CVE-2022-48665

What it actually does

Integer overflow in sector index calculations within the exfat filesystem driver when handling partitions larger than 2 TB (with 512-byte sectors), allowing out-of-bounds memory access.

Why it matters to the business

Unpatched systems may experience kernel crashes, data corruption, or potential code execution when mounting or accessing very large exFAT volumes, increasing downtime and recovery costs for organizations using Linux with high-capacity storage.

How an attack unfolds

An attacker supplies or crafts an exFAT partition exceeding 2 TB, mounts it on a vulnerable kernel, and triggers the integer overflow during sector indexing to corrupt memory or execute arbitrary code in kernel context.

How to fix it

Upgrade the Linux kernel to version 5.19.12 or later, or apply the fix from commit 17244f71765dfec39e84493993993e896c376d09 in the stable repository.

How to confirm the fix worked

Verify kernel version is at least 5.19.12, confirm the exfat driver source contains the corrected sector index type, and test mounting of partitions larger than 2 TB without overflow symptoms.

Typical attack path

1. Identify or create a Linux system using the exfat driver
2. Prepare or obtain an exFAT-formatted storage device larger than 2 TB
3. Mount the oversized partition to trigger sector index calculations
4. Leverage the resulting overflow for memory corruption or privilege escalation

How to detect it

Review kernel logs for exfat-related oops or panic messages around large volume mounts; examine audit logs for unexpected exFAT mounts on systems that should not encounter them.

What your security team should do

• Prioritize kernel upgrades on any systems exposing exFAT volumes to untrusted media
• Monitor for new exFAT-related CVEs and apply patches promptly given the kernel's broad deployment
• Restrict mounting of external exFAT devices on sensitive systems until updated