PT-2025-8314 · Linux+1 · Linux Kernel+1

Ming Yan · Published 2025-02-26 · Updated 2025-03-02 · CVE-2022-49380

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel version 5.17

Description A bug in the F2FS file system has been identified, which can cause the kernel to panic when the dec valid node count() function is called. The issue occurs when the .total valid block count or .total valid node count values are fuzzed to zero. This bug can be reproduced by running specific commands and is evident in the kernel message. The root cause of the issue is related to the f2fs bug on() function in dec valid node count().

Recommendations For Linux kernel version 5.17, apply the patch that fixes the issue by printing warning information and setting SBI NEED FSCK into CP instead of panicking.

Exploit

Fix

Related Identifiers

CVE-2022-49380

Affected Products

Astra Linux

Linux Kernel

References · 19

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49380.json · Exploit
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-49380 · Vendor Advisory
• https://git.kernel.org/stable/c/f8b3c3fcf33105bc1ee7788e3b51b0a1ae42ae53 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-49380 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-49380 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-49380 · Security Note
• https://git.kernel.org/stable/c/2766ddaf45b69252bb8fe526b5b6e56904a9ae7a · Patch
• https://cve.org/CVERecord?id=CVE-2022-49380 · Security Note
• https://wiki.astralinux.ru/pages/viewpage.action?pageId=158612043 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-49380 · Vendor Advisory
• https://git.kernel.org/stable/c/89d9a48d0cd30429463ea4e37ca83be6773ed5eb · Patch
• https://git.kernel.org/stable/c/4d17e6fe9293d57081ffdc11e1cf313e25e8fd9e · Patch
• https://git.kernel.org/stable/c/bce859358d3d5940aa858e40ceee70ee6e76130e · Patch
• https://osv.dev/vulnerability/CVE-2022-49380 · Vendor Advisory
• https://git.kernel.org/stable/c/ccffa99ae6a1f44797b57444c6a80382a42928fe · Patch