In the Linux kernel, the following vulnerability has been resolved: ext4: avoid cycles in directory h-tree A maliciously corrupted filesystem can contain cycles in the h-tree stored inside a directory. That can easily lead to the kernel corrupting tree nodes that were already verified under its hands while doing a node split and consequently accessing unallocated memory. Fix the problem by verifying traversed block numbers are unique.

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Affected Vendors & Products

Vendors Products
Redhat
  • Enterprise Linux

No data.

Package CPE Advisory Released Date
Red Hat Enterprise Linux 8
kernel-0:4.18.0-425.3.1.el8 cpe:/o:redhat:enterprise_linux:8 RHSA-2022:7683 2022-11-08T00:00:00Z
Red Hat Enterprise Linux 9
kernel-0:5.14.0-162.6.1.el9_1 cpe:/a:redhat:enterprise_linux:9 RHSA-2022:8267 2022-11-15T00:00:00Z
kernel-0:5.14.0-162.6.1.el9_1 cpe:/o:redhat:enterprise_linux:9 RHSA-2022:8267 2022-11-15T00:00:00Z
References
Link Providers
https://git.kernel.org/stable/c/24b8206fec1db21d7e82f21f0b2ff5e5672cf5b3 cve-icon cve-icon
https://git.kernel.org/stable/c/3a3ce941645407cd0b0b7f01ad9e2ea3770f46cc cve-icon cve-icon
https://git.kernel.org/stable/c/3ba733f879c2a88910744647e41edeefbc0d92b2 cve-icon cve-icon
https://git.kernel.org/stable/c/6084240bfc44bf265ab6ae7d96980469b05be0f1 cve-icon cve-icon
https://git.kernel.org/stable/c/b3ad9ff6f06c1dc6abf7437691c88ca3d6da3ac0 cve-icon cve-icon
https://git.kernel.org/stable/c/d5a16a6df2c16eaf4de04948553ef0089dee463f cve-icon cve-icon
https://git.kernel.org/stable/c/e157c8f87e8fac112d6c955e69a60cdb9bc80a60 cve-icon cve-icon
https://git.kernel.org/stable/c/ff4cafa51762da3824881a9000ca421d4b78b138 cve-icon cve-icon
https://lore.kernel.org/linux-cve-announce/2025022641-CVE-2022-49343-bddc@gregkh/T cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2022-49343 cve-icon
https://www.cve.org/CVERecord?id=CVE-2022-49343 cve-icon
History

Sat, 10 May 2025 03:30:00 +0000

Type Values Removed Values Added
First Time appeared Redhat
Redhat enterprise Linux
CPEs cpe:/a:redhat:enterprise_linux:9
cpe:/o:redhat:enterprise_linux:8
cpe:/o:redhat:enterprise_linux:9
Vendors & Products Redhat
Redhat enterprise Linux

Fri, 28 Feb 2025 01:30:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Low

Wed, 26 Feb 2025 02:45:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: ext4: avoid cycles in directory h-tree A maliciously corrupted filesystem can contain cycles in the h-tree stored inside a directory. That can easily lead to the kernel corrupting tree nodes that were already verified under its hands while doing a node split and consequently accessing unallocated memory. Fix the problem by verifying traversed block numbers are unique.
Title ext4: avoid cycles in directory h-tree
References
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2025-05-04T08:35:42.522Z

Reserved: 2025-02-26T02:08:31.542Z

Link: CVE-2022-49343

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2025-02-26T07:01:11.040

Modified: 2025-02-26T07:01:11.040

Link: CVE-2022-49343

cve-icon Redhat

Severity : Low

Publid Date: 2025-02-26T00:00:00Z

Links: CVE-2022-49343 - Bugzilla