CVE-2022-49769

Full vulnerability record from the local CVENow database.

Description

In the Linux kernel, the following vulnerability has been resolved: gfs2: Check sb_bsize_shift after reading superblock Fuzzers like to scribble over sb_bsize_shift but in reality it's very unlikely that this field would be corrupted on its own. Nevertheless it should be checked to avoid the possibility of messy mount errors due to bad calculations. It's always a fixed value based on the block size so we can just check that it's the expected value. Tested with: mkfs.gfs2 -O -p lock_nolock /dev/vdb for i in 0 -1 64 65 32 33; do gfs2_edit -p sb field sb_bsize_shift $i /dev/vdb mount /dev/vdb /mnt/test && umount /mnt/test done Before this patch we get a withdraw after [ 76.413681] gfs2: fsid=loop0.0: fatal: invalid metadata block [ 76.413681] bh = 19 (type: exp=5, found=4) [ 76.413681] function = gfs2_meta_buffer, file = fs/gfs2/meta_io.c, line = 492 and with UBSAN configured we also get complaints like [ 76.373395] UBSAN: shift-out-of-bounds in fs/gfs2/ops_fstype.c:295:19 [ 76.373815] shift exponent 4294967287 is too large for 64-bit type 'long unsigned int' After the patch, these complaints don't appear, mount fails immediately and we get an explanation in dmesg.

Severity

MEDIUM

CVSS score

5.5 (v3.1)

Vulnerability status

Analyzed

Source identifier

416baaa9-dc9f-4396-8d5f-8c081fb06d67

Published

2025-05-01 15:15:59.710000

Last modified

2026-11-05 20:17:09.457000

View original CVE JSON

{
  "id": "CVE-2022-49769",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "published": "2025-05-01T15:15:59.710",
  "lastModified": "2026-11-05T20:17:09.457",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngfs2: Check sb_bsize_shift after reading superblock\n\nFuzzers like to scribble over sb_bsize_shift but in reality it's very\nunlikely that this field would be corrupted on its own. Nevertheless it\nshould be checked to avoid the possibility of messy mount errors due to\nbad calculations. It's always a fixed value based on the block size so\nwe can just check that it's the expected value.\n\nTested with:\n\n    mkfs.gfs2 -O -p lock_nolock /dev/vdb\n    for i in 0 -1 64 65 32 33; do\n        gfs2_edit -p sb field sb_bsize_shift $i /dev/vdb\n        mount /dev/vdb /mnt/test && umount /mnt/test\n    done\n\nBefore this patch we get a withdraw after\n\n[   76.413681] gfs2: fsid=loop0.0: fatal: invalid metadata block\n[   76.413681]   bh = 19 (type: exp=5, found=4)\n[   76.413681]   function = gfs2_meta_buffer, file = fs/gfs2/meta_io.c, line = 492\n\nand with UBSAN configured we also get complaints like\n\n[   76.373395] UBSAN: shift-out-of-bounds in fs/gfs2/ops_fstype.c:295:19\n[   76.373815] shift exponent 4294967287 is too large for 64-bit type 'long unsigned int'\n\nAfter the patch, these complaints don't appear, mount fails immediately\nand we get an explanation in dmesg."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: gfs2: Comprobación de sb_bsize_shift tras leer el superbloque. A los fuzzers les gusta manipular sb_bsize_shift, pero en realidad es muy improbable que este campo se corrompa por sí solo. Sin embargo, conviene comprobarlo para evitar errores de montaje problemáticos debido a cálculos erróneos. Siempre es un valor fijo basado en el tamaño del bloque, por lo que podemos comprobar que sea el valor esperado. Probado con: mkfs.gfs2 -O -p lock_nolock /dev/vdb for i in 0 -1 64 65 32 33; Antes de este parche obtenemos una retirada después de [ 76.413681] gfs2: fsid=loop0.0: fatal: bloque de metadatos no válido [ 76.413681] bh = 19 (tipo: exp=5, encontrado=4) [ 76.413681] función = gfs2_meta_buffer, archivo = fs/gfs2/meta_io.c, línea = 492 y con UBSAN configurado también obtenemos quejas como [ 76.373395] UBSAN: cambio fuera de los límites en fs/gfs2/ops_fstype.c:295:19 [ 76.373815] cambio El exponente 4294967287 es demasiado grande para el tipo de 64 bits 'long unsigned int'. Después del parche, estas quejas no aparecen, el montaje falla inmediatamente y obtenemos una explicación en dmesg."
    }
  ],
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "programFiles": [
            "fs/gfs2/ops_fstype.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "b3b94faa5fe5968827ba0640ee9fba4b3e7f736e",
              "lessThan": "d6b1e8ea6f3418c3b461ad5a35cdc93c996b2c87",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "b3b94faa5fe5968827ba0640ee9fba4b3e7f736e",
              "lessThan": "1ad197097343568066a8ffaa27ee7d0ae6d9f476",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "b3b94faa5fe5968827ba0640ee9fba4b3e7f736e",
              "lessThan": "15c83fa0fd659dd9fbdc940a560b61236e876a80",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "b3b94faa5fe5968827ba0640ee9fba4b3e7f736e",
              "lessThan": "8b6534c9ae9dba5489703a19d8ba6c8f2cfa33c2",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "b3b94faa5fe5968827ba0640ee9fba4b3e7f736e",
              "lessThan": "5fa30be7ba81191b0a0c7239a89befc0c94286d5",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "b3b94faa5fe5968827ba0640ee9fba4b3e7f736e",
              "lessThan": "28275a7c84d21c55ab3282d897f284d8d527173c",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "b3b94faa5fe5968827ba0640ee9fba4b3e7f736e",
              "lessThan": "16670534c7cff1acd918a6a5ec751b14e7436b76",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "b3b94faa5fe5968827ba0640ee9fba4b3e7f736e",
              "lessThan": "670f8ce56dd0632dc29a0322e188cc73ce3c6b92",
              "versionType": "git",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "programFiles": [
            "fs/gfs2/ops_fstype.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "2.6.19",
              "status": "affected"
            },
            {
              "version": "0",
              "lessThan": "2.6.19",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "4.9.334",
              "lessThanOrEqual": "4.9.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "4.14.300",
              "lessThanOrEqual": "4.14.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "4.19.267",
              "lessThanOrEqual": "4.19.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "5.4.225",
              "lessThanOrEqual": "5.4.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "5.10.156",
              "lessThanOrEqual": "5.10.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "5.15.80",
              "lessThanOrEqual": "5.15.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.0.10",
              "lessThanOrEqual": "6.0.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.1",
              "lessThanOrEqual": "*",
              "versionType": "original_commit_for_fix",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 5.5,
          "baseSeverity": "MEDIUM",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-11-05T19:47:06.860455Z",
          "id": "CVE-2022-49769",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "4.9.334",
              "matchCriteriaId": "65416FEB-3A76-4DA9-A96A-1479EC77AFB6"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "4.10",
              "versionEndExcluding": "4.14.300",
              "matchCriteriaId": "424802D2-E9E7-48A9-AD6F-DF2227B3D83A"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "4.15",
              "versionEndExcluding": "4.19.267",
              "matchCriteriaId": "A5C69A12-68E2-400E-9A5A-375A673C8402"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "4.20",
              "versionEndExcluding": "5.4.225",
              "matchCriteriaId": "94D21814-3051-4860-AB06-C7880A3D4933"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "5.5",
              "versionEndExcluding": "5.10.156",
              "matchCriteriaId": "E2152F3D-E6D3-405D-B0BE-911B8B6E2EE6"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "5.11",
              "versionEndExcluding": "5.15.80",
              "matchCriteriaId": "51BBEF3B-79F5-4D4C-ADBA-F34DA0E2465C"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "5.16",
              "versionEndExcluding": "6.0.10",
              "matchCriteriaId": "64F9ADD1-3ADB-4D66-A00F-4A83010B05F0"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/15c83fa0fd659dd9fbdc940a560b61236e876a80",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://git.kernel.org/stable/c/16670534c7cff1acd918a6a5ec751b14e7436b76",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://git.kernel.org/stable/c/1ad197097343568066a8ffaa27ee7d0ae6d9f476",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://git.kernel.org/stable/c/28275a7c84d21c55ab3282d897f284d8d527173c",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://git.kernel.org/stable/c/5fa30be7ba81191b0a0c7239a89befc0c94286d5",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://git.kernel.org/stable/c/670f8ce56dd0632dc29a0322e188cc73ce3c6b92",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://git.kernel.org/stable/c/8b6534c9ae9dba5489703a19d8ba6c8f2cfa33c2",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://git.kernel.org/stable/c/d6b1e8ea6f3418c3b461ad5a35cdc93c996b2c87",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ]
    }
  ]
}