CVE-2022-49343

In the Linux kernel, the following vulnerability has been resolved:

ext4: avoid cycles in directory h-tree

A maliciously corrupted filesystem can contain cycles in the h-tree stored inside a directory. That can easily lead to the kernel corrupting tree nodes that were already verified under its hands while doing a node split and consequently accessing unallocated memory. Fix the problem by verifying traversed block numbers are unique.

This vulnerability is rated as Low severity for Red Hat Enterprise Linux because exploitation requires mounting a maliciously crafted storage image, an action that requires administrative privileges in standard enterprise deployments. Unprivileged local users cannot trigger this condition under default system configurations unless explicitly granted mount privileges or access to unprivileged user namespaces. Even if triggered by a privileged user or through compromised media, the issue causes memory corruption that results in a system crash, limiting the impact to local denial of service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.