fkie_cve-2022-50869
Vulnerability from fkie_nvd
Published
2025-12-30 13:16
Modified
2025-12-31 20:43
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Fix slab-out-of-bounds in r_page When PAGE_SIZE is 64K, if read_log_page is called by log_read_rst for the first time, the size of *buffer would be equal to DefaultLogPageSize(4K).But for *buffer operations like memcpy, if the memory area size(n) which being assigned to buffer is larger than 4K (log->page_size(64K) or bytes(64K-page_off)), it will cause an out of boundary error. Call trace: [...] kasan_report+0x44/0x130 check_memory_region+0xf8/0x1a0 memcpy+0xc8/0x100 ntfs_read_run_nb+0x20c/0x460 read_log_page+0xd0/0x1f4 log_read_rst+0x110/0x75c log_replay+0x1e8/0x4aa0 ntfs_loadlog_and_replay+0x290/0x2d0 ntfs_fill_super+0x508/0xec0 get_tree_bdev+0x1fc/0x34c [...] Fix this by setting variable r_page to NULL in log_read_rst.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/6d076293e5bffdf897ea5f975669206e09beed6a
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/bf86a640a34947d92062996e1a75b9cd9d83dd19
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/ecfbd57cf9c5ca225184ae266ce44ae473792132
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/ed686e7a26dd19ae6b46bb662f735acfa88ff7bc
Impacted products
Vendor Product Version


To clipboard 

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/ntfs3: Fix slab-out-of-bounds in r_page\n\nWhen PAGE_SIZE is 64K, if read_log_page is called by log_read_rst for\nthe first time, the size of *buffer would be equal to\nDefaultLogPageSize(4K).But for *buffer operations like memcpy,\nif the memory area size(n) which being assigned to buffer is larger\nthan 4K (log-\u003epage_size(64K) or bytes(64K-page_off)), it will cause\nan out of boundary error.\n Call trace:\n  [...]\n  kasan_report+0x44/0x130\n  check_memory_region+0xf8/0x1a0\n  memcpy+0xc8/0x100\n  ntfs_read_run_nb+0x20c/0x460\n  read_log_page+0xd0/0x1f4\n  log_read_rst+0x110/0x75c\n  log_replay+0x1e8/0x4aa0\n  ntfs_loadlog_and_replay+0x290/0x2d0\n  ntfs_fill_super+0x508/0xec0\n  get_tree_bdev+0x1fc/0x34c\n  [...]\n\nFix this by setting variable r_page to NULL in log_read_rst."
    }
  ],
  "id": "CVE-2022-50869",
  "lastModified": "2025-12-31T20:43:05.160",
  "metrics": {},
  "published": "2025-12-30T13:16:01.760",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/6d076293e5bffdf897ea5f975669206e09beed6a"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/bf86a640a34947d92062996e1a75b9cd9d83dd19"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/ecfbd57cf9c5ca225184ae266ce44ae473792132"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/ed686e7a26dd19ae6b46bb662f735acfa88ff7bc"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Awaiting Analysis"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.