CVE-2022-50673— Linux kernel 安全漏洞
Possible ATT&CK Techniques 1AI
T1053 · Scheduled Task/JobAffected Version Matrix 16
| ベンダー | プロダクト | Version Range | ステータス |
|---|---|---|---|
| Linux | Linux | 2c98eb5ea249767bbc11cf4e70e91d5b0458ed13< 7f801a1593cb957f73659732836b2dafbdfc7709 | affected |
2c98eb5ea249767bbc11cf4e70e91d5b0458ed13< 026a4490b5381229a30f23d073b58e8e35ee6858 | affected | ||
2c98eb5ea249767bbc11cf4e70e91d5b0458ed13< 7223d5e75f26352354ea2c0ccf8b579821b52adf | affected | ||
2c98eb5ea249767bbc11cf4e70e91d5b0458ed13< cf0e0817b0f925b70d101d7014ea81b7094e1159 | affected | ||
2c98eb5ea249767bbc11cf4e70e91d5b0458ed13< c2bdbd4c69308835d1b6f6ba74feeccbfe113478 | affected | ||
2c98eb5ea249767bbc11cf4e70e91d5b0458ed13< 7908b8a541b1578cc61b4da7f19b604a931441da | affected | ||
2c98eb5ea249767bbc11cf4e70e91d5b0458ed13< a71248b1accb2b42e4980afef4fa4a27fa0e36f5 | affected | ||
4.10 | affected | ||
| … +8 more rows | |||
新しい脆弱性情報の通知を購読するログインして購読
I. CVE-2022-50673の基本情報
脆弱性情報
脆弱性についてご質問がありますか？Shenlongの分析が参考になるかご確認ください！
Shenlongの10の質問を表示 ↗ 高度な大規模言語モデル技術を使用していますが、出力には不正確または古い情報が含まれる可能性があります。Shenlongはデータの正確性を確保するよう努めていますが、実際の状況に基づいて検証・判断してください。
脆弱性タイトル
ext4: fix use-after-free in ext4_orphan_cleanup
ソース: CVE Program / CVE List V5
脆弱性説明
In the Linux kernel, the following vulnerability has been resolved: ext4: fix use-after-free in ext4_orphan_cleanup I caught a issue as follows: ================================================================== BUG: KASAN: use-after-free in __list_add_valid+0x28/0x1a0 Read of size 8 at addr ffff88814b13f378 by task mount/710 CPU: 1 PID: 710 Comm: mount Not tainted 6.1.0-rc3-next #370 Call Trace: <TASK> dump_stack_lvl+0x73/0x9f print_report+0x25d/0x759 kasan_report+0xc0/0x120 __asan_load8+0x99/0x140 __list_add_valid+0x28/0x1a0 ext4_orphan_cleanup+0x564/0x9d0 [ext4] __ext4_fill_super+0x48e2/0x5300 [ext4] ext4_fill_super+0x19f/0x3a0 [ext4] get_tree_bdev+0x27b/0x450 ext4_get_tree+0x19/0x30 [ext4] vfs_get_tree+0x49/0x150 path_mount+0xaae/0x1350 do_mount+0xe2/0x110 __x64_sys_mount+0xf0/0x190 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x63/0xcd </TASK> [...] ================================================================== Above issue may happen as follows: ------------------------------------- ext4_fill_super ext4_orphan_cleanup --- loop1: assume last_orphan is 12 --- list_add(&EXT4_I(inode)->i_orphan, &EXT4_SB(sb)->s_orphan) ext4_truncate --> return 0 ext4_inode_attach_jinode --> return -ENOMEM iput(inode) --> free inode<12> --- loop2: last_orphan is still 12 --- list_add(&EXT4_I(inode)->i_orphan, &EXT4_SB(sb)->s_orphan); // use inode<12> and trigger UAF To solve this issue, we need to propagate the return value of ext4_inode_attach_jinode() appropriately.
ソース: CVE Program / CVE List V5
CVSS情報
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
ソース: CVE Program / CVE List V5
脆弱性タイプ
N/A
ソース: CVE Program / CVE List V5
脆弱性タイトル
Linux kernel 安全漏洞
ソース: CNNVD (China National Vulnerability Database)
脆弱性説明
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于ext4_orphan_cleanup中存在释放后重用问题。
ソース: CNNVD (China National Vulnerability Database)
CVSS情報
N/A
ソース: CNNVD (China National Vulnerability Database)
脆弱性タイプ
N/A
ソース: CNNVD (China National Vulnerability Database)
影響を受ける製品
II. CVE-2022-50673の公開POC
| # | POC説明 | ソースリンク | Shenlongリンク |
|---|
AI生成POCプレミアム
公開POCは見つかりませんでした。
ログインしてAI POCを生成III. CVE-2022-50673のインテリジェンス情報
请登录查看更多情报信息。
Same Patch Batch · Linux · 2025-12-09 · 152 CVEs total
| CVE-2025-40343 | 9.8 CRITICAL | nvmet-fc: avoid scheduling association deletion twice |
| CVE-2023-53794 | 9.8 CRITICAL | cifs: fix session state check in reconnect to avoid use-after-free issue |
| CVE-2022-50666 | 9.8 CRITICAL | RDMA/siw: Fix QP destroy to wait for all references dropped. |
| CVE-2023-53827 | 8.8 HIGH | Bluetooth: L2CAP: Fix use-after-free in l2cap_disconnect_{req,rsp} |
| CVE-2023-53785 | 8.8 HIGH | mt76: mt7921: don't assume adequate headroom for SDIO headers |
| CVE-2023-53822 | 8.8 HIGH | wifi: ath11k: Ignore frags from uninitialized peer in dp. |
| CVE-2025-40336 | 8.8 HIGH | drm/gpusvm: fix hmm_pfn_to_map_order() usage |
| CVE-2025-40342 | 8.8 HIGH | nvme-fc: use lock accessing port_state and rport state |
| CVE-2025-40328 | 8.8 HIGH | smb: client: fix potential UAF in smb2_close_cached_fid() |
| CVE-2023-53851 | 8.4 HIGH | drm/msm/dp: Drop aux devices together with DP controller |
| CVE-2025-40337 | 8.2 HIGH | net: stmmac: Correctly handle Rx checksum offload errors |
| CVE-2023-53803 | 8.1 HIGH | scsi: ses: Fix slab-out-of-bounds in ses_enclosure_data_process() |
| CVE-2022-50656 | 8.1 HIGH | nfc: pn533: Clear nfc_target before being used |
| CVE-2023-53804 | 7.8 HIGH | nilfs2: fix use-after-free bug of nilfs_root in nilfs_evict_inode() |
| CVE-2023-53819 | 7.8 HIGH | amdgpu: validate offset_in_bo of drm_amdgpu_gem_va |
| CVE-2023-53816 | 7.8 HIGH | drm/amdkfd: fix potential kgd_mem UAFs |
| CVE-2023-53800 | 7.8 HIGH | ubi: Fix use-after-free when volume resizing failed |
| CVE-2023-53790 | 7.8 HIGH | bpf: Zeroing allocated object from slab in bpf memory allocator |
| CVE-2023-53795 | 7.8 HIGH | iommufd: IOMMUFD_DESTROY should not increase the refcount |
| CVE-2023-53810 | 7.8 HIGH | blk-mq: release crypto keyslot before reporting I/O complete |
Showing 20 of 152 CVEs. View all on vendor page →
IV. 関連脆弱性
同じ製品: Linux
- CVE-2026-68450
btrfs: free mapping node on duplicate reloc root insert - CVE-2026-68449
ata: sata_dwc_460ex: fix infinite loop in NCQ tag completion - CVE-2026-68448
ovl: check access to copy_file_range source with src mounter - CVE-2026-68447
drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to B - CVE-2026-68446
drm/vmwgfx: Validate vmw_surface_metadata::array_size
同じベンダー: Linux
- CVE-2026-68450
btrfs: free mapping node on duplicate reloc root insert - CVE-2026-68449
ata: sata_dwc_460ex: fix infinite loop in NCQ tag completion - CVE-2026-68448
ovl: check access to copy_file_range source with src mounter - CVE-2026-68447
drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to B - CVE-2026-68446
drm/vmwgfx: Validate vmw_surface_metadata::array_size
V. CVE-2022-50673へのコメント
まだコメントはありません