CVE-2022-48712 - OpenCVE

In the Linux kernel, the following vulnerability has been resolved: ext4: fix error handling in ext4_fc_record_modified_inode() Current code does not fully takes care of krealloc() error case, which could lead to silent memory corruption or a kernel bug. This patch fixes that. Also it cleans up some duplicated error handling logic from various functions in fast_commit.c file.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

No data.

No data.

No data.

References

Link	Providers
https://git.kernel.org/stable/c/14aa3f49c7fc6424763f4323bfbc3a807b0727dc
https://git.kernel.org/stable/c/1b6762ecdf3cf12113772427c904aa3c420a1802
https://git.kernel.org/stable/c/62e46e0ffc02daa8fcfc02f7a932cc8a19601b19
https://git.kernel.org/stable/c/cdce59a1549190b66f8e3fe465c2b2f714b98a94
https://lore.kernel.org/linux-cve-announce/2024062054-CVE-2022-48712-6289@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2022-48712
https://www.cve.org/CVERecord?id=CVE-2022-48712

History

Thu, 12 Sep 2024 20:30:00 +0000

Type	Values Removed	Values Added
Metrics	ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Wed, 11 Sep 2024 13:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2024-06-20T11:13:06.701Z

Updated: 2024-11-04T12:15:03.716Z

Reserved: 2024-06-20T11:09:39.050Z

Link: CVE-2022-48712

Vulnrichment

Updated: 2024-08-03T15:17:55.868Z

NVD

Status : Awaiting Analysis

Published: 2024-06-20T11:15:54.880

Modified: 2024-06-20T12:43:25.663

Link: CVE-2022-48712

Redhat

Severity : Low

Publid Date: 2024-06-20T00:00:00Z

Links: CVE-2022-48712 - Bugzilla

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2022-48712", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-06-20T11:09:39.050Z", "datePublished": "2024-06-20T11:13:06.701Z", "dateUpdated": "2024-11-04T12:15:03.716Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2024-11-04T12:15:03.716Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix error handling in ext4_fc_record_modified_inode()\n\nCurrent code does not fully takes care of krealloc() error case, which\ncould lead to silent memory corruption or a kernel bug. This patch\nfixes that.\n\nAlso it cleans up some duplicated error handling logic from various\nfunctions in fast_commit.c file."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/ext4/fast_commit.c"], "versions": [{"version": "1da177e4c3f4", "lessThan": "62e46e0ffc02", "status": "affected", "versionType": "git"}, {"version": "1da177e4c3f4", "lessThan": "1b6762ecdf3c", "status": "affected", "versionType": "git"}, {"version": "1da177e4c3f4", "lessThan": "14aa3f49c7fc", "status": "affected", "versionType": "git"}, {"version": "1da177e4c3f4", "lessThan": "cdce59a15491", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/ext4/fast_commit.c"], "versions": [{"version": "5.10.99", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.22", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.16.8", "lessThanOrEqual": "5.16.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.17", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "references": [{"url": "https://git.kernel.org/stable/c/62e46e0ffc02daa8fcfc02f7a932cc8a19601b19"}, {"url": "https://git.kernel.org/stable/c/1b6762ecdf3cf12113772427c904aa3c420a1802"}, {"url": "https://git.kernel.org/stable/c/14aa3f49c7fc6424763f4323bfbc3a807b0727dc"}, {"url": "https://git.kernel.org/stable/c/cdce59a1549190b66f8e3fe465c2b2f714b98a94"}], "title": "ext4: fix error handling in ext4_fc_record_modified_inode()", "x_generator": {"engine": "bippy-9e1c9544281a"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T15:17:55.868Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/62e46e0ffc02daa8fcfc02f7a932cc8a19601b19", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/1b6762ecdf3cf12113772427c904aa3c420a1802", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/14aa3f49c7fc6424763f4323bfbc3a807b0727dc", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/cdce59a1549190b66f8e3fe465c2b2f714b98a94", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2022-48712", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T17:11:32.374612Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T17:34:50.211Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/62e46e0ffc02daa8fcfc02f7a932cc8a19601b19", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/1b6762ecdf3cf12113772427c904aa3c420a1802", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/14aa3f49c7fc6424763f4323bfbc3a807b0727dc", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/cdce59a1549190b66f8e3fe465c2b2f714b98a94", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T15:17:55.868Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2022-48712", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T17:11:32.374612Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T12:42:26.240Z"}}], "cna": {"title": "ext4: fix error handling in ext4_fc_record_modified_inode()", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "1da177e4c3f4", "lessThan": "62e46e0ffc02", "versionType": "git"}, {"status": "affected", "version": "1da177e4c3f4", "lessThan": "1b6762ecdf3c", "versionType": "git"}, {"status": "affected", "version": "1da177e4c3f4", "lessThan": "14aa3f49c7fc", "versionType": "git"}, {"status": "affected", "version": "1da177e4c3f4", "lessThan": "cdce59a15491", "versionType": "git"}], "programFiles": ["fs/ext4/fast_commit.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "unaffected", "version": "5.10.99", "versionType": "custom", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.22", "versionType": "custom", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "5.16.8", "versionType": "custom", "lessThanOrEqual": "5.16.*"}, {"status": "unaffected", "version": "5.17", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["fs/ext4/fast_commit.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/62e46e0ffc02daa8fcfc02f7a932cc8a19601b19"}, {"url": "https://git.kernel.org/stable/c/1b6762ecdf3cf12113772427c904aa3c420a1802"}, {"url": "https://git.kernel.org/stable/c/14aa3f49c7fc6424763f4323bfbc3a807b0727dc"}, {"url": "https://git.kernel.org/stable/c/cdce59a1549190b66f8e3fe465c2b2f714b98a94"}], "x_generator": {"engine": "bippy-7d53e8ef8be4"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix error handling in ext4_fc_record_modified_inode()\n\nCurrent code does not fully takes care of krealloc() error case, which\ncould lead to silent memory corruption or a kernel bug. This patch\nfixes that.\n\nAlso it cleans up some duplicated error handling logic from various\nfunctions in fast_commit.c file."}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2024-06-20T11:13:53.539Z"}}}, "cveMetadata": {"cveId": "CVE-2022-48712", "state": "PUBLISHED", "dateUpdated": "2024-09-11T17:34:50.211Z", "dateReserved": "2024-06-20T11:09:39.050Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-06-20T11:13:06.701Z", "assignerShortName": "Linux"}, "dataVersion": "5.1"}