Linux Kernel EROFS Vulnerability Affecting Signed i_size Field

CVE-2022-50313

What is CVE-2022-50313?

A vulnerability in the Linux kernel's EROFS filesystem has been identified, arising from the handling of the i_size field as a signed type. This issue occurs when a crafted negative i_size is less than the expected block size, causing it to be improperly treated as a fast symlink. As a result, this can lead to unexpected behavior and potential exploitation. A solution has been implemented to revert to a generic handling path for such atypical i_size values, mitigating the risk associated with this flaw.

References