LiveActive security incident?Get immediate response
CVE Record

CVE-2022-50581: hfs: fix OOB Read in __hfs_brec_find

In the Linux kernel, the following vulnerability has been resolved: hfs: fix OOB Read in __hfs_brec_find Syzbot reported a OOB read bug: ================================================================== BUG: KASAN: slab-out-of-bounds in hfs_strcmp+0x117/0x190 fs/hfs/string.c:84 Read of size 1 at addr ffff88807eb62c4e by task kworker/u4:1/11 CPU: 1 PID: 11 Comm: kworker/u4:1 Not tainted 6.1.0-rc6-syzkaller-00308-g644e9524388a #0 Workqueue: writeback wb_workfn (flush-7:0) Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1b1/0x28e lib/dump_stack.c:106 print_address_description+0x74/0x340 mm/kasan/report.c:284 print_report+0x107/0x1f0 mm/kasan/report.c:395 kasan_report+0xcd/0x100 mm/kasan/report.c:495 hfs_strcmp+0x117/0x190 fs/hfs/string.c:84 __hfs_brec_find+0x213/0x5c0 fs/hfs/bfind.c:75 hfs_brec_find+0x276/0x520 fs/hfs/bfind.c:138 hfs_write_inode+0x34c/0xb40 fs/hfs/inode.c:462 write_inode fs/fs-writeback.c:1440 [inline] If the input inode of hfs_write_inode() is incorrect: struct inode struct hfs_inode_info struct hfs_cat_key struct hfs_name u8 len # len is greater than HFS_NAMELEN(31) which is the maximum length of an HFS filename OOB read occurred: hfs_write_inode() hfs_brec_find() __hfs_brec_find() hfs_cat_keycmp() hfs_strcmp() # OOB read occurred due to len is too large Fix this by adding a Check on len in hfs_write_inode() before calling hfs_brec_find().

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysislow

Security readout for executives and security teams

Plain-English summary

A flaw in the Linux kernel's HFS filesystem driver lets a malformed filesystem trigger a memory read past the end of an allowed buffer. In practice this typically requires a crafted HFS image being mounted or written, and the most likely impact is a kernel crash or information disclosure rather than direct remote takeover.

Executive priority

Low priority for most enterprises. Patch on normal kernel update cycles; prioritize sooner only if your fleet routinely mounts untrusted HFS/Apple-formatted media (e.g., forensics, multimedia ingest, shared kiosks).

Technical view

An out-of-bounds read in __hfs_brec_find via hfs_strcmp occurs when hfs_write_inode is called with an inode whose hfs_name length exceeds HFS_NAMELEN (31). The fix validates the name length in hfs_write_inode before invoking hfs_brec_find. Found by Syzbot with KASAN. Fixed in stable trees including 4.9.337, 4.14.303, 4.19.270, 5.4.229, 5.10.163, 5.15.86, 6.0.16, 6.1.2, and 6.2.

Likely exposure

Affects Linux systems with the HFS filesystem driver loaded that mount or process untrusted HFS volumes. Most servers and cloud workloads do not use HFS, limiting exposure. Highest concern is systems that auto-mount removable media or process user-supplied disk images.

Exploitation context

Not listed in CISA KEV and no public exploitation reported in the source bundle. Discovered by Syzbot fuzzing; the trigger requires a maliciously crafted HFS image being processed by the kernel. Likely outcomes are a kernel oops or a limited information leak.

Researcher notes

Bug class: KASAN slab-out-of-bounds read in fs/hfs/string.c:84 reachable via hfs_write_inode -> hfs_brec_find -> __hfs_brec_find -> hfs_cat_keycmp -> hfs_strcmp when hfs_name.len exceeds HFS_NAMELEN (31). Fix adds a length sanity check in hfs_write_inode. Multiple stable backports were issued; legacy HFS driver is rarely deployed but remains compiled in many distro kernels.

Mitigation direction

  • Update Linux kernels to a fixed stable release (4.9.337, 4.14.303, 4.19.270, 5.4.229, 5.10.163, 5.15.86, 6.0.16, 6.1.2, or 6.2+).
  • If patching is delayed, blacklist the hfs kernel module on systems that do not require it.
  • Disable auto-mount of removable media and reject untrusted HFS disk images on shared hosts.
  • Track distribution security advisories (RHEL, Ubuntu, SUSE, Debian) for backported fixes.

Validation and detection

  • Confirm running kernel version against the fixed stable tags listed in the kernel.org commits.
  • Check whether the hfs module is loaded with `lsmod | grep hfs` and whether it is needed.
  • Review configuration for udisks/automount policies that could process attacker-supplied HFS media.
  • Verify vendor advisory status from your Linux distribution's security tracker for CVE-2022-50581.
Prepared
Confidence
medium
Sources
11

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2022-50581 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
10Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2unaffected
LinuxLinux2.6.12, 0, 4.9.337, 4.14.303, 4.19.270, 5.4.229, 5.10.163, 5.15.86, 6.0.16, 6.1.2, 6.2affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.