the scenario below: Task1 Task2 -------------------------------- ------------------------------ nilfs_construct_segment nilfs_segctor_sync init_wait init_waitqueue_entry add_wait_queue schedule nilfs_remount (R/W remount case) nilfs_attach_log_writer nilfs_detach_log_writer nilfs_segctor_destroy kfree finish_wait _raw_spin_lock_irqsave __raw_spin_lock_irqsave do_raw_spin_lock debug_spin_lock_before <-- use-after-free While Task1 is sleeping, nilfs->ns_writer is freed by Task2. After Task1 waked up, Task1 accesses nilfs->ns_writer which is already freed. This scenario diagram is based on the Shigeru Yoshida's post [1]. This patch fixes the issue by not detaching nilfs->ns_writer on remount so that this UAF race doesn't happen. Along with this change, this patch also inserts a few necessary read-only checks with superblock instance where only the ns_writer pointer was used to check if the filesystem is read-only.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于nilfs2在重新挂载时释放后重用ns_writer。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

VendorProductAffected VersionsCPESubscribe
LinuxLinux fe5f171bb272946ce5fbf843ce2f8467d0d41b9a ~ b2fbf10040216ef5ee270773755fc2f5da65b749 -
LinuxLinux 2.6.34 -

II. Public POCs for CVE-2022-49834

#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2022-49834

请登录查看更多情报信息。

Same Patch Batch · Linux · 2025-05-01 · 245 CVEs total

CVE-2022-49854mctp: Fix an error handling path in mctp_init()
CVE-2022-49837bpf: Fix memory leaks in __check_func_call
CVE-2022-49838sctp: clear out_curr if all frag chunks of current msg are pruned
CVE-2022-49840bpf, test_run: Fix alignment problem in bpf_prog_test_run_skb()
CVE-2022-49839scsi: scsi_transport_sas: Fix error handling in sas_phy_add()
CVE-2022-49841serial: imx: Add missing .thaw_noirq hook
CVE-2022-49842ASoC: core: Fix use-after-free in snd_soc_exit()
CVE-2022-49844can: dev: fix skb drop check
CVE-2022-49845can: j1939: j1939_send_one(): fix missing CAN header initialization
CVE-2022-49846udf: Fix a slab-out-of-bounds write bug in udf_find_entry()
CVE-2022-49847net: ethernet: ti: am65-cpsw: Fix segmentation fault at module unload
CVE-2022-49849btrfs: fix match incorrectly in dev_args_match_device
CVE-2022-49848phy: qcom-qmp-combo: fix NULL-deref on runtime resume
CVE-2022-49850nilfs2: fix deadlock in nilfs_count_free_blocks()
CVE-2022-49851riscv: fix reserved memory setup
CVE-2022-49852riscv: process: fix kernel info leakage
CVE-2022-49862tipc: fix the msg->req tlv len check in tipc_nl_compat_name_table_dump_header
CVE-2022-49864drm/amdkfd: Fix NULL pointer dereference in svm_migrate_to_ram()
CVE-2022-49865ipv6: addrlabel: fix infoleak when sending struct ifaddrlblmsg to network
CVE-2022-49863can: af_can: fix NULL pointer dereference in can_rx_register()

Showing top 20 of 245 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2022-49834

No comments yet

Leave a comment