CVE-2022-50581: 
Linux Kernel vulnerability analysis and mitigation

In the Linux kernel, a vulnerability (CVE-2022-50581) was identified involving an out-of-bounds (OOB) read issue in the _hfsbrec_find function of the HFS filesystem implementation. The vulnerability was discovered by Syzbot and affects the Linux kernel's HFS filesystem handling (Rapid7 DB).

The vulnerability occurs in the hfsstrcmp function within fs/hfs/string.c at line 84. The issue arises when the input inode of hfswriteinode() contains incorrect data, specifically when the len field in the hfsname structure exceeds HFSNAMELEN (31), which is the maximum length allowed for an HFS filename. The vulnerability manifests through the following call chain: hfswriteinode() -> hfsbrecfind() -> _hfsbrecfind() -> hfscatkeycmp() -> hfs_strcmp(), where the OOB read occurs (Rapid7 DB).

The vulnerability allows an attacker to perform an out-of-bounds read operation, which could potentially lead to information disclosure or system crashes. The issue affects systems running the Linux kernel with HFS filesystem support enabled (Rapid7 DB).

The vulnerability has been fixed by adding a check on the len parameter in hfswriteinode() before calling hfsbrecfind(). Users should update their Linux kernel to a version that includes this fix (Rapid7 DB).