Security readout for executives and security teams
Plain-English summary
A maliciously corrupted ext4 filesystem can confuse the Linux kernel into revisiting directory index blocks during an update. This may cause access to unallocated memory, potentially crashing the system or compromising confidentiality and integrity. An attacker must get a victim to interact with a crafted filesystem, so exposure is concentrated around removable media, disk images, and other untrusted storage.
Executive priority
Prioritize patching systems that routinely handle untrusted storage or disk images. Treat general-purpose systems as a scheduled high-severity kernel update, with faster action where crafted filesystems can reach privileged infrastructure. There is no supplied evidence of active exploitation, so urgency should be exposure-driven rather than incident-driven.
Technical view
Cycles in an ext4 directory h-tree can cause previously verified nodes to be corrupted during a node split, followed by access to unallocated memory. The fix verifies that traversed block numbers are unique. CVSS 3.1 is 7.8: local attack vector, low complexity, no privileges, required user interaction, unchanged scope, and high potential impact.
Likely exposure
Potentially exposed systems run an affected Linux kernel and process attacker-influenced ext4 filesystems. Higher-risk environments include those handling untrusted removable storage or filesystem images. The supplied affected-version data is unusual and incomplete for distribution-specific kernels, so administrators should confirm status with their Linux vendor rather than rely solely on upstream version strings.
Exploitation context
The supplied record reports no CISA KEV listing and provides no cited evidence of active exploitation. Exploitation requires a maliciously corrupted ext4 filesystem plus victim interaction. The exact interaction necessary and the practical reliability of achieving confidentiality, integrity, or availability impact are not established by the supplied sources.
Researcher notes
The vulnerable path involves cyclic block references in an ext4 directory h-tree during node splitting. Upstream remediation checks traversed block-number uniqueness. Eight stable-kernel commit references are supplied, indicating branch-specific backports. No CWE, proof of concept, exploit telemetry, or distribution-package mapping is provided; researchers should avoid inferring exploitability beyond the documented unallocated-memory access.
Mitigation direction
- Install a vendor-supported kernel containing the applicable upstream stable fix.
- Reboot systems after updating so the corrected kernel is running.
- Restrict attachment or processing of untrusted filesystem images and removable media until patched.
- Consult the Linux distribution vendor for backport and package status.
Validation and detection
- Inventory running kernels on systems that can process ext4 filesystems.
- Check vendor advisories or package changelogs for CVE-2022-49343 coverage.
- Confirm the running kernel after reboot matches the patched package.
- Review workflows that accept removable media, disk images, or other attacker-controlled storage.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2022-49343 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/24b8206fec1db21d7e82f21f0b2ff5e5672cf5b3CVE reference, Linux
- https://git.kernel.org/stable/c/b3ad9ff6f06c1dc6abf7437691c88ca3d6da3ac0CVE reference, Linux
- https://git.kernel.org/stable/c/e157c8f87e8fac112d6c955e69a60cdb9bc80a60CVE reference, Linux
- https://git.kernel.org/stable/c/ff4cafa51762da3824881a9000ca421d4b78b138CVE reference, Linux
- https://git.kernel.org/stable/c/3a3ce941645407cd0b0b7f01ad9e2ea3770f46ccCVE reference, Linux
- https://git.kernel.org/stable/c/d5a16a6df2c16eaf4de04948553ef0089dee463fCVE reference, Linux
- https://git.kernel.org/stable/c/6084240bfc44bf265ab6ae7d96980469b05be0f1CVE reference, Linux
- https://git.kernel.org/stable/c/3ba733f879c2a88910744647e41edeefbc0d92b2CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.