CVE-2022-50021

In the Linux kernel, the following vulnerability has been resolved:

ext4: block range must be validated before use in ext4_mb_clear_bb()

Block range to free is validated in ext4_free_blocks() using
ext4_inode_block_valid() and then it's passed to ext4_mb_clear_bb().
However in some situations on bigalloc file system the range might be
adjusted after the validation in ext4_free_blocks() which can lead to
troubles on corrupted file systems such as one found by syzkaller that
resulted in the following BUG

kernel BUG at fs/ext4/ext4.h:3319!
PREEMPT SMP NOPTI
CPU: 28 PID: 4243 Comm: repro Kdump: loaded Not tainted 5.19.0-rc6+ #1
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1.fc35 04/01/2014
RIP: 0010:ext4_free_blocks+0x95e/0xa90
Call Trace:
 <TASK>
 ? lock_timer_base+0x61/0x80
 ? __es_remove_extent+0x5a/0x760
 ? __mod_timer+0x256/0x380
 ? ext4_ind_truncate_ensure_credits+0x90/0x220
 ext4_clear_blocks+0x107/0x1b0
 ext4_free_data+0x15b/0x170
 ext4_ind_truncate+0x214/0x2c0
 ? _raw_spin_unlock+0x15/0x30
 ? ext4_discard_preallocations+0x15a/0x410
 ? ext4_journal_check_start+0xe/0x90
 ? __ext4_journal_start_sb+0x2f/0x110
 ext4_truncate+0x1b5/0x460
 ? __ext4_journal_start_sb+0x2f/0x110
 ext4_evict_inode+0x2b4/0x6f0
 evict+0xd0/0x1d0
 ext4_enable_quotas+0x11f/0x1f0
 ext4_orphan_cleanup+0x3de/0x430
 ? proc_create_seq_private+0x43/0x50
 ext4_fill_super+0x295f/0x3ae0
 ? snprintf+0x39/0x40
 ? sget_fc+0x19c/0x330
 ? ext4_reconfigure+0x850/0x850
 get_tree_bdev+0x16d/0x260
 vfs_get_tree+0x25/0xb0
 path_mount+0x431/0xa70
 __x64_sys_mount+0xe2/0x120
 do_syscall_64+0x5b/0x80
 ? do_user_addr_fault+0x1e2/0x670
 ? exc_page_fault+0x70/0x170
 entry_SYSCALL_64_after_hwframe+0x46/0xb0
RIP: 0033:0x7fdf4e512ace

Fix it by making sure that the block range is properly validated before
used every time it changes in ext4_free_blocks() or ext4_mb_clear_bb().
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
UNKNOWN
---
LinuxCNA
---
---
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 2%
Debian logo
Debian Releases
Debian Product
Codename
linux
bullseye
5.10.223-1
fixed
bullseye (security)
5.10.237-1
fixed
bookworm
6.1.137-1
fixed
bookworm (security)
6.1.140-1
fixed
trixie (security)
6.12.31-1
fixed
sid
6.12.32-1
fixed
trixie
6.12.32-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
linux
plucky
needs-triage
oracular
needs-triage
noble
needs-triage
jammy
needs-triage
focal
needs-triage
bionic
needs-triage
xenial
needs-triage
trusty
needs-triage
linux-allwinner-5.19
plucky
dne
oracular
dne
noble
dne
jammy
ignored
linux-aws
plucky
needs-triage
oracular
needs-triage
noble
needs-triage
jammy
needs-triage
focal
needs-triage
bionic
needs-triage
xenial
needs-triage
trusty
needs-triage
linux-aws-5.0
plucky
dne
oracular
dne
noble
dne
jammy
dne
bionic
ignored
linux-aws-5.11
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
ignored
linux-aws-5.13
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
ignored
linux-aws-5.15
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
needs-triage
linux-aws-5.19
plucky
dne
oracular
dne
noble
dne
jammy
ignored
linux-aws-5.3
plucky
dne
oracular
dne
noble
dne
jammy
dne
bionic
ignored
linux-aws-5.4
plucky
dne
oracular
dne
noble
dne
jammy
dne
bionic
needs-triage
linux-aws-5.8
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
ignored
linux-aws-6.2
plucky
dne
oracular
dne
noble
dne
jammy
ignored
linux-aws-6.5
plucky
dne
oracular
dne
noble
dne
jammy
ignored
linux-aws-6.8
plucky
dne
oracular
dne
noble
dne
jammy
needs-triage
linux-aws-fips
plucky
dne
oracular
dne
noble
dne
jammy
needs-triage
focal
needs-triage
bionic
needs-triage
linux-aws-hwe
plucky
dne
oracular
dne
noble
dne
jammy
dne
xenial
needs-triage
linux-azure
plucky
needs-triage
oracular
needs-triage
noble
needs-triage
jammy
needs-triage
focal
needs-triage
bionic
ignored
xenial
needs-triage
trusty
needs-triage
linux-azure-4.15
plucky
dne
oracular
dne
noble
dne
jammy
dne
bionic
needs-triage
linux-azure-5.11
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
ignored
linux-azure-5.13
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
ignored
linux-azure-5.15
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
needs-triage
linux-azure-5.19
plucky
dne
oracular
dne
noble
dne
jammy
ignored
linux-azure-5.3
plucky
dne
oracular
dne
noble
dne
jammy
dne
bionic
ignored
linux-azure-5.4
plucky
dne
oracular
dne
noble
dne
jammy
dne
bionic
needs-triage
linux-azure-5.8
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
ignored
linux-azure-6.11
plucky
dne
oracular
dne
noble
needs-triage
jammy
dne
linux-azure-6.2
plucky
dne
oracular
dne
noble
dne
jammy
ignored
linux-azure-6.5
plucky
dne
oracular
dne
noble
dne
jammy
ignored
linux-azure-6.8
plucky
dne
oracular
dne
noble
dne
jammy
needs-triage
linux-azure-edge
plucky
dne
oracular
dne
noble
dne
jammy
dne
bionic
ignored
linux-azure-fde
plucky
dne
oracular
dne
noble
dne
jammy
needs-triage
focal
ignored
linux-azure-fde-5.15
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
needs-triage
linux-azure-fde-5.19
plucky
dne
oracular
dne
noble
dne
jammy
ignored
linux-azure-fde-6.2
plucky
dne
oracular
dne
noble
dne
jammy
ignored
linux-azure-fips
plucky
dne
oracular
dne
noble
dne
jammy
needs-triage
focal
needs-triage
bionic
needs-triage
linux-azure-nvidia
plucky
dne
oracular
dne
noble
needs-triage
jammy
dne
linux-bluefield
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
needs-triage
linux-fips
plucky
dne
oracular
dne
noble
dne
jammy
needs-triage
focal
needs-triage
bionic
needs-triage
xenial
needs-triage
linux-gcp
plucky
needs-triage
oracular
needs-triage
noble
needs-triage
jammy
needs-triage
focal
needs-triage
bionic
ignored
xenial
needs-triage
linux-gcp-4.15
plucky
dne
oracular
dne
noble
dne
jammy
dne
bionic
needs-triage
linux-gcp-5.11
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
ignored
linux-gcp-5.13
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
ignored
linux-gcp-5.15
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
needs-triage
linux-gcp-5.19
plucky
dne
oracular
dne
noble
dne
jammy
ignored
linux-gcp-5.3
plucky
dne
oracular
dne
noble
dne
jammy
dne
bionic
ignored
linux-gcp-5.4
plucky
dne
oracular
dne
noble
dne
jammy
dne
bionic
needs-triage
linux-gcp-5.8
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
ignored
linux-gcp-6.11
plucky
dne
oracular
dne
noble
needs-triage
jammy
dne
linux-gcp-6.2
plucky
dne
oracular
dne
noble
dne
jammy
ignored
linux-gcp-6.5
plucky
dne
oracular
dne
noble
dne
jammy
ignored
linux-gcp-6.8
plucky
dne
oracular
dne
noble
dne
jammy
needs-triage
linux-gcp-fips
plucky
dne
oracular
dne
noble
dne
jammy
needs-triage
focal
needs-triage
bionic
needs-triage
linux-gke
plucky
dne
oracular
dne
noble
needs-triage
jammy
needs-triage
focal
ignored
linux-gke-4.15
plucky
dne
oracular
dne
noble
dne
jammy
dne
bionic
ignored
linux-gke-5.15
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
ignored
linux-gke-5.4
plucky
dne
oracular
dne
noble
dne
jammy
dne
bionic
ignored
linux-gkeop
plucky
dne
oracular
dne
noble
needs-triage
jammy
needs-triage
focal
ignored
linux-gkeop-5.15
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
ignored
linux-gkeop-5.4
plucky
dne
oracular
dne
noble
dne
jammy
dne
bionic
ignored
linux-hwe
plucky
dne
oracular
dne
noble
dne
jammy
dne
bionic
ignored
xenial
needs-triage
linux-hwe-5.11
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
ignored
linux-hwe-5.13
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
ignored
linux-hwe-5.15
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
needs-triage
linux-hwe-5.19
plucky
dne
oracular
dne
noble
dne
jammy
ignored
linux-hwe-5.4
plucky
dne
oracular
dne
noble
dne
jammy
dne
bionic
needs-triage
linux-hwe-5.8
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
ignored
linux-hwe-6.11
plucky
dne
oracular
dne
noble
needs-triage
jammy
dne
linux-hwe-6.2
plucky
dne
oracular
dne
noble
dne
jammy
ignored
linux-hwe-6.5
plucky
dne
oracular
dne
noble
dne
jammy
ignored
linux-hwe-6.8
plucky
dne
oracular
dne
noble
dne
jammy
needs-triage
linux-hwe-edge
plucky
dne
oracular
dne
noble
dne
jammy
dne
bionic
ignored
xenial
ignored
linux-ibm
plucky
dne
oracular
dne
noble
needs-triage
jammy
needs-triage
focal
needs-triage
linux-ibm-5.15
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
needs-triage
linux-ibm-5.4
plucky
dne
oracular
dne
noble
dne
jammy
dne
bionic
needs-triage
linux-intel-5.13
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
ignored
linux-intel-iot-realtime
plucky
dne
oracular
dne
noble
dne
jammy
needs-triage
linux-intel-iotg
plucky
dne
oracular
dne
noble
dne
jammy
needs-triage
linux-intel-iotg-5.15
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
needs-triage
linux-iot
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
needs-triage
linux-kvm
plucky
dne
oracular
dne
noble
dne
jammy
needs-triage
focal
needs-triage
bionic
needs-triage
xenial
needs-triage
linux-lowlatency
plucky
dne
oracular
needs-triage
noble
needs-triage
jammy
needs-triage
linux-lowlatency-hwe-5.15
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
needs-triage
linux-lowlatency-hwe-5.19
plucky
dne
oracular
dne
noble
dne
jammy
ignored
linux-lowlatency-hwe-6.11
plucky
dne
oracular
dne
noble
needs-triage
jammy
dne
linux-lowlatency-hwe-6.2
plucky
dne
oracular
dne
noble
dne
jammy
ignored
linux-lowlatency-hwe-6.5
plucky
dne
oracular
dne
noble
dne
jammy
ignored
linux-lowlatency-hwe-6.8
plucky
dne
oracular
dne
noble
dne
jammy
needs-triage
linux-lts-xenial
plucky
dne
oracular
dne
noble
dne
jammy
dne
trusty
needs-triage
linux-nvidia
plucky
dne
oracular
dne
noble
needs-triage
jammy
needs-triage
linux-nvidia-6.2
plucky
dne
oracular
dne
noble
dne
jammy
ignored
linux-nvidia-6.5
plucky
dne
oracular
dne
noble
dne
jammy
ignored
linux-nvidia-6.8
plucky
dne
oracular
dne
noble
dne
jammy
needs-triage
linux-nvidia-lowlatency
plucky
dne
oracular
dne
noble
needs-triage
jammy
dne
linux-nvidia-tegra
plucky
dne
oracular
dne
noble
needs-triage
jammy
needs-triage
linux-nvidia-tegra-5.15
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
needs-triage
linux-nvidia-tegra-igx
plucky
dne
oracular
dne
noble
dne
jammy
needs-triage
linux-oem
plucky
dne
oracular
dne
noble
dne
jammy
dne
bionic
ignored
linux-oem-5.10
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
ignored
linux-oem-5.13
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
ignored
linux-oem-5.14
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
ignored
linux-oem-5.17
plucky
dne
oracular
dne
noble
dne
jammy
ignored
linux-oem-5.6
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
ignored
linux-oem-6.0
plucky
dne
oracular
dne
noble
dne
jammy
ignored
linux-oem-6.1
plucky
dne
oracular
dne
noble
dne
jammy
ignored
linux-oem-6.11
plucky
dne
oracular
dne
noble
needs-triage
jammy
dne
linux-oem-6.14
plucky
dne
oracular
dne
noble
needs-triage
jammy
dne
linux-oem-6.5
plucky
dne
oracular
dne
noble
dne
jammy
ignored
linux-oem-6.8
plucky
dne
oracular
dne
noble
needs-triage
jammy
dne
linux-oracle
plucky
needs-triage
oracular
needs-triage
noble
needs-triage
jammy
needs-triage
focal
needs-triage
bionic
needs-triage
xenial
needs-triage
linux-oracle-5.0
plucky
dne
oracular
dne
noble
dne
jammy
dne
bionic
ignored
linux-oracle-5.11
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
ignored
linux-oracle-5.13
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
ignored
linux-oracle-5.15
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
needs-triage
linux-oracle-5.3
plucky
dne
oracular
dne
noble
dne
jammy
dne
bionic
ignored
linux-oracle-5.4
plucky
dne
oracular
dne
noble
dne
jammy
dne
bionic
needs-triage
linux-oracle-5.8
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
ignored
linux-oracle-6.5
plucky
dne
oracular
dne
noble
dne
jammy
ignored
linux-oracle-6.8
plucky
dne
oracular
dne
noble
dne
jammy
needs-triage
linux-raspi
plucky
needs-triage
oracular
needs-triage
noble
needs-triage
jammy
needs-triage
focal
needs-triage
linux-raspi-5.4
plucky
dne
oracular
dne
noble
dne
jammy
dne
bionic
needs-triage
linux-raspi-realtime
plucky
dne
oracular
dne
noble
needs-triage
jammy
dne
linux-raspi2
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
ignored
linux-realtime
plucky
needs-triage
oracular
needs-triage
noble
needs-triage
jammy
needs-triage
linux-riscv
plucky
needs-triage
oracular
needs-triage
noble
needs-triage
jammy
ignored
focal
ignored
linux-riscv-5.11
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
ignored
linux-riscv-5.15
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
needs-triage
linux-riscv-5.19
plucky
dne
oracular
dne
noble
dne
jammy
ignored
linux-riscv-5.8
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
ignored
linux-riscv-6.5
plucky
dne
oracular
dne
noble
dne
jammy
ignored
linux-riscv-6.8
plucky
dne
oracular
dne
noble
dne
jammy
needs-triage
linux-starfive-5.19
plucky
dne
oracular
dne
noble
dne
jammy
ignored
linux-starfive-6.2
plucky
dne
oracular
dne
noble
dne
jammy
ignored
linux-starfive-6.5
plucky
dne
oracular
dne
noble
dne
jammy
ignored
linux-xilinx-zynqmp
plucky
dne
oracular
dne
noble
dne
jammy
needs-triage
focal
needs-triage