CVE-2022-50478 (GCVE-0-2022-50478)

Vulnerability from cvelistv5 – Published: 2025-10-04 15:16 – Updated: 2025-12-23 13:29
VLAI?
Title
nilfs2: fix shift-out-of-bounds/overflow in nilfs_sb2_bad_offset()
Summary
In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix shift-out-of-bounds/overflow in nilfs_sb2_bad_offset() Patch series "nilfs2: fix UBSAN shift-out-of-bounds warnings on mount time". The first patch fixes a bug reported by syzbot, and the second one fixes the remaining bug of the same kind. Although they are triggered by the same super block data anomaly, I divided it into the above two because the details of the issues and how to fix it are different. Both are required to eliminate the shift-out-of-bounds issues at mount time. This patch (of 2): If the block size exponent information written in an on-disk superblock is corrupted, nilfs_sb2_bad_offset helper function can trigger shift-out-of-bounds warning followed by a kernel panic (if panic_on_warn is set): shift exponent 38983 is too large for 64-bit type 'unsigned long long' Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1b1/0x28e lib/dump_stack.c:106 ubsan_epilogue lib/ubsan.c:151 [inline] __ubsan_handle_shift_out_of_bounds+0x33d/0x3b0 lib/ubsan.c:322 nilfs_sb2_bad_offset fs/nilfs2/the_nilfs.c:449 [inline] nilfs_load_super_block+0xdf5/0xe00 fs/nilfs2/the_nilfs.c:523 init_nilfs+0xb7/0x7d0 fs/nilfs2/the_nilfs.c:577 nilfs_fill_super+0xb1/0x5d0 fs/nilfs2/super.c:1047 nilfs_mount+0x613/0x9b0 fs/nilfs2/super.c:1317 ... In addition, since nilfs_sb2_bad_offset() performs multiplication without considering the upper bound, the computation may overflow if the disk layout parameters are not normal. This fixes these issues by inserting preliminary sanity checks for those parameters and by converting the comparison from one involving multiplication and left bit-shifting to one using division and right bit-shifting.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: e339ad31f59925b48a92ee3947692fdf9758b8c7 , < 6b0ea3df56cccd53398d0289f399f19d43136b2e (git)
Affected: e339ad31f59925b48a92ee3947692fdf9758b8c7 , < a6f89b10042baca218c8598d6db5a44c7e32625f (git)
Affected: e339ad31f59925b48a92ee3947692fdf9758b8c7 , < 9b3ba54025357440d6c4414c670984f628c6f6bf (git)
Affected: e339ad31f59925b48a92ee3947692fdf9758b8c7 , < d706485dffbbbf848e681edda29c7a46ac55698c (git)
Affected: e339ad31f59925b48a92ee3947692fdf9758b8c7 , < d464b035c0613856d012cf1704879d3ff3f057fb (git)
Affected: e339ad31f59925b48a92ee3947692fdf9758b8c7 , < b47f5c579c8186f7f5ab5e4254e0734ea5b7bf7a (git)
Affected: e339ad31f59925b48a92ee3947692fdf9758b8c7 , < 1012ff77284e3bec0ec0a35a820b03ec43dec2cc (git)
Affected: e339ad31f59925b48a92ee3947692fdf9758b8c7 , < 62d11ec205ef14d8acf172cfc9904fdbf200025a (git)
Affected: e339ad31f59925b48a92ee3947692fdf9758b8c7 , < 610a2a3d7d8be3537458a378ec69396a76c385b6 (git)
Create a notification for this product.
    Linux Linux Affected: 2.6.30
Unaffected: 0 , < 2.6.30 (semver)
Unaffected: 4.9.337 , ≤ 4.9.* (semver)
Unaffected: 4.14.303 , ≤ 4.14.* (semver)
Unaffected: 4.19.270 , ≤ 4.19.* (semver)
Unaffected: 5.4.229 , ≤ 5.4.* (semver)
Unaffected: 5.10.163 , ≤ 5.10.* (semver)
Unaffected: 5.15.86 , ≤ 5.15.* (semver)
Unaffected: 6.0.16 , ≤ 6.0.* (semver)
Unaffected: 6.1.2 , ≤ 6.1.* (semver)
Unaffected: 6.2 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/nilfs2/the_nilfs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6b0ea3df56cccd53398d0289f399f19d43136b2e",
              "status": "affected",
              "version": "e339ad31f59925b48a92ee3947692fdf9758b8c7",
              "versionType": "git"
            },
            {
              "lessThan": "a6f89b10042baca218c8598d6db5a44c7e32625f",
              "status": "affected",
              "version": "e339ad31f59925b48a92ee3947692fdf9758b8c7",
              "versionType": "git"
            },
            {
              "lessThan": "9b3ba54025357440d6c4414c670984f628c6f6bf",
              "status": "affected",
              "version": "e339ad31f59925b48a92ee3947692fdf9758b8c7",
              "versionType": "git"
            },
            {
              "lessThan": "d706485dffbbbf848e681edda29c7a46ac55698c",
              "status": "affected",
              "version": "e339ad31f59925b48a92ee3947692fdf9758b8c7",
              "versionType": "git"
            },
            {
              "lessThan": "d464b035c0613856d012cf1704879d3ff3f057fb",
              "status": "affected",
              "version": "e339ad31f59925b48a92ee3947692fdf9758b8c7",
              "versionType": "git"
            },
            {
              "lessThan": "b47f5c579c8186f7f5ab5e4254e0734ea5b7bf7a",
              "status": "affected",
              "version": "e339ad31f59925b48a92ee3947692fdf9758b8c7",
              "versionType": "git"
            },
            {
              "lessThan": "1012ff77284e3bec0ec0a35a820b03ec43dec2cc",
              "status": "affected",
              "version": "e339ad31f59925b48a92ee3947692fdf9758b8c7",
              "versionType": "git"
            },
            {
              "lessThan": "62d11ec205ef14d8acf172cfc9904fdbf200025a",
              "status": "affected",
              "version": "e339ad31f59925b48a92ee3947692fdf9758b8c7",
              "versionType": "git"
            },
            {
              "lessThan": "610a2a3d7d8be3537458a378ec69396a76c385b6",
              "status": "affected",
              "version": "e339ad31f59925b48a92ee3947692fdf9758b8c7",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/nilfs2/the_nilfs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.30"
            },
            {
              "lessThan": "2.6.30",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.9.*",
              "status": "unaffected",
              "version": "4.9.337",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.14.*",
              "status": "unaffected",
              "version": "4.14.303",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.229",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.163",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.86",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.0.*",
              "status": "unaffected",
              "version": "6.0.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.9.337",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.14.303",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.270",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.229",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.163",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.86",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0.16",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.2",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.2",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: fix shift-out-of-bounds/overflow in nilfs_sb2_bad_offset()\n\nPatch series \"nilfs2: fix UBSAN shift-out-of-bounds warnings on mount\ntime\".\n\nThe first patch fixes a bug reported by syzbot, and the second one fixes\nthe remaining bug of the same kind.  Although they are triggered by the\nsame super block data anomaly, I divided it into the above two because the\ndetails of the issues and how to fix it are different.\n\nBoth are required to eliminate the shift-out-of-bounds issues at mount\ntime.\n\n\nThis patch (of 2):\n\nIf the block size exponent information written in an on-disk superblock is\ncorrupted, nilfs_sb2_bad_offset helper function can trigger\nshift-out-of-bounds warning followed by a kernel panic (if panic_on_warn\nis set):\n\n shift exponent 38983 is too large for 64-bit type \u0027unsigned long long\u0027\n Call Trace:\n  \u003cTASK\u003e\n  __dump_stack lib/dump_stack.c:88 [inline]\n  dump_stack_lvl+0x1b1/0x28e lib/dump_stack.c:106\n  ubsan_epilogue lib/ubsan.c:151 [inline]\n  __ubsan_handle_shift_out_of_bounds+0x33d/0x3b0 lib/ubsan.c:322\n  nilfs_sb2_bad_offset fs/nilfs2/the_nilfs.c:449 [inline]\n  nilfs_load_super_block+0xdf5/0xe00 fs/nilfs2/the_nilfs.c:523\n  init_nilfs+0xb7/0x7d0 fs/nilfs2/the_nilfs.c:577\n  nilfs_fill_super+0xb1/0x5d0 fs/nilfs2/super.c:1047\n  nilfs_mount+0x613/0x9b0 fs/nilfs2/super.c:1317\n  ...\n\nIn addition, since nilfs_sb2_bad_offset() performs multiplication without\nconsidering the upper bound, the computation may overflow if the disk\nlayout parameters are not normal.\n\nThis fixes these issues by inserting preliminary sanity checks for those\nparameters and by converting the comparison from one involving\nmultiplication and left bit-shifting to one using division and right\nbit-shifting."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-12-23T13:29:34.027Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/6b0ea3df56cccd53398d0289f399f19d43136b2e"
        },
        {
          "url": "https://git.kernel.org/stable/c/a6f89b10042baca218c8598d6db5a44c7e32625f"
        },
        {
          "url": "https://git.kernel.org/stable/c/9b3ba54025357440d6c4414c670984f628c6f6bf"
        },
        {
          "url": "https://git.kernel.org/stable/c/d706485dffbbbf848e681edda29c7a46ac55698c"
        },
        {
          "url": "https://git.kernel.org/stable/c/d464b035c0613856d012cf1704879d3ff3f057fb"
        },
        {
          "url": "https://git.kernel.org/stable/c/b47f5c579c8186f7f5ab5e4254e0734ea5b7bf7a"
        },
        {
          "url": "https://git.kernel.org/stable/c/1012ff77284e3bec0ec0a35a820b03ec43dec2cc"
        },
        {
          "url": "https://git.kernel.org/stable/c/62d11ec205ef14d8acf172cfc9904fdbf200025a"
        },
        {
          "url": "https://git.kernel.org/stable/c/610a2a3d7d8be3537458a378ec69396a76c385b6"
        }
      ],
      "title": "nilfs2: fix shift-out-of-bounds/overflow in nilfs_sb2_bad_offset()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-50478",
    "datePublished": "2025-10-04T15:16:38.346Z",
    "dateReserved": "2025-10-04T15:13:33.467Z",
    "dateUpdated": "2025-12-23T13:29:34.027Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-50478\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-10-04T16:15:44.417\",\"lastModified\":\"2025-10-06T14:56:47.823\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnilfs2: fix shift-out-of-bounds/overflow in nilfs_sb2_bad_offset()\\n\\nPatch series \\\"nilfs2: fix UBSAN shift-out-of-bounds warnings on mount\\ntime\\\".\\n\\nThe first patch fixes a bug reported by syzbot, and the second one fixes\\nthe remaining bug of the same kind.  Although they are triggered by the\\nsame super block data anomaly, I divided it into the above two because the\\ndetails of the issues and how to fix it are different.\\n\\nBoth are required to eliminate the shift-out-of-bounds issues at mount\\ntime.\\n\\n\\nThis patch (of 2):\\n\\nIf the block size exponent information written in an on-disk superblock is\\ncorrupted, nilfs_sb2_bad_offset helper function can trigger\\nshift-out-of-bounds warning followed by a kernel panic (if panic_on_warn\\nis set):\\n\\n shift exponent 38983 is too large for 64-bit type \u0027unsigned long long\u0027\\n Call Trace:\\n  \u003cTASK\u003e\\n  __dump_stack lib/dump_stack.c:88 [inline]\\n  dump_stack_lvl+0x1b1/0x28e lib/dump_stack.c:106\\n  ubsan_epilogue lib/ubsan.c:151 [inline]\\n  __ubsan_handle_shift_out_of_bounds+0x33d/0x3b0 lib/ubsan.c:322\\n  nilfs_sb2_bad_offset fs/nilfs2/the_nilfs.c:449 [inline]\\n  nilfs_load_super_block+0xdf5/0xe00 fs/nilfs2/the_nilfs.c:523\\n  init_nilfs+0xb7/0x7d0 fs/nilfs2/the_nilfs.c:577\\n  nilfs_fill_super+0xb1/0x5d0 fs/nilfs2/super.c:1047\\n  nilfs_mount+0x613/0x9b0 fs/nilfs2/super.c:1317\\n  ...\\n\\nIn addition, since nilfs_sb2_bad_offset() performs multiplication without\\nconsidering the upper bound, the computation may overflow if the disk\\nlayout parameters are not normal.\\n\\nThis fixes these issues by inserting preliminary sanity checks for those\\nparameters and by converting the comparison from one involving\\nmultiplication and left bit-shifting to one using division and right\\nbit-shifting.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1012ff77284e3bec0ec0a35a820b03ec43dec2cc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/610a2a3d7d8be3537458a378ec69396a76c385b6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/62d11ec205ef14d8acf172cfc9904fdbf200025a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/6b0ea3df56cccd53398d0289f399f19d43136b2e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/9b3ba54025357440d6c4414c670984f628c6f6bf\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a6f89b10042baca218c8598d6db5a44c7e32625f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b47f5c579c8186f7f5ab5e4254e0734ea5b7bf7a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/d464b035c0613856d012cf1704879d3ff3f057fb\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/d706485dffbbbf848e681edda29c7a46ac55698c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.