{"id":"CVE-2022-50306","state":"PUBLISHED","title":"ext4: fix potential out of bound read in ext4_fc_replay_scan()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix potential out of bound read in ext4_fc_replay_scan()\n\nFor scan loop must ensure that at least EXT4_FC_TAG_BASE_LEN space. If remain\nspace less than EXT4_FC_TAG_BASE_LEN which will lead to out of bound read\nwhen mounting corrupt file system image.\nADD_RANGE/HEAD/TAIL is needed to add extra check when do journal scan, as this\nthree tags will read data during scan, tag length couldn't less than data length\nwhich will read.","publishedAt":"2025-09-15T14:46:01.672Z","updatedAt":"2026-08-05T08:58:07.756Z","severity":{"score":7.1,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"8016e29f4362e285f0f7e38fadc61a5b7bdfdfa2","status":"affected","lessThan":"6969367c1500c15eddc38fda12f6d15518ad6d03","versionType":"git"},{"version":"8016e29f4362e285f0f7e38fadc61a5b7bdfdfa2","status":"affected","lessThan":"f234294812c9b68d603650d28743eafb718e7ad5","versionType":"git"},{"version":"8016e29f4362e285f0f7e38fadc61a5b7bdfdfa2","status":"affected","lessThan":"1b45cc5c7b920fd8bf72e5a888ec7abeadf41e09","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/ext4/fast_commit.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.10","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.10","versionType":"semver"},{"version":"5.15.87","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.0.6","status":"unaffected","lessThanOrEqual":"6.0.*","versionType":"semver"},{"version":"6.1","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/ext4/fast_commit.c"]}],"references":["https://git.kernel.org/stable/c/6969367c1500c15eddc38fda12f6d15518ad6d03","https://git.kernel.org/stable/c/f234294812c9b68d603650d28743eafb718e7ad5","https://git.kernel.org/stable/c/1b45cc5c7b920fd8bf72e5a888ec7abeadf41e09"],"weaknesses":[],"ingestedAt":"2026-10-29T20:05:26.763Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2022/50xxx/CVE-2022-50306.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2022-50306","state":"PUBLISHED","datePublished":"2025-09-15T14:46:01.672Z","dateUpdated":"2026-08-05T08:58:07.756Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2025-09-15T14:18:36.813Z"},"containers":{"cna":{"title":"ext4: fix potential out of bound read in ext4_fc_replay_scan()","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix potential out of bound read in ext4_fc_replay_scan()\n\nFor scan loop must ensure that at least EXT4_FC_TAG_BASE_LEN space. If remain\nspace less than EXT4_FC_TAG_BASE_LEN which will lead to out of bound read\nwhen mounting corrupt file system image.\nADD_RANGE/HEAD/TAIL is needed to add extra check when do journal scan, as this\nthree tags will read data during scan, tag length couldn't less than data length\nwhich will read."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"8016e29f4362e285f0f7e38fadc61a5b7bdfdfa2","status":"affected","lessThan":"6969367c1500c15eddc38fda12f6d15518ad6d03","versionType":"git"},{"version":"8016e29f4362e285f0f7e38fadc61a5b7bdfdfa2","status":"affected","lessThan":"f234294812c9b68d603650d28743eafb718e7ad5","versionType":"git"},{"version":"8016e29f4362e285f0f7e38fadc61a5b7bdfdfa2","status":"affected","lessThan":"1b45cc5c7b920fd8bf72e5a888ec7abeadf41e09","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/ext4/fast_commit.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.10","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.10","versionType":"semver"},{"version":"5.15.87","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.0.6","status":"unaffected","lessThanOrEqual":"6.0.*","versionType":"semver"},{"version":"6.1","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/ext4/fast_commit.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/6969367c1500c15eddc38fda12f6d15518ad6d03"},{"url":"https://git.kernel.org/stable/c/f234294812c9b68d603650d28743eafb718e7ad5"},{"url":"https://git.kernel.org/stable/c/1b45cc5c7b920fd8bf72e5a888ec7abeadf41e09"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","baseScore":7.1,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - Triggered only when mounting a crafted ext4 image with a dirty fast-commit journal; the path is local VFS mount → jbd2_journal_load → fc_do_one_pass → ext4_fc_replay_scan(), not reachable via network packet processing.\nAC:L - The attacker fully controls the on-disk fast-commit tags, lengths, and journal dirty state in the image, so the OOB read is reliably triggered on mount with no conditions outside their control.\nPR:N - Highest-severity scenario is supplying a malicious filesystem image (USB/SD/cloud disk) that a privileged victim mounts; the attacker needs no privileges of their own. ext4 lacks FS_USERNS_MOUNT, so this is not a self-mount-by-unprivileged-userns case.\nUI:R - Exploitation requires a user or automount path to mount the malicious ext4 filesystem image, which is the interaction that reaches journal recovery and the vulnerable scan loop.\nS:U - Impact is confined to the host kernel authority that performs the mount; there is no VM/IOMMU/sandbox boundary crossing.\nC:H - This is an out-of-bounds read of journal buffer memory; attacker-controlled fc_len (u16) can cause checksum/tag parsing to read far beyond the block (not a few-byte bound), which per guidance scores Confidentiality High.\nI:N - The bug is a pure out-of-bounds read with no write primitive, heap corruption, or control-flow hijack; scanned OOB data only feeds local CRC/region logic and does not modify attacker-controlled kernel state for integrity compromise.\nA:H - Reading past the journal block into unmapped or invalid kernel memory can oops/panic the kernel during mount, fully denying availability."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-05T08:58:07.756Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.10","versionEndExcluding":"5.15.87"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.10","versionEndExcluding":"6.0.6"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.10","versionEndExcluding":"6.1"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}