CVE-2022-2978: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-2978 is a use-after-free vulnerability discovered in the Linux kernel NILFS file system. The flaw was found in the way a user triggers the security_inode_alloc function to fail with a subsequent call to nilfs_mdt_destroy function. The vulnerability was discovered by Hao Sun and Jiacheng Xu and was publicly disclosed on August 24, 2022 (NVD, Ubuntu).

The vulnerability occurs in the alloc_inode function where inode_init_always() could return -ENOMEM if security_inode_alloc() fails, causing inode->i_private to remain uninitialized. This leads to nilfs_is_metadata_file_inode() returning true, causing nilfs_free_inode() to incorrectly call nilfs_mdt_destroy(), which then frees the uninitialized inode->i_private. The vulnerability has been assigned a CVSS v3.1 base score of 7.8 (High), with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (NVD).

A local user could exploit this vulnerability to cause a denial of service (system crash or memory corruption) or potentially escalate their privileges on the system (NVD, Ubuntu).

The vulnerability requires local access to the system and can be triggered by a user with the ability to interact with the NILFS file system. No public exploits have been identified in the wild (NVD).

The vulnerability has been fixed by moving the security_inode_alloc function call just prior to this_cpu_inc(nr_inodes) in the Linux kernel. Various Linux distributions have released patches, including Ubuntu (versions 22.04 LTS, 20.04 LTS, 18.04 LTS, and 16.04 LTS) and Debian (version 10 buster) (Ubuntu, Debian).