CVE-2022-49348

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ext4: filter out EXT4_FC_REPLAY from on-disk superblock field s_state

The EXT4_FC_REPLAY bit in sbi->s_mount_state is used to indicate that

we are in the middle of replay the fast commit journal. This was

actually a mistake, since the sbi->s_mount_info is initialized from

es->s_state. Arguably s_mount_state is misleadingly named, but the

name is historical --- s_mount_state and s_state dates back to ext2.

What should have been used is the ext4_{set,clear,test}_mount_flag()

inline functions, which sets EXT4_MF_* bits in sbi->s_mount_flags.

The problem with using EXT4_FC_REPLAY is that a maliciously corrupted

superblock could result in EXT4_FC_REPLAY getting set in

s_mount_state. This bypasses some sanity checks, and this can trigger

a BUG() in ext4_es_cache_extent(). As a easy-to-backport-fix, filter

out the EXT4_FC_REPLAY bit for now. We should eventually transition

away from EXT4_FC_REPLAY to something like E

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References