#VU104653 Improper locking in Linux kernel - CVE-2022-49414

Vulnerability identifier: #VU104653

Vulnerability risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-49414

CWE-ID: CWE-667

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the ext4_punch_hole() function in fs/ext4/inode.c, within the ext4_fallocate() function in fs/ext4/extents.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
https://git.kernel.org/stable/c/14602353b350950b551eccc6b46411aa3b12ffe2
https://git.kernel.org/stable/c/18881d7e517169193d9ef6c89c7f322e3e164277
https://git.kernel.org/stable/c/725e00cb7039eae291890f1bb19bc867176745f6
https://git.kernel.org/stable/c/91f90b571f1a23f5b8a9c2b68a9aa5d6981a3c3d
https://git.kernel.org/stable/c/ccc6639f831bee91aa8b41c8a1cdd020ecfb9f32
https://git.kernel.org/stable/c/f87c7a4b084afc13190cbb263538e444cb2b392a

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.