CVE-2022-50567

Vulnerability

Overview

CVE-2022-50567 is a shift-out-of-bounds bug in the Linux kernel's JFS (Journaled File System) implementation. The vulnerability resides in the dbAllocAG function, where the field bmp->db_agl2size is used in a shift operation without prior validation. Since this field can be greater than 64, the shift triggers undefined behavior, causing a UBSAN (Undefined Behavior Sanitizer) crash [1][2][3][4].

Exploitation

Conditions

An attacker can exploit this vulnerability by mounting a specially crafted JFS filesystem image. No authentication or special privileges are required beyond the ability to mount a filesystem, making this a low-complexity attack vector in environments where untrusted filesystems may be presented (e.g., via USB drives or network mounts).

Impact

Successful exploitation results in a kernel crash (denial of service). The UBSAN report indicates a shift-out-of-bounds, which can halt system operations. No privilege escalation or data corruption has been documented, but the system becomes unavailable until rebooted.

Mitigation

The Linux kernel maintainers have addressed the issue by adding a check for bmp->db_agl2size in the dbMount function, as this field is used in many subsequent operations. The upper bound was set to L2MAXL2SIZE - L2MAXAG, thanks to Dave Kleikamp's assistance. Patches have been merged into stable kernel branches as commits [1][2][3][4]. Users should apply the relevant update to their kernel version.