LiveActive security incident?Get immediate response
CVE Record

CVE-2022-50753: f2fs: fix to do sanity check on summary info

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to do sanity check on summary info As Wenqing Liu reported in bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=216456 BUG: KASAN: use-after-free in recover_data+0x63ae/0x6ae0 [f2fs] Read of size 4 at addr ffff8881464dcd80 by task mount/1013 CPU: 3 PID: 1013 Comm: mount Tainted: G W 6.0.0-rc4 #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014 Call Trace: dump_stack_lvl+0x45/0x5e print_report.cold+0xf3/0x68d kasan_report+0xa8/0x130 recover_data+0x63ae/0x6ae0 [f2fs] f2fs_recover_fsync_data+0x120d/0x1fc0 [f2fs] f2fs_fill_super+0x4665/0x61e0 [f2fs] mount_bdev+0x2cf/0x3b0 legacy_get_tree+0xed/0x1d0 vfs_get_tree+0x81/0x2b0 path_mount+0x47e/0x19d0 do_mount+0xce/0xf0 __x64_sys_mount+0x12c/0x1a0 do_syscall_64+0x38/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd The root cause is: in fuzzed image, SSA table is corrupted: ofs_in_node is larger than ADDRS_PER_PAGE(), result in out-of-range access on 4k-size page. - recover_data - do_recover_data - check_index_in_prev_nodes - f2fs_data_blkaddr This patch adds sanity check on summary info in recovery and GC flow in where the flows rely on them. After patch: [ 29.310883] F2FS-fs (loop0): Inconsistent ofs_in_node:65286 in summary, ino:0, nid:6, max:1018

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2022-50753 is a Linux kernel F2FS filesystem flaw. A corrupted F2FS image can trigger a use-after-free during mount recovery. Business risk is highest where servers, appliances, sandboxes, or analysis systems mount untrusted disk images or removable media. No source indicates active exploitation.

Executive priority

Prioritize for systems that process untrusted storage images or removable media. For general servers that never mount F2FS, urgency is lower. Treat remediation as part of normal kernel patching unless local exposure is high.

Technical view

The flaw is in F2FS recovery and garbage-collection paths that trusted summary metadata. A fuzzed image with a corrupted SSA table and oversized ofs_in_node caused out-of-range page access and KASAN-reported use-after-free in recover_data. Stable kernel commits add sanity checks for summary information before use.

Likely exposure

Linux systems with F2FS support are potentially exposed, especially if they mount attacker-controlled F2FS filesystems. Exact downstream exposure depends on kernel branch, distribution backports, and whether F2FS is enabled or used.

Exploitation context

The public record describes a fuzzed filesystem image causing failure during mount. Exploitation likely requires getting a vulnerable system to mount a malformed F2FS image. Sources do not show remote exploitation, privilege impact, CVSS, or inclusion in CISA KEV.

Researcher notes

The CVE record lacks CVSS and CWE data. The strongest evidence is the kernel fix text and stable commits. The bug is memory-safety related, but the provided sources do not establish code execution, privilege escalation, or active exploitation.

Mitigation direction

  • Update to a kernel containing the referenced F2FS sanity-check fixes or a vendor backport.
  • Follow your Linux distribution’s kernel advisory for package names and fixed versions.
  • Avoid mounting untrusted F2FS images or removable media on sensitive systems.
  • Disable or restrict F2FS support where it is not operationally required.

Validation and detection

  • Inventory systems running Linux kernels with F2FS enabled or loaded.
  • Identify hosts that mount removable media, mobile images, or untrusted filesystem samples.
  • Confirm the running kernel includes the referenced stable fixes or vendor backports.
  • Review distribution security advisories for CVE-2022-50753 coverage.
Prepared
Confidence
medium
Sources
8

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2022-50753 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
7Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxb292dcab068e141d8a820b77cbcc88d98c610eb4, b292dcab068e141d8a820b77cbcc88d98c610eb4, b292dcab068e141d8a820b77cbcc88d98c610eb4, b292dcab068e141d8a820b77cbcc88d98c610eb4, b292dcab068e141d8a820b77cbcc88d98c610eb4, b292dcab068e141d8a820b77cbcc88d98c610eb4unaffected
LinuxLinux3.11, 0, 5.4.220, 5.10.150, 5.15.75, 5.19.17, 6.0.3, 6.1affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.