{
  "cveId": "CVE-2022-49007",
  "url": "https://patchblox.com/security/cve/CVE-2022-49007",
  "summary": "CVE-2022-49007 is fixed in linux on 1 platform, first by DEBIAN-CVE-2022-49007, released October 21, 2024. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  nilfs2: fix NULL pointer dereference in nilfs_pa...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  nilfs2: fix NULL pointer dereference in nilfs_palloc_commit_free_entry()  Syzbot reported a null-ptr-deref bug:   NILFS (loop0): segctord starting. Construction interval = 5 seconds, CP  frequency \u003C 30 seconds  general protection fault, probably for non-canonical address  0xdffffc0000000002: 0000 [#1] PREEMPT SMP KASAN  KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]  CPU: 1 PID: 3603 Comm: segctord Not tainted  6.1.0-rc2-syzkaller-00105-gb229b6ca5abb #0  Hardware name: Google Compute Engine/Google Compute Engine, BIOS Google  10/11/2022  RIP: 0010:nilfs_palloc_commit_free_entry\u002B0xe5/0x6b0  fs/nilfs2/alloc.c:608  Code: 00 00 00 00 fc ff df 80 3c 02 00 0f 85 cd 05 00 00 48 b8 00 00 00  00 00 fc ff df 4c 8b 73 08 49 8d 7e 10 48 89 fa 48 c1 ea 03 \u003C80\u003E 3c 02  00 0f 85 26 05 00 00 49 8b 46 10 be a6 00 00 00 48 c7 c7  RSP: 0018:ffffc90003dff830 EFLAGS: 00010212  RAX: dffffc0000000000 RBX: ffff88802594e218 RCX: 000000000000000d  RDX: 0000000000000002 RSI: 0000000000002000 RDI: 0000000000000010  RBP: ffff888071880222 R08: 0000000000000005 R09: 000000000000003f  R10: 000000000000000d R11: 0000000000000000 R12: ffff888071880158  R13: ffff88802594e220 R14: 0000000000000000 R15: 0000000000000004  FS:  0000000000000000(0000) GS:ffff8880b9b00000(0000)  knlGS:0000000000000000  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033  CR2: 00007fb1c08316a8 CR3: 0000000018560000 CR4: 0000000000350ee0  Call Trace:   \u003CTASK\u003E   nilfs_dat_commit_free fs/nilfs2/dat.c:114 [inline]   nilfs_dat_commit_end\u002B0x464/0x5f0 fs/nilfs2/dat.c:193   nilfs_dat_commit_update\u002B0x26/0x40 fs/nilfs2/dat.c:236   nilfs_btree_commit_update_v\u002B0x87/0x4a0 fs/nilfs2/btree.c:1940   nilfs_btree_commit_propagate_v fs/nilfs2/btree.c:2016 [inline]   nilfs_btree_propagate_v fs/nilfs2/btree.c:2046 [inline]   nilfs_btree_propagate\u002B0xa00/0xd60 fs/nilfs2/btree.c:2088   nilfs_bmap_propagate\u002B0x73/0x170 fs/nilfs2/bmap.c:337   nilfs_collect_file_data\u002B0x45/0xd0 fs/nilfs2/segment.c:568   nilfs_segctor_apply_buffers\u002B0x14a/0x470 fs/nilfs2/segment.c:1018   nilfs_segctor_scan_file\u002B0x3f4/0x6f0 fs/nilfs2/segment.c:1067   nilfs_segctor_collect_blocks fs/nilfs2/segment.c:1197 [inline]   nilfs_segctor_collect fs/nilfs2/segment.c:1503 [inline]   nilfs_segctor_do_construct\u002B0x12fc/0x6af0 fs/nilfs2/segment.c:2045   nilfs_segctor_construct\u002B0x8e3/0xb30 fs/nilfs2/segment.c:2379   nilfs_segctor_thread_construct fs/nilfs2/segment.c:2487 [inline]   nilfs_segctor_thread\u002B0x3c3/0xf30 fs/nilfs2/segment.c:2570   kthread\u002B0x2e4/0x3a0 kernel/kthread.c:376   ret_from_fork\u002B0x1f/0x30 arch/x86/entry/entry_64.S:306   \u003C/TASK\u003E  ...  If DAT metadata file is corrupted on disk, there is a case where req-\u003Epr_desc_bh is NULL and blocknr is 0 at nilfs_dat_commit_end() during a b-tree operation that cascadingly updates ancestor nodes of the b-tree, because nilfs_dat_commit_alloc() for a lower level block can initialize the blocknr on the same DAT entry between nilfs_dat_prepare_end() and nilfs_dat_commit_end().  If this happens, nilfs_dat_commit_end() calls nilfs_dat_commit_free() without valid buffer heads in req-\u003Epr_desc_bh and req-\u003Epr_bitmap_bh, and causes the NULL pointer dereference above in nilfs_palloc_commit_free_entry() function, which leads to a crash.  Fix this by adding a NULL check on req-\u003Epr_desc_bh and req-\u003Epr_bitmap_bh before nilfs_palloc_commit_free_entry() in nilfs_dat_commit_free().  This also calls nilfs_error() in that case to notify that there is a fatal flaw in the filesystem metadata and prevent further operations.",
  "published": "2024-10-21T20:15:12Z",
  "severity": "medium",
  "cvss": 5.5,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
  "epss": 0.00249,
  "epssPercentile": 0.16271,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "6.0.12-1",
      "fix": "DEBIAN-CVE-2022-49007",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-49007",
      "released": "2024-10-21T20:15:12Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "6.0.12-1",
      "fix": "DEBIAN-CVE-2022-49007",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-49007",
      "released": "2024-10-21T20:15:12Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "6.0.12-1",
      "fix": "DEBIAN-CVE-2022-49007",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-49007",
      "released": "2024-10-21T20:15:12Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T00:53:09Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}