CVE-2022-49560

Summary

CVE-2022-49560 is a Linux kernel vulnerability affecting the exfat file system. The issue was identified as a slab-out-of-bounds read in the function exfat_clear_bitmap, specifically in the fs/exfat/balloc.c file. The problem was triggered by a call to truncute with a size of 0, leading to an invalid cluster number check. This resulted in a memory read from an unintended address, as evidenced by the call trace. To mitigate this issue, the Linux kernel developers introduced the is_valid_cluster() helper function and added its usage in exfat_clear_bitmap() and exfat_set_bitmap() to ensure proper validation of cluster numbers.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.