Vulnerability-Lookup

GHSA-9VR8-RQ9X-PJP8

Vulnerability from github – Published: 2025-09-15 15:31 – Updated: 2025-12-04 18:30

Details

In the Linux kernel, the following vulnerability has been resolved:

ext4: fix potential out of bound read in ext4_fc_replay_scan()

For scan loop must ensure that at least EXT4_FC_TAG_BASE_LEN space. If remain space less than EXT4_FC_TAG_BASE_LEN which will lead to out of bound read when mounting corrupt file system image. ADD_RANGE/HEAD/TAIL is needed to add extra check when do journal scan, as this three tags will read data during scan, tag length couldn't less than data length which will read.

Severity

7.1 (High)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2022-50306"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-125"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-09-15T15:15:42Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix potential out of bound read in ext4_fc_replay_scan()\n\nFor scan loop must ensure that at least EXT4_FC_TAG_BASE_LEN space. If remain\nspace less than EXT4_FC_TAG_BASE_LEN which will lead to out of bound read\nwhen mounting corrupt file system image.\nADD_RANGE/HEAD/TAIL is needed to add extra check when do journal scan, as this\nthree tags will read data during scan, tag length couldn\u0027t less than data length\nwhich will read.",
  "id": "GHSA-9vr8-rq9x-pjp8",
  "modified": "2025-12-04T18:30:37Z",
  "published": "2025-09-15T15:31:26Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-50306"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/1b45cc5c7b920fd8bf72e5a888ec7abeadf41e09"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/6969367c1500c15eddc38fda12f6d15518ad6d03"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/f234294812c9b68d603650d28743eafb718e7ad5"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2022-50306 (GCVE-0-2022-50306)

Vulnerability from cvelistv5 – Published: 2025-09-15 14:46 – Updated: 2026-08-05 08:58

Title

ext4: fix potential out of bound read in ext4_fc_replay_scan()

Summary

In the Linux kernel, the following vulnerability has been resolved: ext4: fix potential out of bound read in ext4_fc_replay_scan() For scan loop must ensure that at least EXT4_FC_TAG_BASE_LEN space. If remain space less than EXT4_FC_TAG_BASE_LEN which will lead to out of bound read when mounting corrupt file system image. ADD_RANGE/HEAD/TAIL is needed to add extra check when do journal scan, as this three tags will read data during scan, tag length couldn't less than data length which will read.

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

Assigner

Linux mitre root

References

3 references

URL	Tags
https://git.kernel.org/stable/c/6969367c1500c15ed…
https://git.kernel.org/stable/c/f234294812c9b68d6…
https://git.kernel.org/stable/c/1b45cc5c7b920fd8b…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 8016e29f4362e285f0f7e38fadc61a5b7bdfdfa2 , < 6969367c1500c15eddc38fda12f6d15518ad6d03 (git) Affected: 8016e29f4362e285f0f7e38fadc61a5b7bdfdfa2 , < f234294812c9b68d603650d28743eafb718e7ad5 (git) Affected: 8016e29f4362e285f0f7e38fadc61a5b7bdfdfa2 , < 1b45cc5c7b920fd8bf72e5a888ec7abeadf41e09 (git)
Linux	Linux	Affected: 5.10 Unaffected: 0 , < 5.10 (semver) Unaffected: 5.15.87 , ≤ 5.15.* (semver) Unaffected: 6.0.6 , ≤ 6.0.* (semver) Unaffected: 6.1 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/ext4/fast_commit.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6969367c1500c15eddc38fda12f6d15518ad6d03",
              "status": "affected",
              "version": "8016e29f4362e285f0f7e38fadc61a5b7bdfdfa2",
              "versionType": "git"
            },
            {
              "lessThan": "f234294812c9b68d603650d28743eafb718e7ad5",
              "status": "affected",
              "version": "8016e29f4362e285f0f7e38fadc61a5b7bdfdfa2",
              "versionType": "git"
            },
            {
              "lessThan": "1b45cc5c7b920fd8bf72e5a888ec7abeadf41e09",
              "status": "affected",
              "version": "8016e29f4362e285f0f7e38fadc61a5b7bdfdfa2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/ext4/fast_commit.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.10"
            },
            {
              "lessThan": "5.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.87",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.0.*",
              "status": "unaffected",
              "version": "6.0.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.87",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0.6",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix potential out of bound read in ext4_fc_replay_scan()\n\nFor scan loop must ensure that at least EXT4_FC_TAG_BASE_LEN space. If remain\nspace less than EXT4_FC_TAG_BASE_LEN which will lead to out of bound read\nwhen mounting corrupt file system image.\nADD_RANGE/HEAD/TAIL is needed to add extra check when do journal scan, as this\nthree tags will read data during scan, tag length couldn\u0027t less than data length\nwhich will read."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Triggered only when mounting a crafted ext4 image with a dirty fast-commit journal; the path is local VFS mount \u2192 jbd2_journal_load \u2192 fc_do_one_pass \u2192 ext4_fc_replay_scan(), not reachable via network packet processing.\nAC:L - The attacker fully controls the on-disk fast-commit tags, lengths, and journal dirty state in the image, so the OOB read is reliably triggered on mount with no conditions outside their control.\nPR:N - Highest-severity scenario is supplying a malicious filesystem image (USB/SD/cloud disk) that a privileged victim mounts; the attacker needs no privileges of their own. ext4 lacks FS_USERNS_MOUNT, so this is not a self-mount-by-unprivileged-userns case.\nUI:R - Exploitation requires a user or automount path to mount the malicious ext4 filesystem image, which is the interaction that reaches journal recovery and the vulnerable scan loop.\nS:U - Impact is confined to the host kernel authority that performs the mount; there is no VM/IOMMU/sandbox boundary crossing.\nC:H - This is an out-of-bounds read of journal buffer memory; attacker-controlled fc_len (u16) can cause checksum/tag parsing to read far beyond the block (not a few-byte bound), which per guidance scores Confidentiality High.\nI:N - The bug is a pure out-of-bounds read with no write primitive, heap corruption, or control-flow hijack; scanned OOB data only feeds local CRC/region logic and does not modify attacker-controlled kernel state for integrity compromise.\nA:H - Reading past the journal block into unmapped or invalid kernel memory can oops/panic the kernel during mount, fully denying availability."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:58:07.756Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/6969367c1500c15eddc38fda12f6d15518ad6d03"
        },
        {
          "url": "https://git.kernel.org/stable/c/f234294812c9b68d603650d28743eafb718e7ad5"
        },
        {
          "url": "https://git.kernel.org/stable/c/1b45cc5c7b920fd8bf72e5a888ec7abeadf41e09"
        }
      ],
      "title": "ext4: fix potential out of bound read in ext4_fc_replay_scan()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-50306",
    "datePublished": "2025-09-15T14:46:01.672Z",
    "dateReserved": "2025-09-15T14:18:36.813Z",
    "dateUpdated": "2026-08-05T08:58:07.756Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.