CVE-2022-49762

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

ntfs: check overflow when iterating ATTR_RECORDs

Kernel iterates over ATTR_RECORDs in mft record in ntfs_attr_find(). Because the ATTR_RECORDs are next to each other, kernel can get the next ATTR_RECORD from end address of current ATTR_RECORD, through current ATTR_RECORD length field.

The problem is that during iteration, when kernel calculates the end address of current ATTR_RECORD, kernel may trigger an integer overflow bug in executing `a = (ATTR_RECORD*)((u8*)a + le32_to_cpu(a->length))`. This may wrap, leading to a forever iteration on 32bit systems.

This patch solves it by adding some checks on calculating end address of current ATTR_RECORD during iteration.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected software

VendorProductVersions
LinuxLinux>= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 5559eb5809353a83a40a1e4e7f066431c7b83020; >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 86f36de14dce5802856bb7a5921d74439db00b64; >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 45683723f6b53e39e8a4cec0894e61fd6ec71989; >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < b612f924f296408d7d02fb4cd01218afd4ed7184; >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 957732a09c3828267c2819d31c425aa793dd475b; >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < b63ddb3ba61e2d3539f87e095c881e552bc45dab; >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 785b2af9654b8beac55644e36da0085c5d776361; >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 63095f4f3af59322bea984a6ae44337439348fe0
LinuxLinux2.6.12

References

Timeline

Published
May 1, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2022

CVE-2022-497637.8In the Linux kernel, the following vulnerability has been resolved: ntfs: fix use-after-free in ntfs_attr_find() Patch series "ntfs: fix bCVE-2022-497645.5In the Linux kernel, the following vulnerability has been resolved: bpf: Prevent bpf program recursion for raw tracepoint probes We got reCVE-2022-497655.5In the Linux kernel, the following vulnerability has been resolved: net/9p: use a dedicated spinlock for trans_fd Shamelessly copying the CVE-2022-497665.5In the Linux kernel, the following vulnerability has been resolved: netlink: Bounds-check struct nlmsgerr creation In preparation for FORTCVE-2022-497675.5In the Linux kernel, the following vulnerability has been resolved: 9p/trans_fd: always use O_NONBLOCK read/write syzbot is reporting hungCVE-2022-497685.5In the Linux kernel, the following vulnerability has been resolved: 9p: trans_fd/p9_conn_cancel: drop client lock earlier syzbot reported CVE-2022-497695.5In the Linux kernel, the following vulnerability has been resolved: gfs2: Check sb_bsize_shift after reading superblock Fuzzers like to scCVE-2022-497707.8In the Linux kernel, the following vulnerability has been resolved: ceph: avoid putting the realm twice when decoding snaps fails When decCVE-2022-497714.7In the Linux kernel, the following vulnerability has been resolved: dm ioctl: fix misbehavior if list_versions races with module loading _CVE-2022-497725.5In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Drop snd_BUG_ON() from snd_usbmidi_output_open() snd_CVE-2022-497735.5In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix optc2_configure warning on dcn314 [Why] dcn314 usCVE-2022-497745.5In the Linux kernel, the following vulnerability has been resolved: KVM: x86/xen: Fix eventfd error handling in kvm_xen_eventfd_assign() S
CVE-2022-49762: Medium severity, CVSS 5.5 | Vulnix