Security readout for executives and security teams
Plain-English summary
CVE-2022-49738 is a Linux kernel F2FS filesystem bug that can read outside valid memory during garbage collection. A local low-privileged user could potentially cause sensitive memory disclosure or a system availability impact on affected kernels using F2FS.
Executive priority
Prioritize patching where Linux systems use F2FS or host untrusted local users. This is not a remotely exploitable internet-facing issue based on the supplied evidence, but confidentiality and availability impacts justify timely remediation.
Technical view
The flaw is a missing sanity check for inode i_extra_isize in F2FS is_alive(), reached through gc_data_segment and data_blkaddr. The reported failure is a KASAN slab out-of-bounds read. CVSS 3.1 is 7.1 with local attack vector, low privileges, high confidentiality impact, and high availability impact.
Likely exposure
Exposure is most relevant for Linux systems running affected kernels where F2FS is enabled or mounted. The bundle lists Linux kernel versions including 3.8 through pre-fixed stable lines as affected, but exact distribution package exposure requires vendor mapping.
Exploitation context
CISA KEV status is false in the supplied bundle. The source describes syzbot discovery and kernel fixes, but does not cite active exploitation, public exploit code, or real-world attacks. Treat exploitation evidence as incomplete, not confirmed.
Researcher notes
The root cause is unchecked i_extra_isize leading to invalid address access in F2FS garbage collection. Affected-version data in the bundle appears broad and commit-oriented, so validate against kernel stable commits and downstream vendor backports before declaring systems vulnerable.
Mitigation direction
- Update to a vendor kernel containing the listed stable F2FS fixes.
- Check distribution advisories for exact package versions and backport status.
- Prioritize systems that mount or allow local access to F2FS filesystems.
- Apply normal local-user hardening while patch rollout is pending.
Validation and detection
- Inventory running Linux kernel versions across servers, endpoints, and appliances.
- Identify systems with F2FS support enabled or F2FS filesystems mounted.
- Map kernels to vendor advisories and the listed stable commits.
- Confirm patched systems rebooted into the fixed kernel.
- Review vulnerability scanner findings for distribution-specific backports.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-125: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-49738 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H1.85.2CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
7.1HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/e5142a4935c1f15841d06047b8130078fc4d7b8fCVE reference, Linux
- https://git.kernel.org/stable/c/914e38f02a490dafd980ff0f39cccedc074deb29CVE reference, Linux
- https://git.kernel.org/stable/c/97ccfffcc061e54ce87e4a51a40e2e9cb0b7076aCVE reference, Linux
- https://git.kernel.org/stable/c/5b25035fb888cb2f78bf0b9c9f95b1dc54480d36CVE reference, Linux
- https://git.kernel.org/stable/c/d3b7b4afd6b2c344eabf9cc26b8bfa903c164c7cCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Out-of-bounds Read
Out-of-bounds Read represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.