CyberSecBulletin
CVE-2022-50084NVD status: Analyzed

Linux: Out-of-bounds Read

Published Updated By the CyberSecBulletin desk

CVE-2022-50084 is a high-severity out-of-bounds read vulnerability in Linux, with a CVSS 3.1 base score of 7.1 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions 1ae0ebfb576b72c2ef400917a5484ebe7892d80b, 90b006da40dd42285b24dd3c940d2c32aca9a70b, b856ce5f4b55f752144baf17e9d5c415072652c5 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.21% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to 1ae0ebfb576b72c2ef400917a5484ebe7892d80b or 90b006da40dd42285b24dd3c940d2c32aca9a70b or b856ce5f4b55f752144baf17e9d5c415072652c5 or cb583ca6125ac64c98e9d65128e95ebb5be7d322, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 4.9.326 or 4.14.291 or 4.19.256 or 5.4.211, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinux3a1c1ef2fd62087c3d6521de217ddb9360776658 up to, but not including, 1ae0ebfb576b72c2ef400917a5484ebe7892d80b; 3a1c1ef2fd62087c3d6521de217ddb9360776658 up to, but not including, 90b006da40dd42285b24dd3c940d2c32aca9a70b; 3a1c1ef2fd62087c3d6521de217ddb9360776658 up to, but not including, b856ce5f4b55f752144baf17e9d5c415072652c5; 3a1c1ef2fd62087c3d6521de217ddb9360776658 up to, but not including, cb583ca6125ac64c98e9d65128e95ebb5be7d322; 3a1c1ef2fd62087c3d6521de217ddb9360776658 up to, but not including, 49dba30638e091120256a9e89125340795f034dc; 3a1c1ef2fd62087c3d6521de217ddb9360776658 up to, but not including, 4c233811a49578634d10a5e70a9dfa569d451e94; 3a1c1ef2fd62087c3d6521de217ddb9360776658 up to, but not including, d8971b595d7adac3421c21f59918241f1574061e; 3a1c1ef2fd62087c3d6521de217ddb9360776658 up to, but not including, b4c6c07c92b6cba2bf3cb2dfa722debeaf8a8abe; and 2 more ranges1ae0ebfb576b72c2ef400917a5484ebe7892d80b, 90b006da40dd42285b24dd3c940d2c32aca9a70b, b856ce5f4b55f752144baf17e9d5c415072652c5, cb583ca6125ac64c98e9d65128e95ebb5be7d322, 49dba30638e091120256a9e89125340795f034dc, 4c233811a49578634d10a5e70a9dfa569d451e94
LinuxLinux Kernelbefore 4.9.326; 4.10 up to, but not including, 4.14.291; 4.15 up to, but not including, 4.19.256; 4.20 up to, but not including, 5.4.211; 5.5 up to, but not including, 5.10.137; 5.11 up to, but not including, 5.15.61; 5.16 up to, but not including, 5.18.18; 5.19 up to, but not including, 5.19.24.9.326, 4.14.291, 4.19.256, 5.4.211, 5.10.137, 5.15.61

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
LocalThe attacker needs local access or must trick a user into running something.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
NoneNothing can be modified.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H. Scored by NVD.

Official description

In the Linux kernel, the following vulnerability has been resolved: dm raid: fix address sanitizer warning in raid_status There is this warning when using a kernel with the address sanitizer and running this testsuite: https://gitlab.com/cki-project/kernel-tests/-/tree/main/storage/swraid/scsi_raid ================================================================== BUG: KASAN: slab-out-of-bounds in raid_status+0x1747/0x2820 [dm_raid] Read of size 4 at addr ffff888079d2c7e8 by task lvcreate/13319 CPU: 0 PID: 13319 Comm: lvcreate Not tainted 5.18.0-0.rc3.<snip> #1 Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 Call Trace: <TASK> dump_stack_lvl+0x6a/0x9c print_address_description.constprop.0+0x1f/0x1e0 print_report.cold+0x55/0x244 kasan_report+0xc9/0x100 raid_status+0x1747/0x2820 [dm_raid] dm_ima_measure_on_table_load+0x4b8/0xca0 [dm_mod] table_load+0x35c/0x630 [dm_mod] ctl_ioctl+0x411/0x630 [dm_mod] dm_ctl_ioctl+0xa/0x10 [dm_mod] __x64_sys_ioctl+0x12a/0x1a0 do_syscall_64+0x5b/0x80 The warning is caused by reading conf->max_nr_stripes in raid_status. The code in raid_status reads mddev->private, casts it to struct r5conf and reads the entry max_nr_stripes. However, if we have different raid type than 4/5/6, mddev->private doesn't point to struct r5conf; it may point to struct r0conf, struct r1conf, struct r10conf or struct mpconf. If we cast a pointer to one of these structs to struct r5conf, we will be reading invalid memory and KASAN warns about it. Fix this bug by reading struct r5conf only if raid type is 4, 5 or 6.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

How developers prevent this class of flaw

  • Use a language that provides appropriate memory abstractions.

More Out-of-bounds Read vulnerabilities (CWE-125)

Timeline

  1. CVE record published.
  2. Record last changed materially (score, affected products, status or references).

References

Recent Out-of-bounds Read vulnerabilities

Spotted an error? Tell us.