CVE-2022-50367 Details

A use-after-free vulnerability has been identified in the Linux kernel's handling of NILFS metadata files. This issue arises in the 'alloc_inode' function, where the 'inode_init_always()' routine may return an out-of-memory error if 'security_inode_alloc()' fails. This failure leaves the 'inode->i_private' field uninitialized. Consequently, the 'nilfs_is_metadata_file_inode()' function incorrectly identifies the inode as valid, leading to a faulty call to 'nilfs_free_inode()', which triggers 'nilfs_mdt_destroy()'. This sequence frees the uninitialized 'i_private' data, causing system crashes due to a use-after-free and general protection fault. The vulnerability affects several versions of the Linux kernel.

The vulnerability has been addressed by modifying the 'alloc_inode' function to move the 'security_inode_alloc()' call earlier in the process, ensuring that the 'inode->i_private' field is properly initialized before the inode is used.