CVE-2022-49363: f2fs: fix to do sanity check on block address in f2fs_do_zero_range()

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-02-26 · updated 2026-08-15

Description

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to do sanity check on block address in f2fs_do_zero_range() As Yanming reported in bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=215894 I have encountered a bug in F2FS file system in kernel v5.17. I have uploaded the system call sequence as case.c, and a fuzzed image can be found in google net disk The kernel should enable CONFIG_KASAN=y and CONFIG_KASAN_INLINE=y. You can reproduce the bug by running the following commands: kernel BUG at fs/f2fs/segment.c:2291! Call Trace: f2fs_invalidate_blocks+0x193/0x2d0 f2fs_fallocate+0x2593/0x4a70 vfs_fallocate+0x2a5/0xac0 ksys_fallocate+0x35/0x70 __x64_sys_fallocate+0x8e/0xf0 do_syscall_64+0x3b/0x90 entry_SYSCALL_64_after_hwframe+0x44/0xae The root cause is, after image was fuzzed, block mapping info in inode will be inconsistent with SIT table, so in f2fs_fallocate(), it will cause panic when updating SIT with invalid blkaddr. Let's fix the issue by adding sanity check on block address before updating SIT table with it.

Affected products

Linux kernel: from 3.8 before 5.4.198; from 5.5 before 5.10.121; from 5.11 before 5.15.46; from 5.16 before 5.17.14; from 5.18 before 5.18.3 — fixed in 5.10.121, 5.15.46, 5.17.14, 5.18.3, 5.4.198

How to fix

Upgrade to a fixed version: Linux kernel 5.10.121, 5.15.46, 5.17.14, 5.18.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-49363 or the next vulnerability affects your stack