CVE-2022-49174

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ext4: fix ext4_mb_mark_bb() with flex_bg with fast_commit

In case of flex_bg feature (which is by default enabled), extents for

any given inode might span across blocks from two different block group.

ext4_mb_mark_bb() only reads the buffer_head of block bitmap once for the

starting block group, but it fails to read it again when the extent length

boundary overflows to another block group. Then in this below loop it

accesses memory beyond the block group bitmap buffer_head and results

into a data abort.

for (i = 0; i < clen; i++)

if (!mb_test_bit(blkoff + i, bitmap_bh->b_data) == !state)

already++;

This patch adds this functionality for checking block group boundary in

ext4_mb_mark_bb() and update the buffer_head(bitmap_bh) for every different

block group.

w/o this patch, I was easily able to hit a data access abort using Power platform.

<...>

[ 74.327662] EXT4-fs error (device loop3): ext4_mb_generate_bu

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References