CVE-2022-49062
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2022-49062
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-49062.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2022-49062
- Downstream
- Related
- Published
- 2025-02-26T01:54:31Z
- Modified
- 2025-10-21T08:39:07.747208Z
- Severity
-
- 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- cachefiles: Fix KASAN slab-out-of-bounds in cachefiles_set_volume_xattr
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
cachefiles: Fix KASAN slab-out-of-bounds in cachefilessetvolume_xattr
Use the actual length of volume coherency data when setting the xattr to avoid the following KASAN report.
BUG: KASAN: slab-out-of-bounds in cachefilessetvolume_xattr+0xa0/0x350 [cachefiles] Write of size 4 at addr ffff888101e02af4 by task kworker/6:0/1347
CPU: 6 PID: 1347 Comm: kworker/6:0 Kdump: loaded Not tainted 5.18.0-rc1-nfs-fscache-netfs+ #13 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-4.fc34 04/01/2014 Workqueue: events fscachecreatevolumework [fscache] Call Trace: <TASK> dumpstacklvl+0x45/0x5a printreport.cold+0x5e/0x5db ? _locktextstart+0x8/0x8 ? cachefilessetvolumexattr+0xa0/0x350 [cachefiles] kasanreport+0xab/0x120 ? cachefilessetvolumexattr+0xa0/0x350 [cachefiles] kasancheckrange+0xf5/0x1d0 memcpy+0x39/0x60 cachefilessetvolumexattr+0xa0/0x350 [cachefiles] cachefilesacquirevolume+0x2be/0x500 [cachefiles] ? _cachefilesfreevolume+0x90/0x90 [cachefiles] fscachecreatevolumework+0x68/0x160 [fscache] processonework+0x3b7/0x6a0 workerthread+0x2c4/0x650 ? processonework+0x6a0/0x6a0 kthread+0x16c/0x1a0 ? kthreadcompleteandexit+0x20/0x20 retfrom_fork+0x22/0x30 </TASK>
Allocated by task 1347: kasansavestack+0x1e/0x40 _kasankmalloc+0x81/0xa0 cachefilessetvolumexattr+0x76/0x350 [cachefiles] cachefilesacquirevolume+0x2be/0x500 [cachefiles] fscachecreatevolumework+0x68/0x160 [fscache] processonework+0x3b7/0x6a0 workerthread+0x2c4/0x650 kthread+0x16c/0x1a0 retfrom_fork+0x22/0x30
The buggy address belongs to the object at ffff888101e02af0 which belongs to the cache kmalloc-8 of size 8 The buggy address is located 4 bytes inside of 8-byte region [ffff888101e02af0, ffff888101e02af8)
The buggy address belongs to the physical page: page:00000000a2292d70 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x101e02 flags: 0x17ffffc0000200(slab|node=0|zone=2|lastcpupid=0x1fffff) raw: 0017ffffc0000200 0000000000000000 dead000000000001 ffff888100042280 raw: 0000000000000000 0000000080660066 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected
Memory state around the buggy address: ffff888101e02980: fc 00 fc fc fc fc 00 fc fc fc fc 00 fc fc fc fc ffff888101e02a00: 00 fc fc fc fc 00 fc fc fc fc 00 fc fc fc fc 00
ffff888101e02a80: fc fc fc fc 00 fc fc fc fc 00 fc fc fc fc 04 fc ^ ffff888101e02b00: fc fc fc 00 fc fc fc fc 00 fc fc fc fc 00 fc fc ffff888101e02b80: fc fc 00 fc fc fc fc 00 fc fc fc fc 00 fc fc fc ==================================================================
- References
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced413a4a6b0b5553f2423d210f65e98c211b99c3f8Fixed09a5df1b88c8f126c8ff9938edf160edd4e92f42
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced413a4a6b0b5553f2423d210f65e98c211b99c3f8Fixed7b2f6c306601240635c72caa61f682e74d4591b2
Database specific
vanir_signatures
[
{
"digest": {
"line_hashes": [
"56609701976063551676407020379566478849",
"263839271204724261135820766354435658287",
"215496576014777417382588584182879459711",
"113013149506380860531123007493358893109"
],
"threshold": 0.9
},
"target": {
"file": "fs/cachefiles/xattr.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7b2f6c306601240635c72caa61f682e74d4591b2",
"id": "CVE-2022-49062-158ce084",
"signature_type": "Line"
},
{
"digest": {
"length": 985.0,
"function_hash": "133437896248202468298341312127846696828"
},
"target": {
"function": "cachefiles_set_volume_xattr",
"file": "fs/cachefiles/xattr.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@09a5df1b88c8f126c8ff9938edf160edd4e92f42",
"id": "CVE-2022-49062-1dcc8253",
"signature_type": "Function"
},
{
"digest": {
"length": 985.0,
"function_hash": "133437896248202468298341312127846696828"
},
"target": {
"function": "cachefiles_set_volume_xattr",
"file": "fs/cachefiles/xattr.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7b2f6c306601240635c72caa61f682e74d4591b2",
"id": "CVE-2022-49062-515fcf9e",
"signature_type": "Function"
},
{
"digest": {
"line_hashes": [
"56609701976063551676407020379566478849",
"263839271204724261135820766354435658287",
"215496576014777417382588584182879459711",
"113013149506380860531123007493358893109"
],
"threshold": 0.9
},
"target": {
"file": "fs/cachefiles/xattr.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@09a5df1b88c8f126c8ff9938edf160edd4e92f42",
"id": "CVE-2022-49062-95c94e5a",
"signature_type": "Line"
}
]