CVE-2022-49707: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-49707 is a NULL pointer dereference vulnerability in the Linux kernel's ext4 filesystem component, discovered in 2022. The vulnerability occurs when resizing a corrupt ext4 image where the resize_inode feature has been cleared without running e2fsck. The issue affects Linux kernel versions from 4.9.320 through 5.18.6 (NVD).

The vulnerability is triggered when the resize_inode feature is cleared and the filesystem is converted to meta_bg mode in ext4_resize_fs(), but the es->s_reserved_gdt_blocks is not reduced to zero. This leads to mistakenly calling reserve_backup_gdb() with an uninitialized resize_inode when adding new group descriptors. The vulnerability has been assigned a CVSS v3.1 base score of 5.5 (Medium) with vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H and is classified as CWE-476 (NULL Pointer Dereference) (NVD).

When exploited, this vulnerability results in a NULL pointer dereference that can cause a kernel crash, leading to a denial of service condition. The vulnerability requires local access and can affect system availability but does not impact confidentiality or integrity (NVD).

The vulnerability can be triggered through a specific sequence of operations: creating an ext4 filesystem, clearing the resize_inode feature without running e2fsck, mounting the filesystem, and attempting to resize it. This makes it a locally exploitable vulnerability requiring specific conditions to be met (Kernel Patch).

The fix involves adding a check in ext4_resize_begin() to ensure that es->s_reserved_gdt_blocks is zero when the resize_inode feature is disabled. This patch has been implemented in the Linux kernel. Users should update to a patched version of the kernel to mitigate this vulnerability (Kernel Patch).