Linux: Out-of-bounds Read
CVE-2022-49674 is a high-severity out-of-bounds read vulnerability in Linux, with a CVSS 3.1 base score of 7.1 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions 5e161a8826b63c0b8b43e4a7fad1f956780f42ab, df1a5ab0dd0775f2ea101c71f2addbc4c0ea0f85, 90de15357504c8097ab29769dc6852e16281e9e8 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.29% chance of exploitation within 30 days, which is low compared with other CVEs.
High severity with no evidence of exploitation so far.
What to do
- Update Linux to 5e161a8826b63c0b8b43e4a7fad1f956780f42ab or df1a5ab0dd0775f2ea101c71f2addbc4c0ea0f85 or 90de15357504c8097ab29769dc6852e16281e9e8 or 9bf2b0757b04c78dc5d6e3a198acca98457b32a1, whichever matches your release line, or a later version.
- Update Linux Kernel to 4.14.287 or 4.19.251 or 5.4.204 or 5.10.129, whichever matches your release line, or a later version.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Linux | Linux | 33e53f06850f44ec9722e08a993ecf8816e447a5 up to, but not including, 5e161a8826b63c0b8b43e4a7fad1f956780f42ab; 33e53f06850f44ec9722e08a993ecf8816e447a5 up to, but not including, df1a5ab0dd0775f2ea101c71f2addbc4c0ea0f85; 33e53f06850f44ec9722e08a993ecf8816e447a5 up to, but not including, 90de15357504c8097ab29769dc6852e16281e9e8; 33e53f06850f44ec9722e08a993ecf8816e447a5 up to, but not including, 9bf2b0757b04c78dc5d6e3a198acca98457b32a1; 33e53f06850f44ec9722e08a993ecf8816e447a5 up to, but not including, 6352b2f4d8e95ec0ae576d7705435d64cfa29503; 33e53f06850f44ec9722e08a993ecf8816e447a5 up to, but not including, bcff98500ea3b4e7615ec31d2bdd326bc1ef5134; 33e53f06850f44ec9722e08a993ecf8816e447a5 up to, but not including, 332bd0778775d0cf105c4b9e03e460b590749916; 4.8 | 5e161a8826b63c0b8b43e4a7fad1f956780f42ab, df1a5ab0dd0775f2ea101c71f2addbc4c0ea0f85, 90de15357504c8097ab29769dc6852e16281e9e8, 9bf2b0757b04c78dc5d6e3a198acca98457b32a1, 6352b2f4d8e95ec0ae576d7705435d64cfa29503, bcff98500ea3b4e7615ec31d2bdd326bc1ef5134 |
| Linux | Linux Kernel | before 4.14.287; 4.15 up to, but not including, 4.19.251; 4.20 up to, but not including, 5.4.204; 5.5 up to, but not including, 5.10.129; 5.11 up to, but not including, 5.15.53; 5.16 up to, but not including, 5.18.10; 5.19 | 4.14.287, 4.19.251, 5.4.204, 5.10.129, 5.15.53, 5.18.10 |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- LocalThe attacker needs local access or must trick a user into running something.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- LowA basic user account is enough.
- User interaction
- NoneNo action by a victim is required.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- HighAll data handled by the component can be read.
- Integrity
- NoneNothing can be modified.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H. Scored by NVD.
Official description
In the Linux kernel, the following vulnerability has been resolved: dm raid: fix accesses beyond end of raid member array On dm-raid table load (using raid_ctr), dm-raid allocates an array rs->devs[rs->raid_disks] for the raid device members. rs->raid_disks is defined by the number of raid metadata and image tupples passed into the target's constructor. In the case of RAID layout changes being requested, that number can be different from the current number of members for existing raid sets as defined in their superblocks. Example RAID layout changes include: - raid1 legs being added/removed - raid4/5/6/10 number of stripes changed (stripe reshaping) - takeover to higher raid level (e.g. raid5 -> raid6) When accessing array members, rs->raid_disks must be used in control loops instead of the potentially larger value in rs->md.raid_disks. Otherwise it will cause memory access beyond the end of the rs->devs array. Fix this by changing code that is prone to out-of-bounds access. Also fix validate_raid_redundancy() to validate all devices that are added. Also, use braces to help clean up raid_iterate_devices(). The out-of-bounds memory accesses was discovered using KASAN. This commit was verified to pass all LVM2 RAID tests (with KASAN enabled).
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
How developers prevent this class of flaw
- Use a language that provides appropriate memory abstractions.
Timeline
- CVE record published.
- Record last changed materially (score, affected products, status or references).
References
Patches and release notes
- git.kernel.org/stable/c/332bd0778775d0cf105c4b9e03e460b590749916
- git.kernel.org/stable/c/5e161a8826b63c0b8b43e4a7fad1f956780f42ab
- git.kernel.org/stable/c/6352b2f4d8e95ec0ae576d7705435d64cfa29503
- git.kernel.org/stable/c/90de15357504c8097ab29769dc6852e16281e9e8
- git.kernel.org/stable/c/9bf2b0757b04c78dc5d6e3a198acca98457b32a1
- git.kernel.org/stable/c/bcff98500ea3b4e7615ec31d2bdd326bc1ef5134
- git.kernel.org/stable/c/df1a5ab0dd0775f2ea101c71f2addbc4c0ea0f85
Recent Out-of-bounds Read vulnerabilities
- 7.1 High severity
- 7.1 High severity
- 7.1 High severity
- 7.1 High severity
- 7.1 High severity
- 7.1 High severity
Spotted an error? Tell us.