CVE-2022-1184

Published: 29 August 2022

A use-after-free flaw was found in fs/ext4/namei.c:dx_insert_block() in the Linux kernel’s filesystem sub-component. This flaw allows a local attacker with a user privilege to cause a denial of service.

From the Ubuntu Security Team

It was discovered that the ext4 file system implementation in the Linux kernel contained a use-after-free vulnerability. An attacker could use this to construct a malicious ext4 file system image that, when mounted, could cause a denial of service (system crash).

Notes

not clear if the first two commits are related to this
CVE or are some other issue.
last three commits are per suse bug; 61a1d87a324a ("ext4: fix
check for block being out of directory size") is a fix for
65f8ea4cd57d ("ext4: check if directory block is within i_size")

Status