{
  "cveId": "CVE-2022-49349",
  "url": "https://patchblox.com/security/cve/CVE-2022-49349",
  "summary": "CVE-2022-49349 is fixed in 27 products on 1 platform, first by RHSA-2022:7683, released November 8, 2022. It is not reported as exploited. Patch Radar priority: High.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  ext4: fix use-after-free in ext4_rename_dir_prep...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  ext4: fix use-after-free in ext4_rename_dir_prepare  We got issue as follows: EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue ext4_get_first_dir_block: bh-\u003Eb_data=0xffff88810bee6000 len=34478 ext4_get_first_dir_block: *parent_de=0xffff88810beee6ae bh-\u003Eb_data=0xffff88810bee6000 ext4_rename_dir_prepare: [1] parent_de=0xffff88810beee6ae ================================================================== BUG: KASAN: use-after-free in ext4_rename_dir_prepare\u002B0x152/0x220 Read of size 4 at addr ffff88810beee6ae by task rep/1895  CPU: 13 PID: 1895 Comm: rep Not tainted 5.10.0\u002B #241 Call Trace:  dump_stack\u002B0xbe/0xf9  print_address_description.constprop.0\u002B0x1e/0x220  kasan_report.cold\u002B0x37/0x7f  ext4_rename_dir_prepare\u002B0x152/0x220  ext4_rename\u002B0xf44/0x1ad0  ext4_rename2\u002B0x11c/0x170  vfs_rename\u002B0xa84/0x1440  do_renameat2\u002B0x683/0x8f0  __x64_sys_renameat\u002B0x53/0x60  do_syscall_64\u002B0x33/0x40  entry_SYSCALL_64_after_hwframe\u002B0x44/0xa9 RIP: 0033:0x7f45a6fc41c9 RSP: 002b:00007ffc5a470218 EFLAGS: 00000246 ORIG_RAX: 0000000000000108 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f45a6fc41c9 RDX: 0000000000000005 RSI: 0000000020000180 RDI: 0000000000000005 RBP: 00007ffc5a470240 R08: 00007ffc5a470160 R09: 0000000020000080 R10: 00000000200001c0 R11: 0000000000000246 R12: 0000000000400bb0 R13: 00007ffc5a470320 R14: 0000000000000000 R15: 0000000000000000  The buggy address belongs to the page: page:00000000440015ce refcount:0 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0x10beee flags: 0x200000000000000() raw: 0200000000000000 ffffea00043ff4c8 ffffea0004325608 0000000000000000 raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected  Memory state around the buggy address:  ffff88810beee580: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff  ffff88810beee600: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff \u003Effff88810beee680: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff                                   ^  ffff88810beee700: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff  ffff88810beee780: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ================================================================== Disabling lock debugging due to kernel taint ext4_rename_dir_prepare: [2] parent_de-\u003Einode=3537895424 ext4_rename_dir_prepare: [3] dir=0xffff888124170140 ext4_rename_dir_prepare: [4] ino=2 ext4_rename_dir_prepare: ent-\u003Edir-\u003Ei_ino=2 parent=-757071872  Reason is first directory entry which \u0027rec_len\u0027 is 34478, then will get illegal parent entry. Now, we do not check directory entry after read directory block in \u0027ext4_get_first_dir_block\u0027. To solve this issue, check directory entry in \u0027ext4_get_first_dir_block\u0027.  [ Trigger an ext4_error() instead of just warning if the directory is   missing a \u0027.\u0027 or \u0027..\u0027 entry.   Also make sure we return an error code   if the file system is corrupted.  -TYT ]",
  "published": "2022-11-08T00:00:00Z",
  "severity": "high",
  "cvss": 7.8,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
  "epss": 0.00291,
  "epssPercentile": 0.2175,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "bpftool",
      "release": "RHEL 8",
      "fixedVersion": "0:4.18.0-425.3.1.el8",
      "fix": "RHSA-2022:7683",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2022-7683",
      "released": "2022-11-08T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "bpftool",
      "release": "RHEL 9",
      "fixedVersion": "0:5.14.0-162.6.1.el9_1",
      "fix": "RHSA-2022:8267",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2022-8267",
      "released": "2022-11-15T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel",
      "release": "RHEL 8",
      "fixedVersion": "0:4.18.0-425.3.1.el8",
      "fix": "RHSA-2022:7683",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2022-7683",
      "released": "2022-11-08T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel",
      "release": "RHEL 9",
      "fixedVersion": "0:5.14.0-162.6.1.el9_1",
      "fix": "RHSA-2022:8267",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2022-8267",
      "released": "2022-11-15T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel-abi-stablelists",
      "release": "RHEL 8",
      "fixedVersion": "0:4.18.0-425.3.1.el8",
      "fix": "RHSA-2022:7683",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2022-7683",
      "released": "2022-11-08T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel-abi-stablelists",
      "release": "RHEL 9",
      "fixedVersion": "0:5.14.0-162.6.1.el9_1",
      "fix": "RHSA-2022:8267",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2022-8267",
      "released": "2022-11-15T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel-core",
      "release": "RHEL 8",
      "fixedVersion": "0:4.18.0-425.3.1.el8",
      "fix": "RHSA-2022:7683",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2022-7683",
      "released": "2022-11-08T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel-core",
      "release": "RHEL 9",
      "fixedVersion": "0:5.14.0-162.6.1.el9_1",
      "fix": "RHSA-2022:8267",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2022-8267",
      "released": "2022-11-15T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel-debug",
      "release": "RHEL 8",
      "fixedVersion": "0:4.18.0-425.3.1.el8",
      "fix": "RHSA-2022:7683",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2022-7683",
      "released": "2022-11-08T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel-debug",
      "release": "RHEL 9",
      "fixedVersion": "0:5.14.0-162.6.1.el9_1",
      "fix": "RHSA-2022:8267",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2022-8267",
      "released": "2022-11-15T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel-debug-core",
      "release": "RHEL 8",
      "fixedVersion": "0:4.18.0-425.3.1.el8",
      "fix": "RHSA-2022:7683",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2022-7683",
      "released": "2022-11-08T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel-debug-core",
      "release": "RHEL 9",
      "fixedVersion": "0:5.14.0-162.6.1.el9_1",
      "fix": "RHSA-2022:8267",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2022-8267",
      "released": "2022-11-15T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel-debug-devel",
      "release": "RHEL 8",
      "fixedVersion": "0:4.18.0-425.3.1.el8",
      "fix": "RHSA-2022:7683",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2022-7683",
      "released": "2022-11-08T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel-debug-devel",
      "release": "RHEL 9",
      "fixedVersion": "0:5.14.0-162.6.1.el9_1",
      "fix": "RHSA-2022:8267",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2022-8267",
      "released": "2022-11-15T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel-debug-devel-matched",
      "release": "RHEL 9",
      "fixedVersion": "0:5.14.0-162.6.1.el9_1",
      "fix": "RHSA-2022:8267",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2022-8267",
      "released": "2022-11-15T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel-debug-modules",
      "release": "RHEL 8",
      "fixedVersion": "0:4.18.0-425.3.1.el8",
      "fix": "RHSA-2022:7683",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2022-7683",
      "released": "2022-11-08T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel-debug-modules",
      "release": "RHEL 9",
      "fixedVersion": "0:5.14.0-162.6.1.el9_1",
      "fix": "RHSA-2022:8267",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2022-8267",
      "released": "2022-11-15T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel-debug-modules-extra",
      "release": "RHEL 8",
      "fixedVersion": "0:4.18.0-425.3.1.el8",
      "fix": "RHSA-2022:7683",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2022-7683",
      "released": "2022-11-08T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel-debug-modules-extra",
      "release": "RHEL 9",
      "fixedVersion": "0:5.14.0-162.6.1.el9_1",
      "fix": "RHSA-2022:8267",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2022-8267",
      "released": "2022-11-15T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel-devel",
      "release": "RHEL 8",
      "fixedVersion": "0:4.18.0-425.3.1.el8",
      "fix": "RHSA-2022:7683",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2022-7683",
      "released": "2022-11-08T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel-devel",
      "release": "RHEL 9",
      "fixedVersion": "0:5.14.0-162.6.1.el9_1",
      "fix": "RHSA-2022:8267",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2022-8267",
      "released": "2022-11-15T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel-devel-matched",
      "release": "RHEL 9",
      "fixedVersion": "0:5.14.0-162.6.1.el9_1",
      "fix": "RHSA-2022:8267",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2022-8267",
      "released": "2022-11-15T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel-doc",
      "release": "RHEL 8",
      "fixedVersion": "0:4.18.0-425.3.1.el8",
      "fix": "RHSA-2022:7683",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2022-7683",
      "released": "2022-11-08T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel-doc",
      "release": "RHEL 9",
      "fixedVersion": "0:5.14.0-162.6.1.el9_1",
      "fix": "RHSA-2022:8267",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2022-8267",
      "released": "2022-11-15T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel-modules",
      "release": "RHEL 8",
      "fixedVersion": "0:4.18.0-425.3.1.el8",
      "fix": "RHSA-2022:7683",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2022-7683",
      "released": "2022-11-08T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel-modules",
      "release": "RHEL 9",
      "fixedVersion": "0:5.14.0-162.6.1.el9_1",
      "fix": "RHSA-2022:8267",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2022-8267",
      "released": "2022-11-15T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel-modules-extra",
      "release": "RHEL 8",
      "fixedVersion": "0:4.18.0-425.3.1.el8",
      "fix": "RHSA-2022:7683",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2022-7683",
      "released": "2022-11-08T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel-modules-extra",
      "release": "RHEL 9",
      "fixedVersion": "0:5.14.0-162.6.1.el9_1",
      "fix": "RHSA-2022:8267",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2022-8267",
      "released": "2022-11-15T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel-tools",
      "release": "RHEL 8",
      "fixedVersion": "0:4.18.0-425.3.1.el8",
      "fix": "RHSA-2022:7683",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2022-7683",
      "released": "2022-11-08T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel-tools",
      "release": "RHEL 9",
      "fixedVersion": "0:5.14.0-162.6.1.el9_1",
      "fix": "RHSA-2022:8267",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2022-8267",
      "released": "2022-11-15T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel-tools-libs",
      "release": "RHEL 8",
      "fixedVersion": "0:4.18.0-425.3.1.el8",
      "fix": "RHSA-2022:7683",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2022-7683",
      "released": "2022-11-08T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel-tools-libs",
      "release": "RHEL 9",
      "fixedVersion": "0:5.14.0-162.6.1.el9_1",
      "fix": "RHSA-2022:8267",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2022-8267",
      "released": "2022-11-15T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel-tools-libs-devel",
      "release": "RHEL 8",
      "fixedVersion": "0:4.18.0-425.3.1.el8",
      "fix": "RHSA-2022:7683",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2022-7683",
      "released": "2022-11-08T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel-tools-libs-devel",
      "release": "RHEL 9",
      "fixedVersion": "0:5.14.0-162.6.1.el9_1",
      "fix": "RHSA-2022:8267",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2022-8267",
      "released": "2022-11-15T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel-zfcpdump",
      "release": "RHEL 8",
      "fixedVersion": "0:4.18.0-425.3.1.el8",
      "fix": "RHSA-2022:7683",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2022-7683",
      "released": "2022-11-08T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel-zfcpdump",
      "release": "RHEL 9",
      "fixedVersion": "0:5.14.0-162.6.1.el9_1",
      "fix": "RHSA-2022:8267",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2022-8267",
      "released": "2022-11-15T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel-zfcpdump-core",
      "release": "RHEL 8",
      "fixedVersion": "0:4.18.0-425.3.1.el8",
      "fix": "RHSA-2022:7683",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2022-7683",
      "released": "2022-11-08T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel-zfcpdump-core",
      "release": "RHEL 9",
      "fixedVersion": "0:5.14.0-162.6.1.el9_1",
      "fix": "RHSA-2022:8267",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2022-8267",
      "released": "2022-11-15T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel-zfcpdump-devel",
      "release": "RHEL 8",
      "fixedVersion": "0:4.18.0-425.3.1.el8",
      "fix": "RHSA-2022:7683",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2022-7683",
      "released": "2022-11-08T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel-zfcpdump-devel",
      "release": "RHEL 9",
      "fixedVersion": "0:5.14.0-162.6.1.el9_1",
      "fix": "RHSA-2022:8267",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2022-8267",
      "released": "2022-11-15T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel-zfcpdump-devel-matched",
      "release": "RHEL 9",
      "fixedVersion": "0:5.14.0-162.6.1.el9_1",
      "fix": "RHSA-2022:8267",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2022-8267",
      "released": "2022-11-15T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel-zfcpdump-modules",
      "release": "RHEL 8",
      "fixedVersion": "0:4.18.0-425.3.1.el8",
      "fix": "RHSA-2022:7683",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2022-7683",
      "released": "2022-11-08T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel-zfcpdump-modules",
      "release": "RHEL 9",
      "fixedVersion": "0:5.14.0-162.6.1.el9_1",
      "fix": "RHSA-2022:8267",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2022-8267",
      "released": "2022-11-15T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel-zfcpdump-modules-extra",
      "release": "RHEL 8",
      "fixedVersion": "0:4.18.0-425.3.1.el8",
      "fix": "RHSA-2022:7683",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2022-7683",
      "released": "2022-11-08T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel-zfcpdump-modules-extra",
      "release": "RHEL 9",
      "fixedVersion": "0:5.14.0-162.6.1.el9_1",
      "fix": "RHSA-2022:8267",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2022-8267",
      "released": "2022-11-15T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "5.18.5-1",
      "fix": "DEBIAN-CVE-2022-49349",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-49349",
      "released": "2025-02-26T07:01:11Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "5.18.5-1",
      "fix": "DEBIAN-CVE-2022-49349",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-49349",
      "released": "2025-02-26T07:01:11Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "5.18.5-1",
      "fix": "DEBIAN-CVE-2022-49349",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-49349",
      "released": "2025-02-26T07:01:11Z"
    },
    {
      "platform": "linux",
      "product": "perf",
      "release": "RHEL 8",
      "fixedVersion": "0:4.18.0-425.3.1.el8",
      "fix": "RHSA-2022:7683",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2022-7683",
      "released": "2022-11-08T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "perf",
      "release": "RHEL 9",
      "fixedVersion": "0:5.14.0-162.6.1.el9_1",
      "fix": "RHSA-2022:8267",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2022-8267",
      "released": "2022-11-15T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "python3-perf",
      "release": "RHEL 8",
      "fixedVersion": "0:4.18.0-425.3.1.el8",
      "fix": "RHSA-2022:7683",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2022-7683",
      "released": "2022-11-08T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "python3-perf",
      "release": "RHEL 9",
      "fixedVersion": "0:5.14.0-162.6.1.el9_1",
      "fix": "RHSA-2022:8267",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2022-8267",
      "released": "2022-11-15T00:00:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T13:06:02Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}