CVE-2022-49762

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-49762
In the Linux kernel, the following vulnerability has been resolved: ntfs: check overflow when iterating ATTR_RECORDs Kernel iterates over ATTR_RECORDs in mft record in ntfs_attr_find(). Because the ATTR_RECORDs are next to each other, kernel can get the next ATTR_RECORD from end address of current ATTR_RECORD, through current ATTR_RECORD length field. The problem is that during iteration, when kernel calculates the end address of current ATTR_RECORD, kernel may trigger an integer overflow bug in executing `a = (ATTR_RECORD*)((u8*)a + le32_to_cpu(a->length))`. This may wrap, leading to a forever iteration on 32bit systems. This patch solves it by adding some checks on calculating end address of current ATTR_RECORD during iteration.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/45683723f6b53e39e8a4cec0894e61fd6ec71989 Patch
https://git.kernel.org/stable/c/5559eb5809353a83a40a1e4e7f066431c7b83020 Patch
https://git.kernel.org/stable/c/63095f4f3af59322bea984a6ae44337439348fe0 Patch
https://git.kernel.org/stable/c/785b2af9654b8beac55644e36da0085c5d776361 Patch
https://git.kernel.org/stable/c/86f36de14dce5802856bb7a5921d74439db00b64 Patch
https://git.kernel.org/stable/c/957732a09c3828267c2819d31c425aa793dd475b Patch
https://git.kernel.org/stable/c/b612f924f296408d7d02fb4cd01218afd4ed7184 Patch
https://git.kernel.org/stable/c/b63ddb3ba61e2d3539f87e095c881e552bc45dab Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

06 Nov 2025, 21:59

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/45683723f6b53e39e8a4cec0894e61fd6ec71989 - () https://git.kernel.org/stable/c/45683723f6b53e39e8a4cec0894e61fd6ec71989 - Patch
References () https://git.kernel.org/stable/c/5559eb5809353a83a40a1e4e7f066431c7b83020 - () https://git.kernel.org/stable/c/5559eb5809353a83a40a1e4e7f066431c7b83020 - Patch
References () https://git.kernel.org/stable/c/63095f4f3af59322bea984a6ae44337439348fe0 - () https://git.kernel.org/stable/c/63095f4f3af59322bea984a6ae44337439348fe0 - Patch
References () https://git.kernel.org/stable/c/785b2af9654b8beac55644e36da0085c5d776361 - () https://git.kernel.org/stable/c/785b2af9654b8beac55644e36da0085c5d776361 - Patch
References () https://git.kernel.org/stable/c/86f36de14dce5802856bb7a5921d74439db00b64 - () https://git.kernel.org/stable/c/86f36de14dce5802856bb7a5921d74439db00b64 - Patch
References () https://git.kernel.org/stable/c/957732a09c3828267c2819d31c425aa793dd475b - () https://git.kernel.org/stable/c/957732a09c3828267c2819d31c425aa793dd475b - Patch
References () https://git.kernel.org/stable/c/b612f924f296408d7d02fb4cd01218afd4ed7184 - () https://git.kernel.org/stable/c/b612f924f296408d7d02fb4cd01218afd4ed7184 - Patch
References () https://git.kernel.org/stable/c/b63ddb3ba61e2d3539f87e095c881e552bc45dab - () https://git.kernel.org/stable/c/b63ddb3ba61e2d3539f87e095c881e552bc45dab - Patch
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ntfs: desbordamiento de comprobación al iterar ATTR_RECORDs El kernel itera sobre los ATTR_RECORD en el registro mft en ntfs_attr_find(). Debido a que los ATTR_RECORD están uno al lado del otro, el kernel puede obtener el siguiente ATTR_RECORD desde la dirección final del ATTR_RECORD actual, a través del campo de longitud del ATTR_RECORD actual. El problema es que durante la iteración, cuando el kernel calcula la dirección final del ATTR_RECORD actual, el kernel puede desencadenar un error de desbordamiento de enteros al ejecutar `a = (ATTR_RECORD*)((u8*)a + le32_to_cpu(a->length))`. Esto puede envolverse, lo que lleva a una iteración eterna en sistemas de 32 bits. Este parche lo resuelve añadiendo algunas comprobaciones en el cálculo de la dirección final del ATTR_RECORD actual durante la iteración.
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
CWE NVD-CWE-noinfo
First Time Linux
Linux linux Kernel

01 May 2025, 15:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-05-01 15:15

Updated : 2025-11-06 21:59

NVD link : CVE-2022-49762

Mitre link : CVE-2022-49762

CVE.ORG link : CVE-2022-49762

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
NVD-CWE-noinfo