CVE-2022-48847
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2022-48847
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-48847.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2022-48847
- Related
- Published
- 2024-07-16T13:15:11Z
- Modified
- 2024-09-18T03:22:38.191578Z
- Severity
-
- 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- [none]
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
watch_queue: Fix filter limit check
In watchqueuesetfilter(), there are a couple of places where we check that the filter type value does not exceed what the typefilter bitmap can hold. One place calculates the number of bits by:
if (tf[i].type >= sizeof(wfilter->type_filter) * 8)
which is fine, but the second does:
if (tf[i].type >= sizeof(wfilter->typefilter) * BITSPER_LONG)
which is not. This can lead to a couple of out-of-bounds writes due to a too-large type:
(1) _setbit() on wfilter->type_filter (2) Writing more elements in wfilter->filters[] than we allocated.
Fix this by just using the proper WATCHTYPE_NR instead, which is the number of types we actually know about.
The bug may cause an oops looking something like:
BUG: KASAN: slab-out-of-bounds in watchqueuesetfilter+0x659/0x740 Write of size 4 at addr ffff88800d2c66bc by task watchqueueoob/611 ... Call Trace: <TASK> dumpstacklvl+0x45/0x59 printaddressdescription.constprop.0+0x1f/0x150 ... kasanreport.cold+0x7f/0x11b ... watchqueuesetfilter+0x659/0x740 ... _x64sysioctl+0x127/0x190 dosyscall64+0x43/0x90 entrySYSCALL64afterhwframe+0x44/0xae
Allocated by task 611: kasansavestack+0x1e/0x40 _kasankmalloc+0x81/0xa0 watchqueuesetfilter+0x23a/0x740 _x64sysioctl+0x127/0x190 dosyscall64+0x43/0x90 entrySYSCALL64afterhwframe+0x44/0xae
The buggy address belongs to the object at ffff88800d2c66a0 which belongs to the cache kmalloc-32 of size 32 The buggy address is located 28 bytes inside of 32-byte region [ffff88800d2c66a0, ffff88800d2c66c0)
- References
-
- https://git.kernel.org/stable/c/1b09f28f70a5046acd64138075ae3f095238b045
- https://git.kernel.org/stable/c/648895da69ced90ca770fd941c3d9479a9d72c16
- https://git.kernel.org/stable/c/b36588ebbcef74583824c08352e75838d6fb4ff2
- https://git.kernel.org/stable/c/c993ee0f9f81caf5767a50d1faeba39a0dc82af2
- https://security-tracker.debian.org/tracker/CVE-2022-48847
Affected packages
Debian:11 / linux
Package
- Name
- linux
- Purl
- pkg:deb/debian/linux?arch=source
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed5.10.106-1
Debian:12 / linux
Package
- Name
- linux
- Purl
- pkg:deb/debian/linux?arch=source
Debian:13 / linux
Package
- Name
- linux
- Purl
- pkg:deb/debian/linux?arch=source