Linux: Out-of-bounds Read
CVE-2022-49560 is a high-severity out-of-bounds read vulnerability in Linux, with a CVSS 3.1 base score of 7.1 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions 82f723b8a5adf497f9e34c702a30ca7298615654, c504167adc3248095a905fa0700a9693897cb5ed, 7c58b14b6f9cde9f69e7fa053ab73f6e013a7131 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.29% chance of exploitation within 30 days, which is low compared with other CVEs.
High severity with no evidence of exploitation so far.
What to do
- Update Linux to 82f723b8a5adf497f9e34c702a30ca7298615654 or c504167adc3248095a905fa0700a9693897cb5ed or 7c58b14b6f9cde9f69e7fa053ab73f6e013a7131 or 2193286402df2d9c53294f7a858d5e6fd7346e08, whichever matches your release line, or a later version.
- Update Linux Kernel to 5.10.120 or 5.15.45 or 5.17.13 or 5.18.2, whichever matches your release line, or a later version.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Linux | Linux | 1e49a94cf707204b66a3fb242f2814712c941f52 up to, but not including, 82f723b8a5adf497f9e34c702a30ca7298615654; 1e49a94cf707204b66a3fb242f2814712c941f52 up to, but not including, c504167adc3248095a905fa0700a9693897cb5ed; 1e49a94cf707204b66a3fb242f2814712c941f52 up to, but not including, 7c58b14b6f9cde9f69e7fa053ab73f6e013a7131; 1e49a94cf707204b66a3fb242f2814712c941f52 up to, but not including, 2193286402df2d9c53294f7a858d5e6fd7346e08; 1e49a94cf707204b66a3fb242f2814712c941f52 up to, but not including, 64ba4b15e5c045f8b746c6da5fc9be9a6b00b61d; 5.7 | 82f723b8a5adf497f9e34c702a30ca7298615654, c504167adc3248095a905fa0700a9693897cb5ed, 7c58b14b6f9cde9f69e7fa053ab73f6e013a7131, 2193286402df2d9c53294f7a858d5e6fd7346e08, 64ba4b15e5c045f8b746c6da5fc9be9a6b00b61d |
| Linux | Linux Kernel | 5.7 up to, but not including, 5.10.120; 5.11 up to, but not including, 5.15.45; 5.16 up to, but not including, 5.17.13; 5.18 up to, but not including, 5.18.2 | 5.10.120, 5.15.45, 5.17.13, 5.18.2 |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- LocalThe attacker needs local access or must trick a user into running something.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- LowA basic user account is enough.
- User interaction
- NoneNo action by a victim is required.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- HighAll data handled by the component can be read.
- Integrity
- NoneNothing can be modified.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H. Scored by NVD.
| Scoring system | Score | Severity | Scored by |
|---|---|---|---|
| CVSS 3.1 | 7.8 | High | CNA |
| CVSS 3.1 | 7.1 | High | NVD |
| CVSS 3.1 | 7.1 | High | CISA (ADP) |
Official description
In the Linux kernel, the following vulnerability has been resolved: exfat: check if cluster num is valid Syzbot reported slab-out-of-bounds read in exfat_clear_bitmap. This was triggered by reproducer calling truncute with size 0, which causes the following trace: BUG: KASAN: slab-out-of-bounds in exfat_clear_bitmap+0x147/0x490 fs/exfat/balloc.c:174 Read of size 8 at addr ffff888115aa9508 by task syz-executor251/365 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack_lvl+0x1e2/0x24b lib/dump_stack.c:118 print_address_description+0x81/0x3c0 mm/kasan/report.c:233 __kasan_report mm/kasan/report.c:419 [inline] kasan_report+0x1a4/0x1f0 mm/kasan/report.c:436 __asan_report_load8_noabort+0x14/0x20 mm/kasan/report_generic.c:309 exfat_clear_bitmap+0x147/0x490 fs/exfat/balloc.c:174 exfat_free_cluster+0x25a/0x4a0 fs/exfat/fatent.c:181 __exfat_truncate+0x99e/0xe00 fs/exfat/file.c:217 exfat_truncate+0x11b/0x4f0 fs/exfat/file.c:243 exfat_setattr+0xa03/0xd40 fs/exfat/file.c:339 notify_change+0xb76/0xe10 fs/attr.c:336 do_truncate+0x1ea/0x2d0 fs/open.c:65 Move the is_valid_cluster() helper from fatent.c to a common header to make it reusable in other *.c files. And add is_valid_cluster() to validate if cluster number is within valid range in exfat_clear_bitmap() and exfat_set_bitmap().
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
How developers prevent this class of flaw
- Use a language that provides appropriate memory abstractions.
Timeline
- CVE record published.
- CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: partial).
- Record last changed materially (score, affected products, status or references).
References
Patches and release notes
- git.kernel.org/stable/c/2193286402df2d9c53294f7a858d5e6fd7346e08
- git.kernel.org/stable/c/64ba4b15e5c045f8b746c6da5fc9be9a6b00b61d
- git.kernel.org/stable/c/7c58b14b6f9cde9f69e7fa053ab73f6e013a7131
- git.kernel.org/stable/c/82f723b8a5adf497f9e34c702a30ca7298615654
- git.kernel.org/stable/c/c504167adc3248095a905fa0700a9693897cb5ed
Recent Out-of-bounds Read vulnerabilities
- 7.1 High severity
- 7.1 High severity
- 7.1 High severity
- 7.1 High severity
- 7.1 High severity
- 7.1 High severity
Spotted an error? Tell us.