Log in Start free

Vulnerability · Published Dec 24, 2025 · Assigned by Linux

CVE-2022-50747hfs: Fix OOB Write in hfs_asc2mac

High 7.8

In plain English

A high-severity security flaw in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.2%top 88.6% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

In the Linux kernel, the following vulnerability has been resolved: hfs: Fix OOB Write in hfs_asc2mac Syzbot reported a OOB Write bug: loop0: detected capacity change from 0 to 64 ================================================================== BUG: KASAN: slab-out-of-bounds in hfs_asc2mac+0x467/0x9a0 fs/hfs/trans.c:133 Write of size 1 at addr ffff88801848314e by task syz-executor391/3632 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1b1/0x28e lib/dump_stack.c:106 print_address_description+0x74/0x340 mm/kasan/report.c:284 print_report+0x107/0x1f0 mm/kasan/report.c:395 kasan_report+0xcd/0x100 mm/kasan/report.c:495 hfs_asc2mac+0x467/0x9a0 fs/hfs/trans.c:133 hfs_cat_build_key+0x92/0x170 fs/hfs/catalog.c:28 hfs_lookup+0x1ab/0x2c0 fs/hfs/dir.c:31 lookup_open fs/namei.c:3391 [inline] open_last_lookups fs/namei.c:3481 [inline] path_openat+0x10e6/0x2df0 fs/namei.c:3710 do_filp_open+0x264/0x4f0 fs/namei.c:3740 If in->len is much larger than HFS_NAMELEN(31) which is the maximum length of an HFS filename, a OOB write could occur in hfs_asc2mac(). In that case, when the dst reaches the boundary, the srclen is still greater than 0, which causes a OOB write. Fix this by adding a check on dstlen in while() before writing to dst address.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12linux6.1.4-1DEBIAN-CVE-2022-50747
Debian:13linux6.1.4-1DEBIAN-CVE-2022-50747
Debian:14linux6.1.4-1DEBIAN-CVE-2022-50747
Ubuntu:22.04:LTSlinux5.15.0-69.76UBUNTU-CVE-2022-50747
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2022-50747
Ubuntu:22.04:LTSlinux-aws5.15.0-1033.37UBUNTU-CVE-2022-50747
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2022-50747
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2022-50747
Ubuntu:22.04:LTSlinux-aws-6.5no fix listedUBUNTU-CVE-2022-50747
Ubuntu:22.04:LTSlinux-azure5.15.0-1035.42UBUNTU-CVE-2022-50747
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2022-50747
Ubuntu:24.04:LTSlinux-azure-6.11no fix listedUBUNTU-CVE-2022-50747
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2022-50747
Ubuntu:22.04:LTSlinux-azure-6.5no fix listedUBUNTU-CVE-2022-50747
Ubuntu:22.04:LTSlinux-azure-fde5.15.0-1035.42.1UBUNTU-CVE-2022-50747
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2022-50747
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2022-50747
Ubuntu:22.04:LTSlinux-gcp5.15.0-1031.38UBUNTU-CVE-2022-50747
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2022-50747
Ubuntu:24.04:LTSlinux-gcp-6.11no fix listedUBUNTU-CVE-2022-50747
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2022-50747
Ubuntu:22.04:LTSlinux-gcp-6.5no fix listedUBUNTU-CVE-2022-50747
Ubuntu:22.04:LTSlinux-gke5.15.0-1030.35UBUNTU-CVE-2022-50747
Ubuntu:22.04:LTSlinux-gkeop5.15.0-1017.22UBUNTU-CVE-2022-50747
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2022-50747
Ubuntu:24.04:LTSlinux-hwe-6.11no fix listedUBUNTU-CVE-2022-50747
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2022-50747
Ubuntu:22.04:LTSlinux-hwe-6.5no fix listedUBUNTU-CVE-2022-50747
Ubuntu:22.04:LTSlinux-ibm5.15.0-1027.30UBUNTU-CVE-2022-50747
Ubuntu:22.04:LTSlinux-intel-iot-realtimeno fix listedUBUNTU-CVE-2022-50747
Ubuntu:22.04:LTSlinux-intel-iotg5.15.0-1027.32UBUNTU-CVE-2022-50747
Ubuntu:22.04:LTSlinux-kvm5.15.0-1030.35UBUNTU-CVE-2022-50747
Ubuntu:22.04:LTSlinux-lowlatency5.15.0-69.76UBUNTU-CVE-2022-50747
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2022-50747
Ubuntu:24.04:LTSlinux-lowlatency-hwe-6.11no fix listedUBUNTU-CVE-2022-50747
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2022-50747
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.5no fix listedUBUNTU-CVE-2022-50747
Ubuntu:22.04:LTSlinux-nvidia5.15.0-1023.23UBUNTU-CVE-2022-50747
Ubuntu:24.04:LTSlinux-nvidia-6.11no fix listedUBUNTU-CVE-2022-50747
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2022-50747
Ubuntu:22.04:LTSlinux-nvidia-6.5no fix listedUBUNTU-CVE-2022-50747
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2022-50747
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2022-50747
Ubuntu:22.04:LTSlinux-oem-6.1no fix listedUBUNTU-CVE-2022-50747
Ubuntu:24.04:LTSlinux-oem-6.11no fix listedUBUNTU-CVE-2022-50747
Ubuntu:22.04:LTSlinux-oem-6.5no fix listedUBUNTU-CVE-2022-50747
Ubuntu:24.04:LTSlinux-oem-6.8no fix listedUBUNTU-CVE-2022-50747
Ubuntu:22.04:LTSlinux-oracle5.15.0-1032.38UBUNTU-CVE-2022-50747
Ubuntu:22.04:LTSlinux-oracle-6.5no fix listedUBUNTU-CVE-2022-50747
Ubuntu:22.04:LTSlinux-raspi5.15.0-1026.28UBUNTU-CVE-2022-50747
Ubuntu:24.04:LTSlinux-raspi-realtimeno fix listedUBUNTU-CVE-2022-50747
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2022-50747
Ubuntu:24.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2022-50747
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2022-50747
Ubuntu:24.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2022-50747
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2022-50747
Ubuntu:24.04:LTSlinux-riscv-6.14no fix listedUBUNTU-CVE-2022-50747
Ubuntu:22.04:LTSlinux-riscv-6.5no fix listedUBUNTU-CVE-2022-50747
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2022-50747
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2022-50747
Ubuntu:22.04:LTSlinux-starfive-6.5no fix listedUBUNTU-CVE-2022-50747

Affected products (as reported)

VendorProductVersions
Linux Linux 328b9227865026268261a24a97a578907b280415 – before 8399318b13dc9e0569dee07ba2994098926d4fb2328b9227865026268261a24a97a578907b280415 – before 95040de81c629cd8d3c6ab5b50a8bd5088068303328b9227865026268261a24a97a578907b280415 – before ba8f0ca386dd15acf5a93cbac932392c7818eab4328b9227865026268261a24a97a578907b280415 – before 6a95b17e4d4cd2d8278559f930b447f8c9c8cff9328b9227865026268261a24a97a578907b280415 – before cff9fefdfbf5744afbb6d70bff2b49ec2065d23d328b9227865026268261a24a97a578907b280415 – before 7af9cb8cbb81308ce4b06cc7164267faccbf75dd328b9227865026268261a24a97a578907b280415 – before ae21b03f904736eb2aa9bd119d2a14e741f1681f328b9227865026268261a24a97a578907b280415 – before 88579c158e026860c61c4192531e8bc42f4bc642
Linux Linux 2.6.14

References