CVE-2022-49409 (GCVE-0-2022-49409)

Vulnerability from cvelistv5 – Published: 2025-02-26 02:12 – Updated: 2026-05-23 15:22
VLAI
Title
ext4: fix bug_on in __es_tree_search
Summary
In the Linux kernel, the following vulnerability has been resolved: ext4: fix bug_on in __es_tree_search Hulk Robot reported a BUG_ON: ================================================================== kernel BUG at fs/ext4/extents_status.c:199! [...] RIP: 0010:ext4_es_end fs/ext4/extents_status.c:199 [inline] RIP: 0010:__es_tree_search+0x1e0/0x260 fs/ext4/extents_status.c:217 [...] Call Trace: ext4_es_cache_extent+0x109/0x340 fs/ext4/extents_status.c:766 ext4_cache_extents+0x239/0x2e0 fs/ext4/extents.c:561 ext4_find_extent+0x6b7/0xa20 fs/ext4/extents.c:964 ext4_ext_map_blocks+0x16b/0x4b70 fs/ext4/extents.c:4384 ext4_map_blocks+0xe26/0x19f0 fs/ext4/inode.c:567 ext4_getblk+0x320/0x4c0 fs/ext4/inode.c:980 ext4_bread+0x2d/0x170 fs/ext4/inode.c:1031 ext4_quota_read+0x248/0x320 fs/ext4/super.c:6257 v2_read_header+0x78/0x110 fs/quota/quota_v2.c:63 v2_check_quota_file+0x76/0x230 fs/quota/quota_v2.c:82 vfs_load_quota_inode+0x5d1/0x1530 fs/quota/dquot.c:2368 dquot_enable+0x28a/0x330 fs/quota/dquot.c:2490 ext4_quota_enable fs/ext4/super.c:6137 [inline] ext4_enable_quotas+0x5d7/0x960 fs/ext4/super.c:6163 ext4_fill_super+0xa7c9/0xdc00 fs/ext4/super.c:4754 mount_bdev+0x2e9/0x3b0 fs/super.c:1158 mount_fs+0x4b/0x1e4 fs/super.c:1261 [...] ================================================================== Above issue may happen as follows: ------------------------------------- ext4_fill_super ext4_enable_quotas ext4_quota_enable ext4_iget __ext4_iget ext4_ext_check_inode ext4_ext_check __ext4_ext_check ext4_valid_extent_entries Check for overlapping extents does't take effect dquot_enable vfs_load_quota_inode v2_check_quota_file v2_read_header ext4_quota_read ext4_bread ext4_getblk ext4_map_blocks ext4_ext_map_blocks ext4_find_extent ext4_cache_extents ext4_es_cache_extent ext4_es_cache_extent __es_tree_search ext4_es_end BUG_ON(es->es_lblk + es->es_len < es->es_lblk) The error ext4 extents is as follows: 0af3 0300 0400 0000 00000000 extent_header 00000000 0100 0000 12000000 extent1 00000000 0100 0000 18000000 extent2 02000000 0400 0000 14000000 extent3 In the ext4_valid_extent_entries function, if prev is 0, no error is returned even if lblock<=prev. This was intended to skip the check on the first extent, but in the error image above, prev=0+1-1=0 when checking the second extent, so even though lblock<=prev, the function does not return an error. As a result, bug_ON occurs in __es_tree_search and the system panics. To solve this problem, we only need to check that: 1. The lblock of the first extent is not less than 0. 2. The lblock of the next extent is not less than the next block of the previous extent. The same applies to extent_idx.
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 5946d089379a35dda0e531710b48fca05446a196 , < d0083459e2b6b07ebd78bea2fe684a19cc0f3d0f (git)
Affected: 5946d089379a35dda0e531710b48fca05446a196 , < 4fd58b5cf118d2d9038a0b8c9cc0e43096297686 (git)
Affected: 5946d089379a35dda0e531710b48fca05446a196 , < 3c617827cd51018bc377bd2954e176920ddbcfad (git)
Affected: 5946d089379a35dda0e531710b48fca05446a196 , < 59cf2fabbfe76de29d88dd7ae69858a25735b59f (git)
Affected: 5946d089379a35dda0e531710b48fca05446a196 , < ea6ea18b3ab0c0d7fefffb3c4d27df758b1c790a (git)
Affected: 5946d089379a35dda0e531710b48fca05446a196 , < d36f6ed761b53933b0b4126486c10d3da7751e7f (git)
Affected: 4645e4ee32aee01a85bdc03348982a65c65ce216 (git)
Affected: a1192c0e5d037def6763f3873d3340615c241fe7 (git)
Affected: ae21dda05193c441bde106a4bbf88c185a68fbed (git)
Affected: ea214c946ee77588c4313be3e9951edd25d6b270 (git)
Affected: 3.2.55 , < 3.3 (semver)
Affected: 3.4.76 , < 3.5 (semver)
Affected: 3.10.26 , < 3.11 (semver)
Affected: 3.12.7 , < 3.13 (semver)
Create a notification for this product.
Linux Linux Affected: 3.13
Unaffected: 0 , < 3.13 (semver)
Unaffected: 5.4.277 , ≤ 5.4.* (semver)
Unaffected: 5.10.121 , ≤ 5.10.* (semver)
Unaffected: 5.15.46 , ≤ 5.15.* (semver)
Unaffected: 5.17.14 , ≤ 5.17.* (semver)
Unaffected: 5.18.3 , ≤ 5.18.* (semver)
Unaffected: 5.19 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/ext4/extents.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d0083459e2b6b07ebd78bea2fe684a19cc0f3d0f",
              "status": "affected",
              "version": "5946d089379a35dda0e531710b48fca05446a196",
              "versionType": "git"
            },
            {
              "lessThan": "4fd58b5cf118d2d9038a0b8c9cc0e43096297686",
              "status": "affected",
              "version": "5946d089379a35dda0e531710b48fca05446a196",
              "versionType": "git"
            },
            {
              "lessThan": "3c617827cd51018bc377bd2954e176920ddbcfad",
              "status": "affected",
              "version": "5946d089379a35dda0e531710b48fca05446a196",
              "versionType": "git"
            },
            {
              "lessThan": "59cf2fabbfe76de29d88dd7ae69858a25735b59f",
              "status": "affected",
              "version": "5946d089379a35dda0e531710b48fca05446a196",
              "versionType": "git"
            },
            {
              "lessThan": "ea6ea18b3ab0c0d7fefffb3c4d27df758b1c790a",
              "status": "affected",
              "version": "5946d089379a35dda0e531710b48fca05446a196",
              "versionType": "git"
            },
            {
              "lessThan": "d36f6ed761b53933b0b4126486c10d3da7751e7f",
              "status": "affected",
              "version": "5946d089379a35dda0e531710b48fca05446a196",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "4645e4ee32aee01a85bdc03348982a65c65ce216",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "a1192c0e5d037def6763f3873d3340615c241fe7",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ae21dda05193c441bde106a4bbf88c185a68fbed",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ea214c946ee77588c4313be3e9951edd25d6b270",
              "versionType": "git"
            },
            {
              "lessThan": "3.3",
              "status": "affected",
              "version": "3.2.55",
              "versionType": "semver"
            },
            {
              "lessThan": "3.5",
              "status": "affected",
              "version": "3.4.76",
              "versionType": "semver"
            },
            {
              "lessThan": "3.11",
              "status": "affected",
              "version": "3.10.26",
              "versionType": "semver"
            },
            {
              "lessThan": "3.13",
              "status": "affected",
              "version": "3.12.7",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/ext4/extents.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.13"
            },
            {
              "lessThan": "3.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.277",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.121",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.46",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.17.*",
              "status": "unaffected",
              "version": "5.17.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.18.*",
              "status": "unaffected",
              "version": "5.18.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.277",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.121",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.46",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.17.14",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.18.3",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.19",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.2.55",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.4.76",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.10.26",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.12.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix bug_on in __es_tree_search\n\nHulk Robot reported a BUG_ON:\n==================================================================\nkernel BUG at fs/ext4/extents_status.c:199!\n[...]\nRIP: 0010:ext4_es_end fs/ext4/extents_status.c:199 [inline]\nRIP: 0010:__es_tree_search+0x1e0/0x260 fs/ext4/extents_status.c:217\n[...]\nCall Trace:\n ext4_es_cache_extent+0x109/0x340 fs/ext4/extents_status.c:766\n ext4_cache_extents+0x239/0x2e0 fs/ext4/extents.c:561\n ext4_find_extent+0x6b7/0xa20 fs/ext4/extents.c:964\n ext4_ext_map_blocks+0x16b/0x4b70 fs/ext4/extents.c:4384\n ext4_map_blocks+0xe26/0x19f0 fs/ext4/inode.c:567\n ext4_getblk+0x320/0x4c0 fs/ext4/inode.c:980\n ext4_bread+0x2d/0x170 fs/ext4/inode.c:1031\n ext4_quota_read+0x248/0x320 fs/ext4/super.c:6257\n v2_read_header+0x78/0x110 fs/quota/quota_v2.c:63\n v2_check_quota_file+0x76/0x230 fs/quota/quota_v2.c:82\n vfs_load_quota_inode+0x5d1/0x1530 fs/quota/dquot.c:2368\n dquot_enable+0x28a/0x330 fs/quota/dquot.c:2490\n ext4_quota_enable fs/ext4/super.c:6137 [inline]\n ext4_enable_quotas+0x5d7/0x960 fs/ext4/super.c:6163\n ext4_fill_super+0xa7c9/0xdc00 fs/ext4/super.c:4754\n mount_bdev+0x2e9/0x3b0 fs/super.c:1158\n mount_fs+0x4b/0x1e4 fs/super.c:1261\n[...]\n==================================================================\n\nAbove issue may happen as follows:\n-------------------------------------\next4_fill_super\n ext4_enable_quotas\n  ext4_quota_enable\n   ext4_iget\n    __ext4_iget\n     ext4_ext_check_inode\n      ext4_ext_check\n       __ext4_ext_check\n        ext4_valid_extent_entries\n         Check for overlapping extents does\u0027t take effect\n   dquot_enable\n    vfs_load_quota_inode\n     v2_check_quota_file\n      v2_read_header\n       ext4_quota_read\n        ext4_bread\n         ext4_getblk\n          ext4_map_blocks\n           ext4_ext_map_blocks\n            ext4_find_extent\n             ext4_cache_extents\n              ext4_es_cache_extent\n               ext4_es_cache_extent\n                __es_tree_search\n                 ext4_es_end\n                  BUG_ON(es-\u003ees_lblk + es-\u003ees_len \u003c es-\u003ees_lblk)\n\nThe error ext4 extents is as follows:\n0af3 0300 0400 0000 00000000    extent_header\n00000000 0100 0000 12000000     extent1\n00000000 0100 0000 18000000     extent2\n02000000 0400 0000 14000000     extent3\n\nIn the ext4_valid_extent_entries function,\nif prev is 0, no error is returned even if lblock\u003c=prev.\nThis was intended to skip the check on the first extent, but\nin the error image above, prev=0+1-1=0 when checking the second extent,\nso even though lblock\u003c=prev, the function does not return an error.\nAs a result, bug_ON occurs in __es_tree_search and the system panics.\n\nTo solve this problem, we only need to check that:\n1. The lblock of the first extent is not less than 0.\n2. The lblock of the next extent  is not less than\n   the next block of the previous extent.\nThe same applies to extent_idx."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-23T15:22:09.801Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d0083459e2b6b07ebd78bea2fe684a19cc0f3d0f"
        },
        {
          "url": "https://git.kernel.org/stable/c/4fd58b5cf118d2d9038a0b8c9cc0e43096297686"
        },
        {
          "url": "https://git.kernel.org/stable/c/3c617827cd51018bc377bd2954e176920ddbcfad"
        },
        {
          "url": "https://git.kernel.org/stable/c/59cf2fabbfe76de29d88dd7ae69858a25735b59f"
        },
        {
          "url": "https://git.kernel.org/stable/c/ea6ea18b3ab0c0d7fefffb3c4d27df758b1c790a"
        },
        {
          "url": "https://git.kernel.org/stable/c/d36f6ed761b53933b0b4126486c10d3da7751e7f"
        }
      ],
      "title": "ext4: fix bug_on in __es_tree_search",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-49409",
    "datePublished": "2025-02-26T02:12:32.591Z",
    "dateReserved": "2025-02-26T02:08:31.567Z",
    "dateUpdated": "2026-05-23T15:22:09.801Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-49409",
      "date": "2026-05-31",
      "epss": "7e-05",
      "percentile": "0.00529"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-49409\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-02-26T07:01:17.420\",\"lastModified\":\"2025-09-22T19:59:08.100\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\next4: fix bug_on in __es_tree_search\\n\\nHulk Robot reported a BUG_ON:\\n==================================================================\\nkernel BUG at fs/ext4/extents_status.c:199!\\n[...]\\nRIP: 0010:ext4_es_end fs/ext4/extents_status.c:199 [inline]\\nRIP: 0010:__es_tree_search+0x1e0/0x260 fs/ext4/extents_status.c:217\\n[...]\\nCall Trace:\\n ext4_es_cache_extent+0x109/0x340 fs/ext4/extents_status.c:766\\n ext4_cache_extents+0x239/0x2e0 fs/ext4/extents.c:561\\n ext4_find_extent+0x6b7/0xa20 fs/ext4/extents.c:964\\n ext4_ext_map_blocks+0x16b/0x4b70 fs/ext4/extents.c:4384\\n ext4_map_blocks+0xe26/0x19f0 fs/ext4/inode.c:567\\n ext4_getblk+0x320/0x4c0 fs/ext4/inode.c:980\\n ext4_bread+0x2d/0x170 fs/ext4/inode.c:1031\\n ext4_quota_read+0x248/0x320 fs/ext4/super.c:6257\\n v2_read_header+0x78/0x110 fs/quota/quota_v2.c:63\\n v2_check_quota_file+0x76/0x230 fs/quota/quota_v2.c:82\\n vfs_load_quota_inode+0x5d1/0x1530 fs/quota/dquot.c:2368\\n dquot_enable+0x28a/0x330 fs/quota/dquot.c:2490\\n ext4_quota_enable fs/ext4/super.c:6137 [inline]\\n ext4_enable_quotas+0x5d7/0x960 fs/ext4/super.c:6163\\n ext4_fill_super+0xa7c9/0xdc00 fs/ext4/super.c:4754\\n mount_bdev+0x2e9/0x3b0 fs/super.c:1158\\n mount_fs+0x4b/0x1e4 fs/super.c:1261\\n[...]\\n==================================================================\\n\\nAbove issue may happen as follows:\\n-------------------------------------\\next4_fill_super\\n ext4_enable_quotas\\n  ext4_quota_enable\\n   ext4_iget\\n    __ext4_iget\\n     ext4_ext_check_inode\\n      ext4_ext_check\\n       __ext4_ext_check\\n        ext4_valid_extent_entries\\n         Check for overlapping extents does\u0027t take effect\\n   dquot_enable\\n    vfs_load_quota_inode\\n     v2_check_quota_file\\n      v2_read_header\\n       ext4_quota_read\\n        ext4_bread\\n         ext4_getblk\\n          ext4_map_blocks\\n           ext4_ext_map_blocks\\n            ext4_find_extent\\n             ext4_cache_extents\\n              ext4_es_cache_extent\\n               ext4_es_cache_extent\\n                __es_tree_search\\n                 ext4_es_end\\n                  BUG_ON(es-\u003ees_lblk + es-\u003ees_len \u003c es-\u003ees_lblk)\\n\\nThe error ext4 extents is as follows:\\n0af3 0300 0400 0000 00000000    extent_header\\n00000000 0100 0000 12000000     extent1\\n00000000 0100 0000 18000000     extent2\\n02000000 0400 0000 14000000     extent3\\n\\nIn the ext4_valid_extent_entries function,\\nif prev is 0, no error is returned even if lblock\u003c=prev.\\nThis was intended to skip the check on the first extent, but\\nin the error image above, prev=0+1-1=0 when checking the second extent,\\nso even though lblock\u003c=prev, the function does not return an error.\\nAs a result, bug_ON occurs in __es_tree_search and the system panics.\\n\\nTo solve this problem, we only need to check that:\\n1. The lblock of the first extent is not less than 0.\\n2. The lblock of the next extent  is not less than\\n   the next block of the previous extent.\\nThe same applies to extent_idx.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ext4: se corrige bug_on en __es_tree_search Hulk Robot inform\u00f3 un BUG_ON: ================================================================== kernel BUG at fs/ext4/extents_status.c:199! [...] RIP: 0010:ext4_es_end fs/ext4/extents_status.c:199 [inline] RIP: 0010:__es_tree_search+0x1e0/0x260 fs/ext4/extents_status.c:217 [...] Call Trace: ext4_es_cache_extent+0x109/0x340 fs/ext4/extents_status.c:766 ext4_cache_extents+0x239/0x2e0 fs/ext4/extents.c:561 ext4_find_extent+0x6b7/0xa20 fs/ext4/extents.c:964 ext4_ext_map_blocks+0x16b/0x4b70 fs/ext4/extents.c:4384 ext4_map_blocks+0xe26/0x19f0 fs/ext4/inode.c:567 ext4_getblk+0x320/0x4c0 fs/ext4/inode.c:980 ext4_bread+0x2d/0x170 fs/ext4/inode.c:1031 ext4_quota_read+0x248/0x320 fs/ext4/super.c:6257 v2_read_header+0x78/0x110 fs/quota/quota_v2.c:63 v2_check_quota_file+0x76/0x230 fs/quota/quota_v2.c:82 vfs_load_quota_inode+0x5d1/0x1530 fs/quota/dquot.c:2368 dquot_enable+0x28a/0x330 fs/quota/dquot.c:2490 ext4_quota_enable fs/ext4/super.c:6137 [inline] ext4_enable_quotas+0x5d7/0x960 fs/ext4/super.c:6163 ext4_fill_super+0xa7c9/0xdc00 fs/ext4/super.c:4754 mount_bdev+0x2e9/0x3b0 fs/super.c:1158 mount_fs+0x4b/0x1e4 fs/super.c:1261 [...] ================================================================== Above issue may happen as follows: ------------------------------------- ext4_fill_super ext4_enable_quotas ext4_quota_enable ext4_iget __ext4_iget ext4_ext_check_inode ext4_ext_check __ext4_ext_check ext4_valid_extent_entries Check for overlapping extents does\u0027t take effect dquot_enable vfs_load_quota_inode v2_check_quota_file v2_read_header ext4_quota_read ext4_bread ext4_getblk ext4_map_blocks ext4_ext_map_blocks ext4_find_extent ext4_cache_extents ext4_es_cache_extent ext4_es_cache_extent __es_tree_search ext4_es_end BUG_ON(es-\u0026gt;es_lblk + es-\u0026gt;es_len \u0026lt; es-\u0026gt;es_lblk) The error ext4 extents is as follows: 0af3 0300 0400 0000 00000000 extent_header 00000000 0100 0000 12000000 extent1 00000000 0100 0000 18000000 extent2 02000000 0400 0000 14000000 extent3 In the ext4_valid_extent_entries function, if prev is 0, no error is returned even if lblock\u0026lt;=prev.. Esto ten\u00eda como objetivo omitir la comprobaci\u00f3n de la primera extensi\u00f3n, pero en la imagen de error anterior, prev=0+1-1=0 al comprobar la segunda extensi\u00f3n, por lo que, aunque lblock\u0026lt;=prev, la funci\u00f3n no devuelve un error. Como resultado, se produce bug_ON en __es_tree_search y el sistema entra en p\u00e1nico. Para resolver este problema, solo necesitamos comprobar que: 1. El lblock de la primera extensi\u00f3n no sea menor que 0. 2. El lblock de la siguiente extensi\u00f3n no sea menor que el siguiente bloque de la extensi\u00f3n anterior. Lo mismo se aplica a extended_idx.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-617\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.2.55\",\"versionEndExcluding\":\"3.3\",\"matchCriteriaId\":\"5C95C155-41E7-4E81-A8DD-EC19537F5226\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.4.76\",\"versionEndExcluding\":\"3.5\",\"matchCriteriaId\":\"6E3A65EB-29D6-4348-BDE5-F27663790621\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.10.26\",\"versionEndExcluding\":\"3.11\",\"matchCriteriaId\":\"4D15D25D-A46B-4878-A447-FFC5AA90F366\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.12.7\",\"versionEndExcluding\":\"3.13\",\"matchCriteriaId\":\"E26E2889-451E-4DFD-9964-724337ED1C10\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.13.1\",\"versionEndExcluding\":\"5.4.277\",\"matchCriteriaId\":\"877E1976-3D35-426F-8A07-63FC94AE1513\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.121\",\"matchCriteriaId\":\"34ACD872-E5BC-401C-93D5-B357A62426E0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.46\",\"matchCriteriaId\":\"20D41697-0E8B-4B7D-8842-F17BF2AA21E1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"5.17.14\",\"matchCriteriaId\":\"15E2DD33-2255-4B76-9C15-04FF8CBAB252\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.18\",\"versionEndExcluding\":\"5.18.3\",\"matchCriteriaId\":\"8E122216-2E9E-4B3E-B7B8-D575A45BA3C2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:3.13:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"0F72A71E-B6B2-40F2-A21D-BF7CE1514976\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:3.13:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"5782C96D-D8F7-42C1-A3A0-34B1DEF1FC93\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:3.13:rc7:*:*:*:*:*:*\",\"matchCriteriaId\":\"51B2DAD1-BF87-4AEF-A41D-81B7D042B22A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:3.13:rc8:*:*:*:*:*:*\",\"matchCriteriaId\":\"C8E94C86-A5D8-4C34-8494-5B471DAEB27A\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/3c617827cd51018bc377bd2954e176920ddbcfad\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4fd58b5cf118d2d9038a0b8c9cc0e43096297686\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/59cf2fabbfe76de29d88dd7ae69858a25735b59f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d0083459e2b6b07ebd78bea2fe684a19cc0f3d0f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d36f6ed761b53933b0b4126486c10d3da7751e7f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ea6ea18b3ab0c0d7fefffb3c4d27df758b1c790a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.