Vulnerability-Lookup

BDU:2026-02602 (CVE-2022-49318)

Vulnerability from fstec – Published: 2026-03-06 – Updated: 2026-03-06 – View on bdu.fstec.ru Fixed

Title

Уязвимость функции __is_bitmap_valid() модуля fs/f2fs/checkpoint.c поддержки файловой системы F2FS ядра операционной системы Linux, позволяющая нарушителю вызвать отказ в обслуживании

Summary

Уязвимость функции __is_bitmap_valid() модуля fs/f2fs/checkpoint.c поддержки файловой системы F2FS ядра операционной системы Linux связана с переполнением буфера на основе стека. Эксплуатация уязвимости может позволить нарушителю вызвать отказ в обслуживании

Severity

4.6 (Medium) CVSS 2.0


                      
                        AV:L/AC:L/Au:S/C:N/I:N/A:C

5.5 (Medium) CVSS 3.1


                      
                        CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Class

Code vulnerability

Status

Confirmed by the vendor

Exploitation

Data structure manipulation

Incidents

Being clarified

Remediation

Software update

CWE

CWE-121 - Переполнение буфера в стеке

Aliases

CVE-2022-49318

References

15 references

URL
https://git.kernel.org/stable/c/8c62c5e26345c34d199b4b8c8e69255ba3d0e751
https://git.kernel.org/stable/c/99c09b298e47ebbe345a6da9f268b32a6b0f4582
https://git.kernel.org/stable/c/cd6374af36cc548464d8c47a93fdba7303bb82a4
https://git.kernel.org/stable/c/0a7a1fc7e71eecf2e5053a6c312c9f0dcbb9b8fd
https://git.kernel.org/stable/c/32bea51fe4c6e92c00403739f7547c89219bea88
https://www.cve.org/CVERecord?id=CVE-2022-49318
https://lore.kernel.org/linux-cve-announce/2025022637-CVE-2022-49318-732e@gregkh/
https://git.kernel.org/linus/dc2f78e2d4cc844a1458653d57ce1b54d4a29f21
https://kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.4.198
https://kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.122
https://kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.47
https://kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.17.15
https://kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.18.4
https://security-tracker.debian.org/tracker/CVE-2022-49318
https://ubuntu.com/security/CVE-2022-49318

Impacted products

3 products from 2 vendors

Vendors

Canonical Ltd., Сообщество свободного программного обеспечения

Products

Ubuntu, Debian GNU/Linux, Linux

Versions

18.04 LTS (Ubuntu), 20.04 LTS (Ubuntu), 11 (Debian GNU/Linux), 22.04 LTS (Ubuntu), от 5.18 до 5.18.3 включительно (Linux), от 5.5 до 5.10.121 включительно (Linux), от 5.11 до 5.15.46 включительно (Linux), от 5.16 до 5.17.14 включительно (Linux), от 3.8 до 5.4.197 включительно (Linux)

Product types

Operating system

Platforms

Canonical Ltd. Ubuntu 18.04 LTS, Canonical Ltd. Ubuntu 20.04 LTS, Сообщество свободного программного обеспечения Debian GNU/Linux 11, Canonical Ltd. Ubuntu 22.04 LTS, Сообщество свободного программного обеспечения Linux от 5.18 до 5.18.3 включительно, Сообщество свободного программного обеспечения Linux от 5.5 до 5.10.121 включительно, Сообщество свободного программного обеспечения Linux от 5.11 до 5.15.46 включительно, Сообщество свободного программного обеспечения Linux от 5.16 до 5.17.14 включительно, Сообщество свободного программного обеспечения Linux от 3.8 до 5.4.197 включительно

Mitigations

В условиях отсутствия обновлений безопасности от производителя рекомендуется придерживаться "Рекомендаций по безопасной настройке операционных систем LINUX", изложенных в методическом документе ФСТЭК России, утверждённом 25 декабря 2022 года. Использование рекомендаций: Для Linux: https://git.kernel.org/stable/c/8c62c5e26345c34d199b4b8c8e69255ba3d0e751 https://git.kernel.org/stable/c/99c09b298e47ebbe345a6da9f268b32a6b0f4582 https://git.kernel.org/stable/c/cd6374af36cc548464d8c47a93fdba7303bb82a4 https://git.kernel.org/stable/c/0a7a1fc7e71eecf2e5053a6c312c9f0dcbb9b8fd https://git.kernel.org/stable/c/32bea51fe4c6e92c00403739f7547c89219bea88 https://www.cve.org/CVERecord?id=CVE-2022-49318 https://lore.kernel.org/linux-cve-announce/2025022637-CVE-2022-49318-732e@gregkh/ https://git.kernel.org/linus/dc2f78e2d4cc844a1458653d57ce1b54d4a29f21 https://kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.4.198 https://kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.122 https://kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.47 https://kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.17.15 https://kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.18.4 Для Debian GNU/Linux: https://security-tracker.debian.org/tracker/CVE-2022-49318 Для Ubuntu: https://ubuntu.com/security/CVE-2022-49318

JSON

To clipboard

{
  "CVSS 2.0": "AV:L/AC:L/Au:S/C:N/I:N/A:C",
  "CVSS 3.0": "AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
  "CVSS 4.0": null,
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "Canonical Ltd., \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "18.04 LTS (Ubuntu), 20.04 LTS (Ubuntu), 11 (Debian GNU/Linux), 22.04 LTS (Ubuntu), \u043e\u0442 5.18 \u0434\u043e 5.18.3 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (Linux), \u043e\u0442 5.5 \u0434\u043e 5.10.121 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (Linux), \u043e\u0442 5.11 \u0434\u043e 5.15.46 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (Linux), \u043e\u0442 5.16 \u0434\u043e 5.17.14 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (Linux), \u043e\u0442 3.8 \u0434\u043e 5.4.197 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (Linux)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0412 \u0443\u0441\u043b\u043e\u0432\u0438\u044f\u0445 \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u044f \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043e\u0442 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u043f\u0440\u0438\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0442\u044c\u0441\u044f \"\u0420\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439 \u043f\u043e \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0439 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0435 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c LINUX\", \u0438\u0437\u043b\u043e\u0436\u0435\u043d\u043d\u044b\u0445 \u0432 \u043c\u0435\u0442\u043e\u0434\u0438\u0447\u0435\u0441\u043a\u043e\u043c \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0435 \u0424\u0421\u0422\u042d\u041a \u0420\u043e\u0441\u0441\u0438\u0438, \u0443\u0442\u0432\u0435\u0440\u0436\u0434\u0451\u043d\u043d\u043e\u043c 25 \u0434\u0435\u043a\u0430\u0431\u0440\u044f 2022 \u0433\u043e\u0434\u0430.\n\n\n\n\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439:\n\n\n\u0414\u043b\u044f Linux:\nhttps://git.kernel.org/stable/c/8c62c5e26345c34d199b4b8c8e69255ba3d0e751\nhttps://git.kernel.org/stable/c/99c09b298e47ebbe345a6da9f268b32a6b0f4582\nhttps://git.kernel.org/stable/c/cd6374af36cc548464d8c47a93fdba7303bb82a4\nhttps://git.kernel.org/stable/c/0a7a1fc7e71eecf2e5053a6c312c9f0dcbb9b8fd\nhttps://git.kernel.org/stable/c/32bea51fe4c6e92c00403739f7547c89219bea88\nhttps://www.cve.org/CVERecord?id=CVE-2022-49318\nhttps://lore.kernel.org/linux-cve-announce/2025022637-CVE-2022-49318-732e@gregkh/\nhttps://git.kernel.org/linus/dc2f78e2d4cc844a1458653d57ce1b54d4a29f21\nhttps://kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.4.198\nhttps://kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.122\nhttps://kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.47\nhttps://kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.17.15\nhttps://kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.18.4\n\n\u0414\u043b\u044f Debian GNU/Linux:\nhttps://security-tracker.debian.org/tracker/CVE-2022-49318\n\n\u0414\u043b\u044f Ubuntu:\nhttps://ubuntu.com/security/CVE-2022-49318",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "06.05.2022",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "06.03.2026",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "06.03.2026",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2026-02602",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2022-49318",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0434\u0430",
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "Ubuntu, Debian GNU/Linux, Linux",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": "Canonical Ltd. Ubuntu 18.04 LTS , Canonical Ltd. Ubuntu 20.04 LTS , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Debian GNU/Linux 11 , Canonical Ltd. Ubuntu 22.04 LTS , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Linux \u043e\u0442 5.18 \u0434\u043e 5.18.3 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Linux \u043e\u0442 5.5 \u0434\u043e 5.10.121 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Linux \u043e\u0442 5.11 \u0434\u043e 5.15.46 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Linux \u043e\u0442 5.16 \u0434\u043e 5.17.14 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Linux \u043e\u0442 3.8 \u0434\u043e 5.4.197 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e ",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0444\u0443\u043d\u043a\u0446\u0438\u0438 __is_bitmap_valid() \u043c\u043e\u0434\u0443\u043b\u044f fs/f2fs/checkpoint.c \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 \u0444\u0430\u0439\u043b\u043e\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b F2FS \u044f\u0434\u0440\u0430 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b Linux, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u043e\u0442\u043a\u0430\u0437 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u041f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0431\u0443\u0444\u0435\u0440\u0430 \u0432 \u0441\u0442\u0435\u043a\u0435 (CWE-121)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0444\u0443\u043d\u043a\u0446\u0438\u0438 __is_bitmap_valid() \u043c\u043e\u0434\u0443\u043b\u044f fs/f2fs/checkpoint.c \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 \u0444\u0430\u0439\u043b\u043e\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b F2FS \u044f\u0434\u0440\u0430 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b Linux \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435\u043c \u0431\u0443\u0444\u0435\u0440\u0430 \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 \u0441\u0442\u0435\u043a\u0430. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u043e\u0442\u043a\u0430\u0437 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u041c\u0430\u043d\u0438\u043f\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0430\u043c\u0438 \u0434\u0430\u043d\u043d\u044b\u0445",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://git.kernel.org/stable/c/8c62c5e26345c34d199b4b8c8e69255ba3d0e751\nhttps://git.kernel.org/stable/c/99c09b298e47ebbe345a6da9f268b32a6b0f4582\nhttps://git.kernel.org/stable/c/cd6374af36cc548464d8c47a93fdba7303bb82a4\nhttps://git.kernel.org/stable/c/0a7a1fc7e71eecf2e5053a6c312c9f0dcbb9b8fd\nhttps://git.kernel.org/stable/c/32bea51fe4c6e92c00403739f7547c89219bea88\nhttps://www.cve.org/CVERecord?id=CVE-2022-49318\nhttps://lore.kernel.org/linux-cve-announce/2025022637-CVE-2022-49318-732e@gregkh/\nhttps://git.kernel.org/linus/dc2f78e2d4cc844a1458653d57ce1b54d4a29f21\nhttps://kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.4.198\nhttps://kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.122\nhttps://kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.47\nhttps://kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.17.15\nhttps://kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.18.4\nhttps://security-tracker.debian.org/tracker/CVE-2022-49318\nhttps://ubuntu.com/security/CVE-2022-49318",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u041e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u0430\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u0430",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-121",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0421\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 4,6)\n\u0421\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.1 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 5,5)"
}

CVE-2022-49318 (GCVE-0-2022-49318)

Vulnerability from cvelistv5 – Published: 2025-02-26 02:10 – Updated: 2026-08-15 12:22

Title

f2fs: remove WARN_ON in f2fs_is_valid_blkaddr

Summary

In the Linux kernel, the following vulnerability has been resolved: f2fs: remove WARN_ON in f2fs_is_valid_blkaddr Syzbot triggers two WARNs in f2fs_is_valid_blkaddr and __is_bitmap_valid. For example, in f2fs_is_valid_blkaddr, if type is DATA_GENERIC_ENHANCE or DATA_GENERIC_ENHANCE_READ, it invokes WARN_ON if blkaddr is not in the right range. The call trace is as follows: f2fs_get_node_info+0x45f/0x1070 read_node_page+0x577/0x1190 __get_node_page.part.0+0x9e/0x10e0 __get_node_page f2fs_get_node_page+0x109/0x180 do_read_inode f2fs_iget+0x2a5/0x58b0 f2fs_fill_super+0x3b39/0x7ca0 Fix these two WARNs by replacing WARN_ON with dump_stack.

Severity

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-10-01 19:43 UTC

CWE

CWE-noinfo Not enough information

Assigner

Linux mitre root Scorecard

References

6 references

URL	Tags
https://git.kernel.org/stable/c/0a7a1fc7e71eecf2e…
https://git.kernel.org/stable/c/32bea51fe4c6e92c0…
https://git.kernel.org/stable/c/99c09b298e47ebbe3…
https://git.kernel.org/stable/c/cd6374af36cc54846…
https://git.kernel.org/stable/c/8c62c5e26345c34d1…
https://git.kernel.org/stable/c/dc2f78e2d4cc844a1…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: c9b60788fc760d136211853f10ce73dc152d1f4a , < 0a7a1fc7e71eecf2e5053a6c312c9f0dcbb9b8fd (git) Affected: c9b60788fc760d136211853f10ce73dc152d1f4a , < 32bea51fe4c6e92c00403739f7547c89219bea88 (git) Affected: c9b60788fc760d136211853f10ce73dc152d1f4a , < 99c09b298e47ebbe345a6da9f268b32a6b0f4582 (git) Affected: c9b60788fc760d136211853f10ce73dc152d1f4a , < cd6374af36cc548464d8c47a93fdba7303bb82a4 (git) Affected: c9b60788fc760d136211853f10ce73dc152d1f4a , < 8c62c5e26345c34d199b4b8c8e69255ba3d0e751 (git) Affected: c9b60788fc760d136211853f10ce73dc152d1f4a , < dc2f78e2d4cc844a1458653d57ce1b54d4a29f21 (git) Affected: bdffda8db8d9e0125b9a41edc420c39f9905c6ab (git) Affected: aafb371575161e315a98dee978b72f9d5357791b (git) Affected: ad19d1e78fd51f5b4bf3ebbcbf3a133c8c03c49d (git) Affected: 4.4.172 , < 4.5 (semver) Affected: 4.9.144 , < 4.10 (semver) Affected: 4.14.86 , < 4.15 (semver)
Linux	Linux	Affected: 4.19 Unaffected: 0 , < 4.19 (semver) Unaffected: 5.4.198 , ≤ 5.4.* (semver) Unaffected: 5.10.122 , ≤ 5.10.* (semver) Unaffected: 5.15.47 , ≤ 5.15.* (semver) Unaffected: 5.17.15 , ≤ 5.17.* (semver) Unaffected: 5.18.4 , ≤ 5.18.* (semver) Unaffected: 5.19 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-49318",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T19:43:51.397686Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-01T19:46:56.972Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/f2fs/checkpoint.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0a7a1fc7e71eecf2e5053a6c312c9f0dcbb9b8fd",
              "status": "affected",
              "version": "c9b60788fc760d136211853f10ce73dc152d1f4a",
              "versionType": "git"
            },
            {
              "lessThan": "32bea51fe4c6e92c00403739f7547c89219bea88",
              "status": "affected",
              "version": "c9b60788fc760d136211853f10ce73dc152d1f4a",
              "versionType": "git"
            },
            {
              "lessThan": "99c09b298e47ebbe345a6da9f268b32a6b0f4582",
              "status": "affected",
              "version": "c9b60788fc760d136211853f10ce73dc152d1f4a",
              "versionType": "git"
            },
            {
              "lessThan": "cd6374af36cc548464d8c47a93fdba7303bb82a4",
              "status": "affected",
              "version": "c9b60788fc760d136211853f10ce73dc152d1f4a",
              "versionType": "git"
            },
            {
              "lessThan": "8c62c5e26345c34d199b4b8c8e69255ba3d0e751",
              "status": "affected",
              "version": "c9b60788fc760d136211853f10ce73dc152d1f4a",
              "versionType": "git"
            },
            {
              "lessThan": "dc2f78e2d4cc844a1458653d57ce1b54d4a29f21",
              "status": "affected",
              "version": "c9b60788fc760d136211853f10ce73dc152d1f4a",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "bdffda8db8d9e0125b9a41edc420c39f9905c6ab",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "aafb371575161e315a98dee978b72f9d5357791b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ad19d1e78fd51f5b4bf3ebbcbf3a133c8c03c49d",
              "versionType": "git"
            },
            {
              "lessThan": "4.5",
              "status": "affected",
              "version": "4.4.172",
              "versionType": "semver"
            },
            {
              "lessThan": "4.10",
              "status": "affected",
              "version": "4.9.144",
              "versionType": "semver"
            },
            {
              "lessThan": "4.15",
              "status": "affected",
              "version": "4.14.86",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/f2fs/checkpoint.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.19"
            },
            {
              "lessThan": "4.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.198",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.122",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.47",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.17.*",
              "status": "unaffected",
              "version": "5.17.15",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.18.*",
              "status": "unaffected",
              "version": "5.18.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.198",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.122",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.47",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.17.15",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.18.4",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.19",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.4.172",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.9.144",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.14.86",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: remove WARN_ON in f2fs_is_valid_blkaddr\n\nSyzbot triggers two WARNs in f2fs_is_valid_blkaddr and\n__is_bitmap_valid. For example, in f2fs_is_valid_blkaddr,\nif type is DATA_GENERIC_ENHANCE or DATA_GENERIC_ENHANCE_READ,\nit invokes WARN_ON if blkaddr is not in the right range.\nThe call trace is as follows:\n\n f2fs_get_node_info+0x45f/0x1070\n read_node_page+0x577/0x1190\n __get_node_page.part.0+0x9e/0x10e0\n __get_node_page\n f2fs_get_node_page+0x109/0x180\n do_read_inode\n f2fs_iget+0x2a5/0x58b0\n f2fs_fill_super+0x3b39/0x7ca0\n\nFix these two WARNs by replacing WARN_ON with dump_stack."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-15T12:22:35.531Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0a7a1fc7e71eecf2e5053a6c312c9f0dcbb9b8fd"
        },
        {
          "url": "https://git.kernel.org/stable/c/32bea51fe4c6e92c00403739f7547c89219bea88"
        },
        {
          "url": "https://git.kernel.org/stable/c/99c09b298e47ebbe345a6da9f268b32a6b0f4582"
        },
        {
          "url": "https://git.kernel.org/stable/c/cd6374af36cc548464d8c47a93fdba7303bb82a4"
        },
        {
          "url": "https://git.kernel.org/stable/c/8c62c5e26345c34d199b4b8c8e69255ba3d0e751"
        },
        {
          "url": "https://git.kernel.org/stable/c/dc2f78e2d4cc844a1458653d57ce1b54d4a29f21"
        }
      ],
      "title": "f2fs: remove WARN_ON in f2fs_is_valid_blkaddr",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-49318",
    "datePublished": "2025-02-26T02:10:44.557Z",
    "dateReserved": "2025-02-26T02:08:31.537Z",
    "dateUpdated": "2026-08-15T12:22:35.531Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

BDU:2026-02602 (CVE-2022-49318)

CVE-2022-49318 (GCVE-0-2022-49318)

Tags

Sightings

Nomenclature

Related by attack behaviour