Critical Crash Vulnerability in Linux Kernel's OCFS2 Package
Summary
CVE-2022-49274: In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix crash when mount with quota enabled There is a reported crash when mounting ocfs2 with quota enabled. Affects linux versions < 5.17.3-1. Fixed in 5.17.3-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services for all hardware and software. The OCFS2 (Oracle Cluster File System 2) is a shared disk file system designed for use in a cluster environment. It allows multiple servers to access the same storage concurrently, making it crucial for high-availability applications. However, a vulnerability has been identified that can lead to a crash when mounting OCFS2 with quotas enabled, potentially disrupting services and data access.
Vulnerability Detail
The vulnerability, identified as CVE-2022-49274, originates from an improper initialization of certain variables in the OCFS2 file system. Specifically, when the quota feature is enabled, the system may crash due to uninitialized variables in the quota information structure. This issue was introduced by a commit aimed at preventing access to uninitialized variables during error handling. The crash occurs during the mounting process, which can lead to service interruptions and data accessibility issues in environments relying on OCFS2.
How To Fix
Minimum fixed version
5.17.3-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable the quota feature when mounting OCFS2 until the system is updated to the patched version. This can be done by using the mount command without the quota option: mount -t ocfs2 /dev/sdX /mountpoint.
Conclusion
CVE-2022-49274 represents a significant risk for systems utilizing the OCFS2 file system with quotas enabled. It is crucial for users to apply the necessary updates to mitigate this vulnerability and ensure system stability. By following the outlined steps for updating and utilizing workarounds, users can protect their systems from potential crashes.
See every vulnerability recorded for linux →
FAQ
CVE-2022-49274 is a vulnerability in the Linux kernel's OCFS2 file system that can cause a crash when mounting with quotas enabled.
If your system uses the OCFS2 file system with quotas enabled, it may crash during the mounting process, leading to potential service disruptions.
Yes, a patch is available in version 5.17.3-1 of the Linux kernel. Users should update to this version or later.
Yes, you can use Vulert's playground at Vulert Scanner to check if your application is affected without needing to sign up.
As a temporary measure, you can disable the quota feature when mounting OCFS2 to avoid triggering the crash.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
