In the Linux kernel, the following vulnerability has been resolved:
md/bitmap: don't set sb values if can't pass sanity check
If bitmap area contains invalid data, kernel will crash then mdadm triggers "Segmentation fault". This is cluster-md speical bug. In non-clustered env, mdadm will handle broken metadata case. In clustered array, only kernel space handles bitmap slot info. But even this bug only happened in clustered env, current sanity check is wrong, the code should be changed.
How to trigger: (faulty injection)
dd if=/dev/zero bs=1M count=1 oflag=direct of=/dev/sda dd if=/dev/zero bs=1M count=1 oflag=direct of=/dev/sdb mdadm -C /dev/md0 -b clustered -e 1.2 -n 2 -l mirror /dev/sda /dev/sdb mdadm -Ss echo aaa > magic.txt == below modifying slot 2 bitmap data == dd if=magic.txt of=/dev/sda seek=16384 bs=1 count=3 <== destroy magic dd if=/dev/zero of=/dev/sda seek=16436 bs=1 count=4 <== ZERO chunksize mdadm -A /dev/md0 /dev/sda /dev/sdb == kernel crashes. mdadm outputs "Segmentation fault" ==
Reason of kernel crash:
In mdbitmapreadsb (called by mdbitmapcreate), bad bitmap magic didn't block chunksize assignment, and zero value made DIVROUNDUPSECTOR_T() trigger "divide error".
Crash log:
kernel: md: md0 stopped. kernel: md/raid1:md0: not clean -- starting background reconstruction kernel: md/raid1:md0: active with 2 out of 2 mirrors kernel: dlm: ... ... kernel: md-cluster: Joined cluster 44810aba-38bb-e6b8-daca-bc97a0b254aa slot 1 kernel: md0: invalid bitmap file superblock: bad magic kernel: mdbitmapcopyfromslot can't get bitmap from slot 2 kernel: md-cluster: Could not gather bitmaps from slot 2 kernel: divide error: 0000 [#1] SMP NOPTI kernel: CPU: 0 PID: 1603 Comm: mdadm Not tainted 5.14.6-1-default kernel: Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) kernel: RIP: 0010:mdbitmapcreate+0x1d1/0x850 [mdmod] kernel: RSP: 0018:ffffc22ac0843ba0 EFLAGS: 00010246 kernel: ... ... kernel: Call Trace: kernel: ? dlmlocksync+0xd0/0xd0 [mdcluster 77fe..7a0] kernel: mdbitmapcopyfromslot+0x2c/0x290 [mdmod 24ea..d3a] kernel: loadbitmaps+0xec/0x210 [mdcluster 77fe..7a0] kernel: mdbitmapload+0x81/0x1e0 [mdmod 24ea..d3a] kernel: domdrun+0x30/0x100 [mdmod 24ea..d3a] kernel: mdioctl+0x1290/0x15a0 [mdmod 24ea....d3a] kernel: ? mddevunlock+0xaa/0x130 [mdmod 24ea..d3a] kernel: ? blkdevioctl+0xb1/0x2b0 kernel: blockioctl+0x3b/0x40 kernel: _x64sysioctl+0x7f/0xb0 kernel: dosyscall64+0x59/0x80 kernel: ? exittousermodeprepare+0x1ab/0x230 kernel: ? syscallexittousermode+0x18/0x40 kernel: ? dosyscall64+0x69/0x80 kernel: entrySYSCALL64afterhwframe+0x44/0xae kernel: RIP: 0033:0x7f4a15fa722b kernel: ... ... kernel: ---[ end trace 8afa7612f559c868 ]--- kernel: RIP: 0010:mdbitmapcreate+0x1d1/0x850 [md_mod]
[
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"269593379738596411160146635617863155703",
"118419672671470246952381837373323587822",
"99206719061396092183299012432271402717",
"289817842398569549547023838364068844954",
"231427492037791889255625994808846049240",
"282335880339987093789335548875926514127",
"165540697938102772077680113387937957774",
"125255095721957588697441247724692155828",
"89480525812189096911081790101014110020",
"100256506743970530529739952020515009050",
"38227629805066557846827328251835183091",
"76985072188229009327576117367391801150",
"8423356296164024840936047555649726782",
"231840402472463134695269263309675096785",
"323526355424714593128508483492258119463",
"193519431452827856321725795692051251820",
"276400862606816634225905335928672157060",
"68433078479294508431892773098717140002",
"180288295319140971956845154256092157954",
"300524963254594988230370141874534304292",
"8539950548979846276557780739112067664",
"289611826282075596430612373394477735551",
"261727410283143264457467268236336321118",
"35888108906710553013554210198961457521",
"303471510186428794002139278004606923571",
"117404708908191183730979491877954170182",
"298568356758149507438946117439212795524",
"215603522368830601260271571939003791527",
"23667812590314552977007136206442955856",
"40538756069658555724645131444564597055"
]
},
"target": {
"file": "drivers/md/md-bitmap.c"
},
"id": "CVE-2022-49526-2b6f303a",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@27f672af28a8e9b783ff7f0eaf7ef2fbd5a2f4ba",
"signature_type": "Line"
},
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"269593379738596411160146635617863155703",
"118419672671470246952381837373323587822",
"99206719061396092183299012432271402717",
"289817842398569549547023838364068844954",
"231427492037791889255625994808846049240",
"282335880339987093789335548875926514127",
"165540697938102772077680113387937957774",
"125255095721957588697441247724692155828",
"89480525812189096911081790101014110020",
"100256506743970530529739952020515009050",
"38227629805066557846827328251835183091",
"76985072188229009327576117367391801150",
"8423356296164024840936047555649726782",
"231840402472463134695269263309675096785",
"323526355424714593128508483492258119463",
"193519431452827856321725795692051251820",
"276400862606816634225905335928672157060",
"68433078479294508431892773098717140002",
"180288295319140971956845154256092157954",
"300524963254594988230370141874534304292",
"8539950548979846276557780739112067664",
"289611826282075596430612373394477735551",
"261727410283143264457467268236336321118",
"35888108906710553013554210198961457521",
"303471510186428794002139278004606923571",
"117404708908191183730979491877954170182",
"298568356758149507438946117439212795524",
"215603522368830601260271571939003791527",
"23667812590314552977007136206442955856",
"40538756069658555724645131444564597055"
]
},
"target": {
"file": "drivers/md/md-bitmap.c"
},
"id": "CVE-2022-49526-31432e49",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@422e8f7ba1e08c8e0e88d375bcb550bc2bbfe96d",
"signature_type": "Line"
},
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"function_hash": "242883799544294271102442669573189462816",
"length": 4133.0
},
"target": {
"function": "md_bitmap_read_sb",
"file": "drivers/md/md-bitmap.c"
},
"id": "CVE-2022-49526-582a7c2a",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@422e8f7ba1e08c8e0e88d375bcb550bc2bbfe96d",
"signature_type": "Function"
},
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"function_hash": "29245223579172442411871828673329774298",
"length": 4143.0
},
"target": {
"function": "md_bitmap_read_sb",
"file": "drivers/md/md-bitmap.c"
},
"id": "CVE-2022-49526-5d952d4f",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d8f1558e1daf54f53a90b4c5700ae3e3a4b13412",
"signature_type": "Function"
},
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"269593379738596411160146635617863155703",
"118419672671470246952381837373323587822",
"99206719061396092183299012432271402717",
"289817842398569549547023838364068844954",
"231427492037791889255625994808846049240",
"282335880339987093789335548875926514127",
"165540697938102772077680113387937957774",
"125255095721957588697441247724692155828",
"89480525812189096911081790101014110020",
"100256506743970530529739952020515009050",
"38227629805066557846827328251835183091",
"76985072188229009327576117367391801150",
"8423356296164024840936047555649726782",
"231840402472463134695269263309675096785",
"323526355424714593128508483492258119463",
"193519431452827856321725795692051251820",
"276400862606816634225905335928672157060",
"68433078479294508431892773098717140002",
"180288295319140971956845154256092157954",
"300524963254594988230370141874534304292",
"8539950548979846276557780739112067664",
"289611826282075596430612373394477735551",
"261727410283143264457467268236336321118",
"35888108906710553013554210198961457521",
"303471510186428794002139278004606923571",
"117404708908191183730979491877954170182",
"298568356758149507438946117439212795524",
"215603522368830601260271571939003791527",
"23667812590314552977007136206442955856",
"40538756069658555724645131444564597055"
]
},
"target": {
"file": "drivers/md/md-bitmap.c"
},
"id": "CVE-2022-49526-5dcf48be",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cf9392282a2cf5a8d83dd1c5aa1a097e12f172bc",
"signature_type": "Line"
},
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"269593379738596411160146635617863155703",
"118419672671470246952381837373323587822",
"99206719061396092183299012432271402717",
"289817842398569549547023838364068844954",
"231427492037791889255625994808846049240",
"282335880339987093789335548875926514127",
"165540697938102772077680113387937957774",
"125255095721957588697441247724692155828",
"89480525812189096911081790101014110020",
"100256506743970530529739952020515009050",
"38227629805066557846827328251835183091",
"76985072188229009327576117367391801150",
"8423356296164024840936047555649726782",
"231840402472463134695269263309675096785",
"323526355424714593128508483492258119463",
"193519431452827856321725795692051251820",
"276400862606816634225905335928672157060",
"68433078479294508431892773098717140002",
"180288295319140971956845154256092157954",
"300524963254594988230370141874534304292",
"8539950548979846276557780739112067664",
"289611826282075596430612373394477735551",
"261727410283143264457467268236336321118",
"35888108906710553013554210198961457521",
"303471510186428794002139278004606923571",
"117404708908191183730979491877954170182",
"298568356758149507438946117439212795524",
"215603522368830601260271571939003791527",
"23667812590314552977007136206442955856",
"40538756069658555724645131444564597055"
]
},
"target": {
"file": "drivers/md/md-bitmap.c"
},
"id": "CVE-2022-49526-7740bb2b",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e68cb83a57a458b01c9739e2ad9cb70b04d1e6d2",
"signature_type": "Line"
},
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"function_hash": "29245223579172442411871828673329774298",
"length": 4143.0
},
"target": {
"function": "md_bitmap_read_sb",
"file": "drivers/md/md-bitmap.c"
},
"id": "CVE-2022-49526-93c684f1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cf9392282a2cf5a8d83dd1c5aa1a097e12f172bc",
"signature_type": "Function"
},
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"function_hash": "29245223579172442411871828673329774298",
"length": 4143.0
},
"target": {
"function": "md_bitmap_read_sb",
"file": "drivers/md/md-bitmap.c"
},
"id": "CVE-2022-49526-99b552d9",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e68cb83a57a458b01c9739e2ad9cb70b04d1e6d2",
"signature_type": "Function"
},
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"function_hash": "29245223579172442411871828673329774298",
"length": 4143.0
},
"target": {
"function": "md_bitmap_read_sb",
"file": "drivers/md/md-bitmap.c"
},
"id": "CVE-2022-49526-abc710c3",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e69e93120f6219b9cc4fba3b515b6ababd8548aa",
"signature_type": "Function"
},
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"function_hash": "29245223579172442411871828673329774298",
"length": 4143.0
},
"target": {
"function": "md_bitmap_read_sb",
"file": "drivers/md/md-bitmap.c"
},
"id": "CVE-2022-49526-ad8e825b",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@27f672af28a8e9b783ff7f0eaf7ef2fbd5a2f4ba",
"signature_type": "Function"
},
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"269593379738596411160146635617863155703",
"118419672671470246952381837373323587822",
"99206719061396092183299012432271402717",
"289817842398569549547023838364068844954",
"231427492037791889255625994808846049240",
"282335880339987093789335548875926514127",
"165540697938102772077680113387937957774",
"125255095721957588697441247724692155828",
"89480525812189096911081790101014110020",
"100256506743970530529739952020515009050",
"38227629805066557846827328251835183091",
"76985072188229009327576117367391801150",
"8423356296164024840936047555649726782",
"231840402472463134695269263309675096785",
"323526355424714593128508483492258119463",
"193519431452827856321725795692051251820",
"276400862606816634225905335928672157060",
"68433078479294508431892773098717140002",
"180288295319140971956845154256092157954",
"300524963254594988230370141874534304292",
"8539950548979846276557780739112067664",
"289611826282075596430612373394477735551",
"261727410283143264457467268236336321118",
"35888108906710553013554210198961457521",
"303471510186428794002139278004606923571",
"117404708908191183730979491877954170182",
"298568356758149507438946117439212795524",
"215603522368830601260271571939003791527",
"23667812590314552977007136206442955856",
"40538756069658555724645131444564597055"
]
},
"target": {
"file": "drivers/md/md-bitmap.c"
},
"id": "CVE-2022-49526-b2631e52",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0959aa00f9765bd8c654b1365012e41b51c733cc",
"signature_type": "Line"
},
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"269593379738596411160146635617863155703",
"118419672671470246952381837373323587822",
"99206719061396092183299012432271402717",
"289817842398569549547023838364068844954",
"231427492037791889255625994808846049240",
"282335880339987093789335548875926514127",
"165540697938102772077680113387937957774",
"125255095721957588697441247724692155828",
"89480525812189096911081790101014110020",
"100256506743970530529739952020515009050",
"38227629805066557846827328251835183091",
"76985072188229009327576117367391801150",
"8423356296164024840936047555649726782",
"231840402472463134695269263309675096785",
"323526355424714593128508483492258119463",
"193519431452827856321725795692051251820",
"276400862606816634225905335928672157060",
"68433078479294508431892773098717140002",
"180288295319140971956845154256092157954",
"300524963254594988230370141874534304292",
"8539950548979846276557780739112067664",
"289611826282075596430612373394477735551",
"261727410283143264457467268236336321118",
"35888108906710553013554210198961457521",
"303471510186428794002139278004606923571",
"117404708908191183730979491877954170182",
"298568356758149507438946117439212795524",
"215603522368830601260271571939003791527",
"23667812590314552977007136206442955856",
"40538756069658555724645131444564597055"
]
},
"target": {
"file": "drivers/md/md-bitmap.c"
},
"id": "CVE-2022-49526-b79ae11a",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e69e93120f6219b9cc4fba3b515b6ababd8548aa",
"signature_type": "Line"
},
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"function_hash": "242883799544294271102442669573189462816",
"length": 4133.0
},
"target": {
"function": "md_bitmap_read_sb",
"file": "drivers/md/md-bitmap.c"
},
"id": "CVE-2022-49526-cdc233c2",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0959aa00f9765bd8c654b1365012e41b51c733cc",
"signature_type": "Function"
},
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"269593379738596411160146635617863155703",
"118419672671470246952381837373323587822",
"99206719061396092183299012432271402717",
"289817842398569549547023838364068844954",
"231427492037791889255625994808846049240",
"282335880339987093789335548875926514127",
"165540697938102772077680113387937957774",
"125255095721957588697441247724692155828",
"89480525812189096911081790101014110020",
"100256506743970530529739952020515009050",
"38227629805066557846827328251835183091",
"76985072188229009327576117367391801150",
"8423356296164024840936047555649726782",
"231840402472463134695269263309675096785",
"323526355424714593128508483492258119463",
"193519431452827856321725795692051251820",
"276400862606816634225905335928672157060",
"68433078479294508431892773098717140002",
"180288295319140971956845154256092157954",
"300524963254594988230370141874534304292",
"8539950548979846276557780739112067664",
"289611826282075596430612373394477735551",
"261727410283143264457467268236336321118",
"35888108906710553013554210198961457521",
"303471510186428794002139278004606923571",
"117404708908191183730979491877954170182",
"298568356758149507438946117439212795524",
"215603522368830601260271571939003791527",
"23667812590314552977007136206442955856",
"40538756069658555724645131444564597055"
]
},
"target": {
"file": "drivers/md/md-bitmap.c"
},
"id": "CVE-2022-49526-db873e25",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d8f1558e1daf54f53a90b4c5700ae3e3a4b13412",
"signature_type": "Line"
}
]