linux-cve-announce - CVE-2022-50020: ext4: avoid resizing to a partial cluster size

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025061835-CVE-2022-50020-6f27@gregkh>
Date: Wed, 18 Jun 2025 13:01:25 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2022-50020: ext4: avoid resizing to a partial cluster size

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

ext4: avoid resizing to a partial cluster size

This patch avoids an attempt to resize the filesystem to an
unaligned cluster boundary.  An online resize to a size that is not
integral to cluster size results in the last iteration attempting to
grow the fs by a negative amount, which trips a BUG_ON and leaves the fs
with a corrupted in-memory superblock.

The Linux kernel CVE team has assigned CVE-2022-50020 to this issue.


Affected and fixed versions
===========================

	Fixed in 4.9.326 with commit 53f62a4201be1cfc1e3c971e566888b182c3ffb0
	Fixed in 4.14.291 with commit 952b3dc02baaae6a69c71c0aca23e06741182d9a
	Fixed in 4.19.256 with commit 7bdfb01fc5f6b3696728aeb527c50386e0ee09a1
	Fixed in 5.4.211 with commit a6805b3dcf5cd41f2ae3a03dca43411135b99849
	Fixed in 5.10.138 with commit 80288883294c5b4ed18bae0d8bd9c4a12f297074
	Fixed in 5.15.63 with commit 72b850a2a996f72541172e7cf686d54a2b29bcd8
	Fixed in 5.19.4 with commit 0082e99a9074ff88eff729c70c93454c8588d8e1
	Fixed in 6.0 with commit 69cb8e9d8cd97cdf5e293b26d70a9dee3e35e6bd

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2022-50020
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	fs/ext4/resize.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/53f62a4201be1cfc1e3c971e566888b182c3ffb0
	https://git.kernel.org/stable/c/952b3dc02baaae6a69c71c0aca23e06741182d9a
	https://git.kernel.org/stable/c/7bdfb01fc5f6b3696728aeb527c50386e0ee09a1
	https://git.kernel.org/stable/c/a6805b3dcf5cd41f2ae3a03dca43411135b99849
	https://git.kernel.org/stable/c/80288883294c5b4ed18bae0d8bd9c4a12f297074
	https://git.kernel.org/stable/c/72b850a2a996f72541172e7cf686d54a2b29bcd8
	https://git.kernel.org/stable/c/0082e99a9074ff88eff729c70c93454c8588d8e1
	https://git.kernel.org/stable/c/69cb8e9d8cd97cdf5e293b26d70a9dee3e35e6bd