What’s Vulnerable › Vulnerabilities

CVE-2022-48502

• Severity: high (CVSS 7.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-05-31 · updated 2026-06-17
• Weakness: CWE-125

Description

An issue was discovered in the Linux kernel before 6.2. The ntfs3 subsystem does not properly check for correctness during disk reads, leading to an out-of-bounds read in ntfs_set_ea in fs/ntfs3/xattr.c.

Affected products

• Linux kernel: from 5.15 before 5.15.121; from 5.16 before 6.1.40 — fixed in 5.15.121, 6.1.40
• NetApp H300S: all versions
• NetApp H410C: all versions
• NetApp H410S: all versions
• NetApp H500S: all versions
• NetApp H700S: all versions

How to fix

Upgrade to a fixed version: Linux kernel 5.15.121, 6.1.40. Check the vendor advisory for mitigations.

References

• https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.2
• https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=0e8235d28f3a0e9eda9f02ff67ee566d5f42b66b
• https://security.netapp.com/advisory/ntap-20230703-0004/
• https://syzkaller.appspot.com/bug?extid=8778f030156c6cd16d72
• https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.2
• https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=0e8235d28f3a0e9eda9f02ff67ee566d5f42b66b
• https://security.netapp.com/advisory/ntap-20230703-0004/
• https://syzkaller.appspot.com/bug?extid=8778f030156c6cd16d72

Get alerted when CVE-2022-48502 or the next vulnerability affects your stack