Bug 2373519 (CVE-2022-50083)

Summary:	CVE-2022-50083 kernel: ext4: add EXT4_INODE_HAS_XATTR_SPACE macro in xattr.h
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability-draft	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	unspecified	CC:	dfreiber, drow, jburrell, vkumar
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	[REJECTED CVE] In the Linux kernel, the following vulnerability has been resolved: ext4: add EXT4_INODE_HAS_XATTR_SPACE macro in xattr.h	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2025-06-18 12:06:34 UTC

In the Linux kernel, the following vulnerability has been resolved:

ext4: add EXT4_INODE_HAS_XATTR_SPACE macro in xattr.h

When adding an xattr to an inode, we must ensure that the inode_size is
not less than EXT4_GOOD_OLD_INODE_SIZE + extra_isize + pad. Otherwise,
the end position may be greater than the start position, resulting in UAF.

Comment 1 Avinash Hanwate 2025-06-19 18:51:11 UTC

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2025061857-CVE-2022-50083-faff@gregkh/T

Comment 6 Rohit Keshri 2025-08-20 14:38:15 UTC

RedHat has rejected this cve, as it looks like CVE-2022-50083 (duplicate of cve-2023-2513) is not really a vulnerability fix, but rather that cve-2023-2513 depends on that specific commit.

Comment 7 TEJ RATHI 2025-08-21 12:26:56 UTC

This CVE has been rejected by the Linux kernel community. Refer to the announcement: https://lore.kernel.org/linux-cve-announce/2025082055-REJECTED-816e@gregkh/

Comment added by: Automated Script