CVE-2022-50753 in Linux
Summary
by MITRE • 12/24/2025
In the Linux kernel, the following vulnerability has been resolved:
f2fs: fix to do sanity check on summary info
As Wenqing Liu reported in bugzilla:
https://bugzilla.kernel.org/show_bug.cgi?id=216456
BUG: KASAN: use-after-free in recover_data+0x63ae/0x6ae0 [f2fs]
Read of size 4 at addr ffff8881464dcd80 by task mount/1013
CPU: 3 PID: 1013 Comm: mount Tainted: G W 6.0.0-rc4 #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014 Call Trace: dump_stack_lvl+0x45/0x5e print_report.cold+0xf3/0x68d kasan_report+0xa8/0x130 recover_data+0x63ae/0x6ae0 [f2fs]
f2fs_recover_fsync_data+0x120d/0x1fc0 [f2fs]
f2fs_fill_super+0x4665/0x61e0 [f2fs]
mount_bdev+0x2cf/0x3b0 legacy_get_tree+0xed/0x1d0 vfs_get_tree+0x81/0x2b0 path_mount+0x47e/0x19d0 do_mount+0xce/0xf0 __x64_sys_mount+0x12c/0x1a0 do_syscall_64+0x38/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd
The root cause is: in fuzzed image, SSA table is corrupted: ofs_in_node is larger than ADDRS_PER_PAGE(), result in out-of-range access on 4k-size page.
- recover_data - do_recover_data - check_index_in_prev_nodes - f2fs_data_blkaddr
This patch adds sanity check on summary info in recovery and GC flow in where the flows rely on them.
After patch: [ 29.310883] F2FS-fs (loop0): Inconsistent ofs_in_node:65286 in summary, ino:0, nid:6, max:1018
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 04/21/2026
The vulnerability CVE-2022-50753 affects the Linux kernel's F2FS (Flash-Friendly File System) implementation and represents a critical use-after-free condition that can lead to system instability and potential privilege escalation. This issue manifests during the filesystem recovery process when the kernel attempts to access corrupted data structures in the SSA (Segment Summary Area) table. The bug was identified through KASAN (Kernel Address Sanitizer) reporting a use-after-free error in the recover_data function, specifically at offset 0x63ae within the f2fs module. The problematic execution path involves the mount process where the kernel tries to recover data from a corrupted filesystem image, triggering an out-of-bounds memory access pattern.
The technical root cause lies in improper validation of summary information during filesystem recovery operations. When processing a fuzzed filesystem image, the SSA table contains corrupted data where the ofs_in_node field exceeds the valid range defined by ADDRS_PER_PAGE(), which is typically 1018 for 4KB pages. This results in an out-of-range memory access that attempts to read 4 bytes from address 0xffff8881464dcd80. The call stack shows the execution flow starting from mount process through f2fs_fill_super, f2fs_recover_fsync_data, and ultimately reaching recover_data where the use-after-free occurs. The vulnerability specifically affects the check_index_in_prev_nodes function which calls f2fs_data_blkaddr, creating a scenario where freed memory locations are accessed after the summary information has been processed.
This vulnerability poses significant operational risks to systems running F2FS filesystems, particularly in environments where filesystem corruption or maliciously crafted images might be encountered. The out-of-bounds memory access can lead to kernel crashes, data corruption, or potentially allow attackers to exploit the use-after-free condition for privilege escalation. The impact is particularly severe because it occurs during the critical mount process, meaning any system attempting to boot from or access a corrupted F2FS volume could experience system instability. According to CWE classification, this represents a CWE-416 Use After Free vulnerability, which is categorized under the broader weakness of improper cleanup of resources. The ATT&CK framework would classify this under T1059.001 Command and Scripting Interpreter: PowerShell and T1068 Exploitation for Privilege Escalation, as the vulnerability could be leveraged to gain elevated privileges through kernel exploitation.
The patch addresses this issue by implementing additional sanity checks on summary information within both the recovery and garbage collection flows of the F2FS filesystem. These checks validate that the ofs_in_node values remain within acceptable bounds before proceeding with data access operations. The fix specifically targets the recovery and garbage collection paths where the system relies heavily on summary information for proper filesystem operation. The patched version now includes validation that will detect inconsistent ofs_in_node values and log appropriate error messages such as "Inconsistent ofs_in_node:65286 in summary, ino:0, nid:6, max:1018" before terminating the recovery process. This defensive programming approach prevents the out-of-bounds memory access that previously led to use-after-free conditions and system crashes. The mitigation strategy ensures that corrupted filesystem metadata is properly rejected rather than processed, preventing potential exploitation while maintaining filesystem integrity.