| From bippy-1.1.0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@kernel.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2022-49769: gfs2: Check sb_bsize_shift after reading superblock |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| gfs2: Check sb_bsize_shift after reading superblock |
| |
| Fuzzers like to scribble over sb_bsize_shift but in reality it's very |
| unlikely that this field would be corrupted on its own. Nevertheless it |
| should be checked to avoid the possibility of messy mount errors due to |
| bad calculations. It's always a fixed value based on the block size so |
| we can just check that it's the expected value. |
| |
| Tested with: |
| |
| mkfs.gfs2 -O -p lock_nolock /dev/vdb |
| for i in 0 -1 64 65 32 33; do |
| gfs2_edit -p sb field sb_bsize_shift $i /dev/vdb |
| mount /dev/vdb /mnt/test && umount /mnt/test |
| done |
| |
| Before this patch we get a withdraw after |
| |
| [ 76.413681] gfs2: fsid=loop0.0: fatal: invalid metadata block |
| [ 76.413681] bh = 19 (type: exp=5, found=4) |
| [ 76.413681] function = gfs2_meta_buffer, file = fs/gfs2/meta_io.c, line = 492 |
| |
| and with UBSAN configured we also get complaints like |
| |
| [ 76.373395] UBSAN: shift-out-of-bounds in fs/gfs2/ops_fstype.c:295:19 |
| [ 76.373815] shift exponent 4294967287 is too large for 64-bit type 'long unsigned int' |
| |
| After the patch, these complaints don't appear, mount fails immediately |
| and we get an explanation in dmesg. |
| |
| The Linux kernel CVE team has assigned CVE-2022-49769 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Fixed in 4.9.334 with commit d6b1e8ea6f3418c3b461ad5a35cdc93c996b2c87 |
| Fixed in 4.14.300 with commit 1ad197097343568066a8ffaa27ee7d0ae6d9f476 |
| Fixed in 4.19.267 with commit 15c83fa0fd659dd9fbdc940a560b61236e876a80 |
| Fixed in 5.4.225 with commit 8b6534c9ae9dba5489703a19d8ba6c8f2cfa33c2 |
| Fixed in 5.10.156 with commit 5fa30be7ba81191b0a0c7239a89befc0c94286d5 |
| Fixed in 5.15.80 with commit 28275a7c84d21c55ab3282d897f284d8d527173c |
| Fixed in 6.0.10 with commit 16670534c7cff1acd918a6a5ec751b14e7436b76 |
| Fixed in 6.1 with commit 670f8ce56dd0632dc29a0322e188cc73ce3c6b92 |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2022-49769 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| fs/gfs2/ops_fstype.c |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/d6b1e8ea6f3418c3b461ad5a35cdc93c996b2c87 |
| https://git.kernel.org/stable/c/1ad197097343568066a8ffaa27ee7d0ae6d9f476 |
| https://git.kernel.org/stable/c/15c83fa0fd659dd9fbdc940a560b61236e876a80 |
| https://git.kernel.org/stable/c/8b6534c9ae9dba5489703a19d8ba6c8f2cfa33c2 |
| https://git.kernel.org/stable/c/5fa30be7ba81191b0a0c7239a89befc0c94286d5 |
| https://git.kernel.org/stable/c/28275a7c84d21c55ab3282d897f284d8d527173c |
| https://git.kernel.org/stable/c/16670534c7cff1acd918a6a5ec751b14e7436b76 |
| https://git.kernel.org/stable/c/670f8ce56dd0632dc29a0322e188cc73ce3c6b92 |
