Linux Kernel up to 5.10.120/5.15.45/5.17.13/5.18.2 fs/inode.c f2fs_evict_inode privilege escalation

Summaryinfo

A vulnerability described as problematic has been identified in Linux Kernel up to 5.10.120/5.15.45/5.17.13/5.18.2. Affected by this issue is the function f2fs_evict_inode of the file fs/inode.c. Such manipulation leads to an unknown weakness. This vulnerability is traded as CVE-2022-49361. There is no exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in Linux Kernel up to 5.10.120/5.15.45/5.17.13/5.18.2 and classified as problematic. Affected by this issue is the function f2fs_evict_inode of the file fs/inode.c. The impact remains unknown. CVE summarizes:

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to do sanity check for inline inode Yanming reported a kernel bug in Bugzilla kernel [1], which can be reproduced. The bug message is: The kernel message is shown below: kernel BUG at fs/inode.c:611! Call Trace: evict+0x282/0x4e0 __dentry_kill+0x2b2/0x4d0 dput+0x2dd/0x720 do_renameat2+0x596/0x970 __x64_sys_rename+0x78/0x90 do_syscall_64+0x3b/0x90 [1] https://bugzilla.kernel.org/show_bug.cgi?id=215895 The bug is due to fuzzed inode has both inline_data and encrypted flags. During f2fs_evict_inode(), as the inode was deleted by rename(), it will cause inline data conversion due to conflicting flags. The page cache will be polluted and the panic will be triggered in clear_inode(). Try fixing the bug by doing more sanity checks for inline data inode in sanity_check_inode().

The advisory is shared for download at git.kernel.org. This vulnerability is handled as CVE-2022-49361 since 02/26/2025. The exploitation is known to be difficult. There are known technical details, but no exploit is available.

The vulnerability scanner Nessus provides a plugin with the ID 225795 (Linux Distros Unpatched Vulnerability : CVE-2022-49361), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 5.10.121, 5.15.46, 5.17.14 or 5.18.3 eliminates this vulnerability. Applying the patch efdefbe8b7564602ab446474788225a1f2a323b5/7cfe2d43becaf76e562b9617d2c2d9b445f86761/11c1cd032df85df3c096a57a7f27d57819956e4a/198fd9faa271dd54dca6fc8eb6873f42dfd3b4d8/677a82b44ebf263d4f9a0cfbd576a6ade797a07b is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the databases at Tenable (225795) and EUVD (EUVD-2022-54868). Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 5.10.120
• 5.15.0
• 5.15.1
• 5.15.2
• 5.15.3
• 5.15.4
• 5.15.5
• 5.15.6
• 5.15.7
• 5.15.8
• 5.15.9
• 5.15.10
• 5.15.11
• 5.15.12
• 5.15.13
• 5.15.14
• 5.15.15
• 5.15.16
• 5.15.17
• 5.15.18
• 5.15.19
• 5.15.20
• 5.15.21
• 5.15.22
• 5.15.23
• 5.15.24
• 5.15.25
• 5.15.26
• 5.15.27
• 5.15.28
• 5.15.29
• 5.15.30
• 5.15.31
• 5.15.32
• 5.15.33
• 5.15.34
• 5.15.35
• 5.15.36
• 5.15.37
• 5.15.38
• 5.15.39
• 5.15.40
• 5.15.41
• 5.15.42
• 5.15.43
• 5.15.44
• 5.15.45
• 5.17.0
• 5.17.1
• 5.17.2
• 5.17.3
• 5.17.4
• 5.17.5
• 5.17.6
• 5.17.7
• 5.17.8
• 5.17.9
• 5.17.10
• 5.17.11
• 5.17.12
• 5.17.13
• 5.18.0
• 5.18.1
• 5.18.2

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion