CVE-2022-1184

What it actually does

Use-after-free in ext4 dx_insert_block allows a local user to trigger kernel memory corruption resulting in denial of service via crash or panic.

Why it matters to the business

Local users can force system reboots or outages on any Linux host using the ext4 filesystem, interrupting services and requiring administrative recovery.

How an attack unfolds

An attacker with a local account performs filesystem operations that exercise the vulnerable directory-entry insertion path in ext4, freeing an object that is later dereferenced and causing the kernel to fault.

How to fix it

Apply the upstream or distribution kernel update that resolves the use-after-free in fs/ext4/namei.c; reboot into the patched kernel. Where immediate patching is impossible, restrict untrusted local accounts and consider mounting ext4 with nosuid,nodev options.

How to confirm the fix worked

Confirm the running kernel contains the fix by inspecting the ext4 source or changelog entry for dx_insert_block; attempt reproduction in a test environment and verify the crash no longer occurs.

Typical attack path

1. Obtain local shell or user session on the target host
2. Access or create an ext4 filesystem image or mount point
3. Issue directory operations that reach dx_insert_block with crafted parameters
4. Trigger the use-after-free, producing a kernel oops or panic

How to detect it

Search kernel logs (dmesg, /var/log/kern.log, journalctl) for oops or panic messages referencing ext4 and dx_insert_block; correlate with local user activity around the time of the crash.

• BUG: KASAN: use-after-free in dx_insert_block
• RIP: 0010:dx_insert_block
• ext4: directory has duplicate entries

What your security team should do

• Patch all affected Linux kernels to a version containing the ext4 fix as soon as vendor packages are available
• Limit local interactive access on systems that must remain on older kernels
• Monitor kernel logs for ext4-related oops and panics
• Include this class of local filesystem UAFs in future kernel update testing cycles