CVE-2022-50346

MEDIUM EPSS 4.5%
Published Sep 16, 20259mo ago · Modified Jun 17, 20262w ago
5.5 CVSS 3.1
Medium
Find Similar
Published Sep 16, 2025 9mo ago
Last Modified Jun 17, 2026 2w ago

Description

In the Linux kernel, the following vulnerability has been resolved: ext4: init quota for 'old.inode' in 'ext4_rename' Syzbot found the following issue: ext4_parse_param: s_want_extra_isize=128 ext4_inode_info_init: s_want_extra_isize=32 ext4_rename: old.inode=ffff88823869a2c8 old.dir=ffff888238699828 new.inode=ffff88823869d7e8 new.dir=ffff888238699828 __ext4_mark_inode_dirty: inode=ffff888238699828 ea_isize=32 want_ea_size=128 __ext4_mark_inode_dirty: inode=ffff88823869a2c8 ea_isize=32 want_ea_size=128 ext4_xattr_block_set: inode=ffff88823869a2c8 ------------[ cut here ]------------ WARNING: CPU: 13 PID: 2234 at fs/ext4/xattr.c:2070 ext4_xattr_block_set.cold+0x22/0x980 Modules linked in: RIP: 0010:ext4_xattr_block_set.cold+0x22/0x980 RSP: 0018:ffff888227d3f3b0 EFLAGS: 00010202 RAX: 0000000000000001 RBX: ffff88823007a000 RCX: 0000000000000000 RDX: 0000000000000a03 RSI: 0000000000000040 RDI: ffff888230078178 RBP: 0000000000000000 R08: 000000000000002c R09: ffffed1075c7df8e R10: ffff8883ae3efc6b R11: ffffed1075c7df8d R12: 0000000000000000 R13: ffff88823869a2c8 R14: ffff8881012e0460 R15: dffffc0000000000 FS: 00007f350ac1f740(0000) GS:ffff8883ae200000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f350a6ed6a0 CR3: 0000000237456000 CR4: 00000000000006e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> ? ext4_xattr_set_entry+0x3b7/0x2320 ? ext4_xattr_block_set+0x0/0x2020 ? ext4_xattr_set_entry+0x0/0x2320 ? ext4_xattr_check_entries+0x77/0x310 ? ext4_xattr_ibody_set+0x23b/0x340 ext4_xattr_move_to_block+0x594/0x720 ext4_expand_extra_isize_ea+0x59a/0x10f0 __ext4_expand_extra_isize+0x278/0x3f0 __ext4_mark_inode_dirty.cold+0x347/0x410 ext4_rename+0xed3/0x174f vfs_rename+0x13a7/0x2510 do_renameat2+0x55d/0x920 __x64_sys_rename+0x7d/0xb0 do_syscall_64+0x3b/0xa0 entry_SYSCALL_64_after_hwframe+0x72/0xdc As 'ext4_rename' will modify 'old.inode' ctime and mark inode dirty, which may trigger expand 'extra_isize' and allocate block. If inode didn't init quota will lead to warning. To solve above issue, init 'old.inode' firstly in 'ext4_rename'.

CVSS Details

Base Score
5.5
Exploitability
1.8
Impact
3.6
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack Vector Local
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality None
Integrity None
Availability High

Threat Intelligence

EPSS Exploit Probability
4.5% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-908

Affected Products 8

VendorProductVersionRange
linuxlinux_kernel* <4.9.337
linuxlinux_kernel*≥4.10  –  <4.14.303
linuxlinux_kernel*≥4.15  –  <4.19.270
linuxlinux_kernel*≥4.20  –  <5.4.229
linuxlinux_kernel*≥5.5  –  <5.10.163
linuxlinux_kernel*≥5.11  –  <5.15.87
linuxlinux_kernel*≥5.16  –  <6.0.18
linuxlinux_kernel*≥6.1  –  <6.1.4

References 9

  • git.kernel.org https://git.kernel.org/stable/c/13271fbbe85d73a7c47058f56a52f2a7f00d6e39
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/135ba9146f4d38abed48a540ef8a8770ff0bd34f
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/33fd7031d634f3b46e59f61adfbb0ea9fe514fef
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/67f6d5a4043f3db0c6bb0e14a0d97a7be8bfb8b5
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/7dfb8259f66faafa68d23a261b284d2c2c67649b
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/84a2f2ed49d6a4d92b354219077434c57d334620
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/def7a39091e60e1c4a2f623629082a00092602be
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/f263e349bacc2f303526dcfa61c4bc50132418b1
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/fae381a3d79bb94aa2eb752170d47458d778b797
    Patch

Remediation

  • git.kernel.org https://git.kernel.org/stable/c/13271fbbe85d73a7c47058f56a52f2a7f00d6e39
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/135ba9146f4d38abed48a540ef8a8770ff0bd34f
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/33fd7031d634f3b46e59f61adfbb0ea9fe514fef
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/67f6d5a4043f3db0c6bb0e14a0d97a7be8bfb8b5
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/7dfb8259f66faafa68d23a261b284d2c2c67649b
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/84a2f2ed49d6a4d92b354219077434c57d334620
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/def7a39091e60e1c4a2f623629082a00092602be
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/f263e349bacc2f303526dcfa61c4bc50132418b1
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/fae381a3d79bb94aa2eb752170d47458d778b797
    Patch