CVE-2022-49763

一、漏洞信息
 漏洞编号：[CVE-2022-49763](https://nvd.nist.gov/vuln/detail/CVE-2022-49763)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.19,6.4.0,6.6.0
 CVSS V3.0分值：
  BaseScore：N/A None
  Vector：CVSS：3.0/
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:ntfs: fix use-after-free in ntfs_attr_find()Patch series  ntfs: fix bugs about Attribute , v2.This patchset fixes three bugs relative to Attribute in record:Patch 1 adds a sanity check to ensure that, attrs_offset field in firstmft record loading from disk is within bounds.Patch 2 moves the ATTR_RECORD s bounds checking earlier, to avoiddereferencing ATTR_RECORD before checking this ATTR_RECORD is withinbounds.Patch 3 adds an overflow checking to avoid possible forever loop inntfs_attr_find().Without patch 1 and patch 2, the kernel triggersa KASAN use-after-freedetection as reported by Syzkaller.Although one of patch 1 or patch 2 can fix this, we still need both ofthem.  Because patch 1 fixes the root cause, and patch 2 not only fixesthe direct cause, but also fixes the potential out-of-bounds bug.This patch (of 3):Syzkaller reported use-after-free read as follows:==================================================================BUG: KASAN: use-after-free in ntfs_attr_find+0xc02/0xce0 fs/ntfs/attrib.c:597Read of size 2 at addr ffff88807e352009 by task syz-executor153/3607[...]Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:317 [inline] print_report.cold+0x2ba/0x719 mm/kasan/report.c:433 kasan_report+0xb1/0x1e0 mm/kasan/report.c:495 ntfs_attr_find+0xc02/0xce0 fs/ntfs/attrib.c:597 ntfs_attr_lookup+0x1056/0x2070 fs/ntfs/attrib.c:1193 ntfs_read_inode_mount+0x89a/0x2580 fs/ntfs/inode.c:1845 ntfs_fill_super+0x1799/0x9320 fs/ntfs/super.c:2854 mount_bdev+0x34d/0x410 fs/super.c:1400 legacy_get_tree+0x105/0x220 fs/fs_context.c:610 vfs_get_tree+0x89/0x2f0 fs/super.c:1530 do_new_mount fs/namespace.c:3040 [inline] path_mount+0x1326/0x1e20 fs/namespace.c:3370 do_mount fs/namespace.c:3383 [inline] __do_sys_mount fs/namespace.c:3591 [inline] __se_sys_mount fs/namespace.c:3568 [inline] __x64_sys_mount+0x27f/0x300 fs/namespace.c:3568 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd [...] </TASK>The buggy address belongs to the physical page:page:ffffea0001f8d400 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7e350head:ffffea0001f8d400 order:3 compound_mapcount:0 compound_pincount:0flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff)raw: 00fff00000010200 0000000000000000 dead000000000122 ffff888011842140raw: 0000000000000000 0000000000040004 00000001ffffffff 0000000000000000page dumped because: kasan: bad access detectedMemory state around the buggy address: ffff88807e351f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff88807e351f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc>ffff88807e352000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb                      ^ ffff88807e352080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88807e352100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb==================================================================Kernel will loads $MFT/$DATA s first mft record inntfs_read_inode_mount().Yet the problem is that after loading, kernel doesn t check whetherattrs_offset field is a valid value.To be more specific, if attrs_offset field is larger than bytes_allocatedfield, then it may trigger the out-of-bounds read bug(reported asuse-after-free bug) in ntfs_attr_find(), when kernel tries to access thecorresponding mft record s attribute.This patch solves it by adding the sanity check between attrs_offset fieldand bytes_allocated field, after loading the first mft record.
 漏洞公开时间：2025-05-01 23:15:59
 漏洞创建时间：2025-05-02 01:35:51
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2022-49763
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/266bd5306286316758e6246ea0345133427b0f62 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/4863f815463034f588a035cfd99cdca97a4f1069 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/5330c423b86263ac7883fef0260b9e2229cb531e |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/79f3ac7dcd12c05b7539239a4c6fa229a50d786c |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/b825bfbbaafbe8da2037e3a778ad660c59f9e054 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/d0006d739738a658a9c29b438444259d9f71dfa0 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/d85a1bec8e8d552ab13163ca1874dcd82f3d1550 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/fb2004bafd1932e08d21ca604ee5844f2b7f212d |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-49763 | https://bugzilla.suse.com/show_bug.cgi?id=1242249 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2022-49763 | https://bugzilla.suse.com/show_bug.cgi?id=1242249 |
| suse_bugzilla | https://git.kernel.org/stable/c/266bd5306286316758e6246ea0345133427b0f62 | https://bugzilla.suse.com/show_bug.cgi?id=1242249 |
| suse_bugzilla | https://git.kernel.org/stable/c/4863f815463034f588a035cfd99cdca97a4f1069 | https://bugzilla.suse.com/show_bug.cgi?id=1242249 |
| suse_bugzilla | https://git.kernel.org/stable/c/5330c423b86263ac7883fef0260b9e2229cb531e | https://bugzilla.suse.com/show_bug.cgi?id=1242249 |
| suse_bugzilla | https://git.kernel.org/stable/c/79f3ac7dcd12c05b7539239a4c6fa229a50d786c | https://bugzilla.suse.com/show_bug.cgi?id=1242249 |
| suse_bugzilla | https://git.kernel.org/stable/c/b825bfbbaafbe8da2037e3a778ad660c59f9e054 | https://bugzilla.suse.com/show_bug.cgi?id=1242249 |
| suse_bugzilla | https://git.kernel.org/stable/c/d0006d739738a658a9c29b438444259d9f71dfa0 | https://bugzilla.suse.com/show_bug.cgi?id=1242249 |
| suse_bugzilla | https://git.kernel.org/stable/c/d85a1bec8e8d552ab13163ca1874dcd82f3d1550 | https://bugzilla.suse.com/show_bug.cgi?id=1242249 |
| suse_bugzilla | https://git.kernel.org/stable/c/fb2004bafd1932e08d21ca604ee5844f2b7f212d | https://bugzilla.suse.com/show_bug.cgi?id=1242249 |
| suse_bugzilla | https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2022/CVE-2022-49763.mbox | https://bugzilla.suse.com/show_bug.cgi?id=1242249 |
| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2363372 | https://bugzilla.suse.com/show_bug.cgi?id=1242249 |
| anolis |  | https://anas.openanolis.cn/cves/detail/CVE-2022-49763 |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

无
</details>

二、漏洞分析结构反馈
 影响性分析说明：
  In the Linux kernel, the following vulnerability has been resolved:ntfs: fix use-after-free in ntfs_attr_find()Patch series &#34;ntfs: fix bugs about Attribute&#34;, v2.This patchset fixes three bugs relative to Attribute in record:Patch 1 adds a sanity check to ensure that, attrs_offset field in firstmft record loading from disk is within bounds.Patch 2 moves the ATTR_RECORD&#39;s bounds checking earlier, to avoiddereferencing ATTR_RECORD before checking this ATTR_RECORD is withinbounds.Patch 3 adds an overflow checking to avoid possible forever loop inntfs_attr_find().Without patch 1 and patch 2, the kernel triggersa KASAN use-after-freedetection as reported by Syzkaller.Although one of patch 1 or patch 2 can fix this, we still need both ofthem.  Because patch 1 fixes the root cause, and patch 2 not only fixesthe direct cause, but also fixes the potential out-of-bounds bug.
 openEuler评分：
  3.9
 Vector：CVSS：3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L
 受影响版本排查(受影响/不受影响)：
  1.master(6.12.0):不受影响
2.openEuler-20.03-LTS-SP4(4.19.90):不受影响
3.openEuler-22.03-LTS-SP3(5.10.0):不受影响
4.openEuler-22.03-LTS-SP4(5.10.0):不受影响
5.openEuler-24.03-LTS(6.6.0):不受影响
6.openEuler-24.03-LTS-Next(6.6.0):不受影响
7.openEuler-24.03-LTS-SP1(6.6.0):不受影响
8.openEuler-24.03-LTS-SP2(6.6.0):不受影响

修复是否涉及abi变化(是/否)：
  1.master(6.12.0):否
2.openEuler-20.03-LTS-SP4(4.19.90):否
3.openEuler-22.03-LTS-SP3(5.10.0):否
4.openEuler-22.03-LTS-SP4(5.10.0):否
5.openEuler-24.03-LTS(6.6.0):否
6.openEuler-24.03-LTS-Next(6.6.0):否
7.openEuler-24.03-LTS-SP1(6.6.0):否
8.openEuler-24.03-LTS-SP2(6.6.0):否

原因说明：
  1.openEuler-20.03-LTS-SP4(4.19.90):不受影响-组件不存在
2.master(6.12.0):不受影响-漏洞代码不能被攻击者触发
3.openEuler-22.03-LTS-SP3(5.10.0):不受影响-漏洞代码不能被攻击者触发
4.openEuler-22.03-LTS-SP4(5.10.0):不受影响-漏洞代码不能被攻击者触发
5.openEuler-24.03-LTS(6.6.0):不受影响-漏洞代码不能被攻击者触发
6.openEuler-24.03-LTS-Next(6.6.0):不受影响-漏洞代码不能被攻击者触发
7.openEuler-24.03-LTS-SP1(6.6.0):不受影响-漏洞代码不能被攻击者触发
8.openEuler-24.03-LTS-SP2(6.6.0):不受影响-漏洞代码不能被攻击者触发

src-openEuler/kernel

内容风险标识

评论 (5)

src-openEuler/kernel .gitee-modal { width: 500px !important; }

内容风险标识

CVE-2022-49763

评论 (5)

搜索帮助

src-openEuler/kernel