CVE-2022-50864

Vulnerability

In the Linux kernel's nilfs2 filesystem, the superblock field s_log_block_size is used to compute the block size via a left-shift operation. If this field is corrupted to an excessively large value, the shift overflows a 32-bit integer, causing a shift-out-of-bounds undefined behavior. This triggers a kernel panic if panic_on_warn is set [1][2].

Exploitation

An attacker with the ability to mount a maliciously crafted nilfs2 filesystem—for example, via a USB drive or a network filesystem—can exploit this by providing a superblock with an abnormally large s_log_block_size. No authentication beyond mount privileges is required; the attack surface is local or physical access to mount a filesystem.

Impact

The kernel panics, resulting in a denial of service. The description does not indicate any code execution or data corruption beyond the panic.

Mitigation

The fix introduces a helper function that validates the block size exponent before performing the shift, preventing the out-of-bounds condition. Patches are available in the stable kernel trees [1][2]. Users should apply the latest kernel updates to mitigate this vulnerability.