CVE-2022-50746

In the Linux kernel, the following vulnerability has been resolved:

erofs: validate the extent length for uncompressed pclusters

syzkaller reported a KASAN use-after-free: https://syzkaller.appspot.com/bug?extid=2ae90e873e97f1faf6f2

The referenced fuzzed image actually has two issues:

• m_pa == 0 as a non-inlined pcluster;
• The logical length is longer than its physical length.

The first issue has already been addressed. This patch addresses the second issue by checking the extent length validity.

In EROFS compressed layout code z_erofs_do_map_blocks handles plain uncompressed pclusters. A crafted filesystem image can provide an extent where the logical length map m_llen is larger than the physical length map m_plen. This breaks internal assumptions about valid mapping ranges and can cause subsequent code to access memory or buffers based on inconsistent lengths. Syzkaller reported a KASAN use after free in this area (read). A local attacker can mount or otherwise cause the kernel to parse a crafted EROFS image. In many environments mounting requires CAP_SYS_ADMIN. However parsing may also happen indirectly in privileged contexts such as system image handling.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.