CVE-2022-50746

Root

Cause

The vulnerability resides in the Linux kernel's EROFS filesystem driver. When processing uncompressed pclusters, the driver failed to validate the extent length. A specially crafted filesystem image could provide a logical extent length that exceeds the physical length, leading to out-of-bounds memory access [1].

Exploitation

An attacker with the ability to mount a malicious EROFS image (e.g., via a crafted filesystem or a malicious storage device) can trigger the bug. The bug is reachable through the erofs_read_metabuf path. No special privileges beyond the ability to mount an EROFS filesystem are required; the attack surface is local, requiring physical access or a compromised storage medium [1].

Impact

Successful exploitation results in a use-after-free condition, which can lead to memory corruption, system crash (denial of service), or potentially privilege escalation if the attacker can control the freed memory [1]. The KASAN report confirms the use-after-free nature of the bug.

Mitigation

The fix was committed to the Linux kernel stable tree in commit dc8b6bd587b13b85 [1]. Users should update to a kernel version containing this patch. No workaround is available; the only mitigation is to apply the kernel update.