In the Linux kernel, the following vulnerability has been resolved:
module: fix [eshstrndx].shsize=0 OOB access
It is trivial to craft a module to trigger OOB access in this line:
if (info->secstrings[strhdr->sh_size - 1] != '\0') {
BUG: unable to handle page fault for address: ffffc90000aa0fff PGD 100000067 P4D 100000067 PUD 100066067 PMD 10436f067 PTE 0 Oops: 0000 [#1] PREEMPT SMP PTI CPU: 7 PID: 1215 Comm: insmod Not tainted 5.18.0-rc5-00007-g9bf578647087-dirty #10 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-4.fc34 04/01/2014 RIP: 0010:load_module+0x19b/0x2391
[rebased patch onto modules-next]
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49444.json"
}"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-49444.json"
[
{
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"306718885173020909604664980396451015644",
"124987548747047546373239611025910355336",
"138975254544656040080675200762110317509",
"275659751097402064520068917409341062791"
]
},
"signature_type": "Line",
"target": {
"file": "kernel/module/main.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@391e982bfa632b8315235d8be9c0a81374c6a19c",
"id": "CVE-2022-49444-089926c1",
"signature_version": "v1"
},
{
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"306718885173020909604664980396451015644",
"124987548747047546373239611025910355336",
"138975254544656040080675200762110317509",
"275659751097402064520068917409341062791"
]
},
"signature_type": "Line",
"target": {
"file": "kernel/module.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@921630e2e5124a04158129a8f22f4b425e61a858",
"id": "CVE-2022-49444-19f89983",
"signature_version": "v1"
},
{
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"306718885173020909604664980396451015644",
"124987548747047546373239611025910355336",
"138975254544656040080675200762110317509",
"275659751097402064520068917409341062791"
]
},
"signature_type": "Line",
"target": {
"file": "kernel/module.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@09cb6663618a74fe5572a4931ecbf098832e79ec",
"id": "CVE-2022-49444-3aa8b4c6",
"signature_version": "v1"
},
{
"deprecated": false,
"digest": {
"function_hash": "127486534457466177841168890381055755799",
"length": 2932.0
},
"signature_type": "Function",
"target": {
"file": "kernel/module.c",
"function": "elf_validity_check"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@921630e2e5124a04158129a8f22f4b425e61a858",
"id": "CVE-2022-49444-83af044f",
"signature_version": "v1"
},
{
"deprecated": false,
"digest": {
"function_hash": "127486534457466177841168890381055755799",
"length": 2932.0
},
"signature_type": "Function",
"target": {
"file": "kernel/module.c",
"function": "elf_validity_check"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@09cb6663618a74fe5572a4931ecbf098832e79ec",
"id": "CVE-2022-49444-90b784cb",
"signature_version": "v1"
},
{
"deprecated": false,
"digest": {
"function_hash": "127486534457466177841168890381055755799",
"length": 2932.0
},
"signature_type": "Function",
"target": {
"file": "kernel/module/main.c",
"function": "elf_validity_check"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@391e982bfa632b8315235d8be9c0a81374c6a19c",
"id": "CVE-2022-49444-a4440c1c",
"signature_version": "v1"
},
{
"deprecated": false,
"digest": {
"function_hash": "127486534457466177841168890381055755799",
"length": 2932.0
},
"signature_type": "Function",
"target": {
"file": "kernel/module.c",
"function": "elf_validity_check"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@45a76414b6d8b8b39c23fea53b9d20e831ae72a0",
"id": "CVE-2022-49444-e278b4e7",
"signature_version": "v1"
},
{
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"306718885173020909604664980396451015644",
"124987548747047546373239611025910355336",
"138975254544656040080675200762110317509",
"275659751097402064520068917409341062791"
]
},
"signature_type": "Line",
"target": {
"file": "kernel/module.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@45a76414b6d8b8b39c23fea53b9d20e831ae72a0",
"id": "CVE-2022-49444-f1709bb1",
"signature_version": "v1"
}
]