In the Linux kernel, the following vulnerability has been resolved:
dm raid: fix accesses beyond end of raid member array
On dm-raid table load (using raidctr), dm-raid allocates an array rs->devs[rs->raiddisks] for the raid device members. rs->raid_disks is defined by the number of raid metadata and image tupples passed into the target's constructor.
In the case of RAID layout changes being requested, that number can be different from the current number of members for existing raid sets as defined in their superblocks. Example RAID layout changes include: - raid1 legs being added/removed - raid4/5/6/10 number of stripes changed (stripe reshaping) - takeover to higher raid level (e.g. raid5 -> raid6)
When accessing array members, rs->raiddisks must be used in control loops instead of the potentially larger value in rs->md.raiddisks. Otherwise it will cause memory access beyond the end of the rs->devs array.
Fix this by changing code that is prone to out-of-bounds access. Also fix validateraidredundancy() to validate all devices that are added. Also, use braces to help clean up raiditeratedevices().
The out-of-bounds memory accesses was discovered using KASAN.
This commit was verified to pass all LVM2 RAID tests (with KASAN enabled).
{
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49674.json",
"cna_assigner": "Linux"
}[
{
"target": {
"file": "drivers/md/dm-raid.c"
},
"id": "CVE-2022-49674-07d193ae",
"digest": {
"line_hashes": [
"330020620202217460945209352405398043146",
"704016182789750680556149069184302117",
"83455170366771351445908421045841809727",
"174534517584991084701274629354739843272",
"96994982241739861003743093819338593549",
"287737897731589147888796915867529950584",
"163273801249478482885074488576048703410",
"13526338603370498341584626319531945829",
"296141920807475835941804171035027556878",
"319443261847428053250991099819557628464",
"201019362572123832701140922113033956496",
"125832487407780230525844722367232622710",
"24172334421244810497007679168711269251",
"210638809482168890036976575355286290849",
"172087715699153206697065265878969125472",
"205025710962850018151577669619438425062",
"45653372530262214877416549204269705430",
"293662982190627239830769593336795454822",
"101888687557340163725802575471973010587",
"259096957711516134651913197466160800637",
"67667255424754307770839229633513566680",
"60587328221435545047169753708425923164",
"62581958876549743347229580069112488460",
"9648525468845411749538778854615116461",
"202567577390522358378136257402103573279",
"123699257885266798074533970589249869685",
"322986737697588846724435061814651038982",
"58492171781333060423044643936620055203",
"133414744950694686464413794908928952147",
"3635098251708203499889798814014394734",
"235430658397364936693103903779609247102",
"277826544257934791952818252337277934677",
"100366004700822125852010447419307043038",
"104594830691496027006687579546244797539"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@90de15357504c8097ab29769dc6852e16281e9e8",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line"
},
{
"target": {
"file": "drivers/md/dm-raid.c"
},
"id": "CVE-2022-49674-12823240",
"digest": {
"line_hashes": [
"330020620202217460945209352405398043146",
"704016182789750680556149069184302117",
"83455170366771351445908421045841809727",
"174534517584991084701274629354739843272",
"96994982241739861003743093819338593549",
"287737897731589147888796915867529950584",
"281747522520624248709383285430067794477",
"266979125387741868274567971910880158682",
"287876721550318791280914301050952255289",
"319443261847428053250991099819557628464",
"201019362572123832701140922113033956496",
"125832487407780230525844722367232622710",
"24172334421244810497007679168711269251",
"210638809482168890036976575355286290849",
"172087715699153206697065265878969125472",
"205025710962850018151577669619438425062",
"45653372530262214877416549204269705430",
"293662982190627239830769593336795454822",
"101888687557340163725802575471973010587",
"259096957711516134651913197466160800637",
"67667255424754307770839229633513566680",
"60587328221435545047169753708425923164",
"62581958876549743347229580069112488460",
"9648525468845411749538778854615116461",
"202567577390522358378136257402103573279",
"123699257885266798074533970589249869685",
"322986737697588846724435061814651038982",
"58492171781333060423044643936620055203",
"133414744950694686464413794908928952147",
"3635098251708203499889798814014394734",
"235430658397364936693103903779609247102",
"277826544257934791952818252337277934677",
"100366004700822125852010447419307043038",
"104594830691496027006687579546244797539"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5e161a8826b63c0b8b43e4a7fad1f956780f42ab",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line"
},
{
"target": {
"function": "validate_raid_redundancy",
"file": "drivers/md/dm-raid.c"
},
"id": "CVE-2022-49674-20514d56",
"digest": {
"function_hash": "191363813132644657905195586173025931951",
"length": 1463.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6352b2f4d8e95ec0ae576d7705435d64cfa29503",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
},
{
"target": {
"function": "validate_raid_redundancy",
"file": "drivers/md/dm-raid.c"
},
"id": "CVE-2022-49674-24593139",
"digest": {
"function_hash": "191363813132644657905195586173025931951",
"length": 1463.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bcff98500ea3b4e7615ec31d2bdd326bc1ef5134",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
},
{
"target": {
"file": "drivers/md/dm-raid.c"
},
"id": "CVE-2022-49674-2936e69f",
"digest": {
"line_hashes": [
"330020620202217460945209352405398043146",
"704016182789750680556149069184302117",
"83455170366771351445908421045841809727",
"174534517584991084701274629354739843272",
"96994982241739861003743093819338593549",
"287737897731589147888796915867529950584",
"163273801249478482885074488576048703410",
"13526338603370498341584626319531945829",
"296141920807475835941804171035027556878",
"319443261847428053250991099819557628464",
"201019362572123832701140922113033956496",
"125832487407780230525844722367232622710",
"24172334421244810497007679168711269251",
"210638809482168890036976575355286290849",
"172087715699153206697065265878969125472",
"205025710962850018151577669619438425062",
"45653372530262214877416549204269705430",
"293662982190627239830769593336795454822",
"101888687557340163725802575471973010587",
"259096957711516134651913197466160800637",
"67667255424754307770839229633513566680",
"60587328221435545047169753708425923164",
"62581958876549743347229580069112488460",
"9648525468845411749538778854615116461",
"202567577390522358378136257402103573279",
"123699257885266798074533970589249869685",
"322986737697588846724435061814651038982",
"58492171781333060423044643936620055203",
"133414744950694686464413794908928952147",
"3635098251708203499889798814014394734",
"235430658397364936693103903779609247102",
"277826544257934791952818252337277934677",
"100366004700822125852010447419307043038",
"104594830691496027006687579546244797539"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bcff98500ea3b4e7615ec31d2bdd326bc1ef5134",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line"
},
{
"target": {
"function": "validate_raid_redundancy",
"file": "drivers/md/dm-raid.c"
},
"id": "CVE-2022-49674-3145bd07",
"digest": {
"function_hash": "191363813132644657905195586173025931951",
"length": 1463.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@df1a5ab0dd0775f2ea101c71f2addbc4c0ea0f85",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
},
{
"target": {
"file": "drivers/md/dm-raid.c"
},
"id": "CVE-2022-49674-3e9d9c5e",
"digest": {
"line_hashes": [
"330020620202217460945209352405398043146",
"704016182789750680556149069184302117",
"83455170366771351445908421045841809727",
"174534517584991084701274629354739843272",
"96994982241739861003743093819338593549",
"287737897731589147888796915867529950584",
"163273801249478482885074488576048703410",
"13526338603370498341584626319531945829",
"296141920807475835941804171035027556878",
"319443261847428053250991099819557628464",
"201019362572123832701140922113033956496",
"125832487407780230525844722367232622710",
"24172334421244810497007679168711269251",
"210638809482168890036976575355286290849",
"172087715699153206697065265878969125472",
"205025710962850018151577669619438425062",
"45653372530262214877416549204269705430",
"293662982190627239830769593336795454822",
"101888687557340163725802575471973010587",
"259096957711516134651913197466160800637",
"67667255424754307770839229633513566680",
"60587328221435545047169753708425923164",
"62581958876549743347229580069112488460",
"9648525468845411749538778854615116461",
"202567577390522358378136257402103573279",
"123699257885266798074533970589249869685",
"322986737697588846724435061814651038982",
"58492171781333060423044643936620055203",
"133414744950694686464413794908928952147",
"3635098251708203499889798814014394734",
"235430658397364936693103903779609247102",
"277826544257934791952818252337277934677",
"100366004700822125852010447419307043038",
"104594830691496027006687579546244797539"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9bf2b0757b04c78dc5d6e3a198acca98457b32a1",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line"
},
{
"target": {
"function": "validate_raid_redundancy",
"file": "drivers/md/dm-raid.c"
},
"id": "CVE-2022-49674-47461287",
"digest": {
"function_hash": "191363813132644657905195586173025931951",
"length": 1463.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9bf2b0757b04c78dc5d6e3a198acca98457b32a1",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
},
{
"target": {
"function": "__rdev_sectors",
"file": "drivers/md/dm-raid.c"
},
"id": "CVE-2022-49674-4d559511",
"digest": {
"function_hash": "31685707425610628390011335314277083594",
"length": 277.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9bf2b0757b04c78dc5d6e3a198acca98457b32a1",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
},
{
"target": {
"function": "__rdev_sectors",
"file": "drivers/md/dm-raid.c"
},
"id": "CVE-2022-49674-4e9bf6e6",
"digest": {
"function_hash": "31685707425610628390011335314277083594",
"length": 277.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6352b2f4d8e95ec0ae576d7705435d64cfa29503",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
},
{
"target": {
"file": "drivers/md/dm-raid.c"
},
"id": "CVE-2022-49674-58c7d848",
"digest": {
"line_hashes": [
"330020620202217460945209352405398043146",
"704016182789750680556149069184302117",
"83455170366771351445908421045841809727",
"174534517584991084701274629354739843272",
"96994982241739861003743093819338593549",
"287737897731589147888796915867529950584",
"163273801249478482885074488576048703410",
"13526338603370498341584626319531945829",
"296141920807475835941804171035027556878",
"319443261847428053250991099819557628464",
"201019362572123832701140922113033956496",
"125832487407780230525844722367232622710",
"24172334421244810497007679168711269251",
"210638809482168890036976575355286290849",
"172087715699153206697065265878969125472",
"205025710962850018151577669619438425062",
"45653372530262214877416549204269705430",
"293662982190627239830769593336795454822",
"101888687557340163725802575471973010587",
"259096957711516134651913197466160800637",
"67667255424754307770839229633513566680",
"60587328221435545047169753708425923164",
"62581958876549743347229580069112488460",
"9648525468845411749538778854615116461",
"202567577390522358378136257402103573279",
"123699257885266798074533970589249869685",
"322986737697588846724435061814651038982",
"58492171781333060423044643936620055203",
"133414744950694686464413794908928952147",
"3635098251708203499889798814014394734",
"235430658397364936693103903779609247102",
"277826544257934791952818252337277934677",
"100366004700822125852010447419307043038",
"104594830691496027006687579546244797539"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@332bd0778775d0cf105c4b9e03e460b590749916",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line"
},
{
"target": {
"function": "raid_iterate_devices",
"file": "drivers/md/dm-raid.c"
},
"id": "CVE-2022-49674-5c98126b",
"digest": {
"function_hash": "187271641569668872979013709375151490279",
"length": 358.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@90de15357504c8097ab29769dc6852e16281e9e8",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
},
{
"target": {
"function": "raid_iterate_devices",
"file": "drivers/md/dm-raid.c"
},
"id": "CVE-2022-49674-686a3e08",
"digest": {
"function_hash": "187271641569668872979013709375151490279",
"length": 358.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bcff98500ea3b4e7615ec31d2bdd326bc1ef5134",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
},
{
"target": {
"function": "__rdev_sectors",
"file": "drivers/md/dm-raid.c"
},
"id": "CVE-2022-49674-8037473d",
"digest": {
"function_hash": "31685707425610628390011335314277083594",
"length": 277.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5e161a8826b63c0b8b43e4a7fad1f956780f42ab",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
},
{
"target": {
"function": "__rdev_sectors",
"file": "drivers/md/dm-raid.c"
},
"id": "CVE-2022-49674-80777920",
"digest": {
"function_hash": "31685707425610628390011335314277083594",
"length": 277.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bcff98500ea3b4e7615ec31d2bdd326bc1ef5134",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
},
{
"target": {
"function": "validate_raid_redundancy",
"file": "drivers/md/dm-raid.c"
},
"id": "CVE-2022-49674-82eb6289",
"digest": {
"function_hash": "111578258557933380888434790167268756952",
"length": 1387.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5e161a8826b63c0b8b43e4a7fad1f956780f42ab",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
},
{
"target": {
"function": "raid_iterate_devices",
"file": "drivers/md/dm-raid.c"
},
"id": "CVE-2022-49674-8b92f7e6",
"digest": {
"function_hash": "187271641569668872979013709375151490279",
"length": 358.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5e161a8826b63c0b8b43e4a7fad1f956780f42ab",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
},
{
"target": {
"function": "__rdev_sectors",
"file": "drivers/md/dm-raid.c"
},
"id": "CVE-2022-49674-8e1022cd",
"digest": {
"function_hash": "31685707425610628390011335314277083594",
"length": 277.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@90de15357504c8097ab29769dc6852e16281e9e8",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
},
{
"target": {
"function": "raid_iterate_devices",
"file": "drivers/md/dm-raid.c"
},
"id": "CVE-2022-49674-92385d82",
"digest": {
"function_hash": "187271641569668872979013709375151490279",
"length": 358.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@df1a5ab0dd0775f2ea101c71f2addbc4c0ea0f85",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
},
{
"target": {
"function": "validate_raid_redundancy",
"file": "drivers/md/dm-raid.c"
},
"id": "CVE-2022-49674-b7cdbee3",
"digest": {
"function_hash": "191363813132644657905195586173025931951",
"length": 1463.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@332bd0778775d0cf105c4b9e03e460b590749916",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
},
{
"target": {
"function": "__rdev_sectors",
"file": "drivers/md/dm-raid.c"
},
"id": "CVE-2022-49674-bc06ef98",
"digest": {
"function_hash": "31685707425610628390011335314277083594",
"length": 277.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@df1a5ab0dd0775f2ea101c71f2addbc4c0ea0f85",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
},
{
"target": {
"function": "raid_iterate_devices",
"file": "drivers/md/dm-raid.c"
},
"id": "CVE-2022-49674-cc51adc5",
"digest": {
"function_hash": "187271641569668872979013709375151490279",
"length": 358.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9bf2b0757b04c78dc5d6e3a198acca98457b32a1",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
},
{
"target": {
"function": "raid_iterate_devices",
"file": "drivers/md/dm-raid.c"
},
"id": "CVE-2022-49674-cc797a0b",
"digest": {
"function_hash": "187271641569668872979013709375151490279",
"length": 358.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6352b2f4d8e95ec0ae576d7705435d64cfa29503",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
},
{
"target": {
"function": "validate_raid_redundancy",
"file": "drivers/md/dm-raid.c"
},
"id": "CVE-2022-49674-d5b32f53",
"digest": {
"function_hash": "191363813132644657905195586173025931951",
"length": 1463.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@90de15357504c8097ab29769dc6852e16281e9e8",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
},
{
"target": {
"file": "drivers/md/dm-raid.c"
},
"id": "CVE-2022-49674-de2138ec",
"digest": {
"line_hashes": [
"330020620202217460945209352405398043146",
"704016182789750680556149069184302117",
"83455170366771351445908421045841809727",
"174534517584991084701274629354739843272",
"96994982241739861003743093819338593549",
"287737897731589147888796915867529950584",
"163273801249478482885074488576048703410",
"13526338603370498341584626319531945829",
"296141920807475835941804171035027556878",
"319443261847428053250991099819557628464",
"201019362572123832701140922113033956496",
"125832487407780230525844722367232622710",
"24172334421244810497007679168711269251",
"210638809482168890036976575355286290849",
"172087715699153206697065265878969125472",
"205025710962850018151577669619438425062",
"45653372530262214877416549204269705430",
"293662982190627239830769593336795454822",
"101888687557340163725802575471973010587",
"259096957711516134651913197466160800637",
"67667255424754307770839229633513566680",
"60587328221435545047169753708425923164",
"62581958876549743347229580069112488460",
"9648525468845411749538778854615116461",
"202567577390522358378136257402103573279",
"123699257885266798074533970589249869685",
"322986737697588846724435061814651038982",
"58492171781333060423044643936620055203",
"133414744950694686464413794908928952147",
"3635098251708203499889798814014394734",
"235430658397364936693103903779609247102",
"277826544257934791952818252337277934677",
"100366004700822125852010447419307043038",
"104594830691496027006687579546244797539"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@df1a5ab0dd0775f2ea101c71f2addbc4c0ea0f85",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line"
},
{
"target": {
"file": "drivers/md/dm-raid.c"
},
"id": "CVE-2022-49674-dea7e3e6",
"digest": {
"line_hashes": [
"330020620202217460945209352405398043146",
"704016182789750680556149069184302117",
"83455170366771351445908421045841809727",
"174534517584991084701274629354739843272",
"96994982241739861003743093819338593549",
"287737897731589147888796915867529950584",
"163273801249478482885074488576048703410",
"13526338603370498341584626319531945829",
"296141920807475835941804171035027556878",
"319443261847428053250991099819557628464",
"201019362572123832701140922113033956496",
"125832487407780230525844722367232622710",
"24172334421244810497007679168711269251",
"210638809482168890036976575355286290849",
"172087715699153206697065265878969125472",
"205025710962850018151577669619438425062",
"45653372530262214877416549204269705430",
"293662982190627239830769593336795454822",
"101888687557340163725802575471973010587",
"259096957711516134651913197466160800637",
"67667255424754307770839229633513566680",
"60587328221435545047169753708425923164",
"62581958876549743347229580069112488460",
"9648525468845411749538778854615116461",
"202567577390522358378136257402103573279",
"123699257885266798074533970589249869685",
"322986737697588846724435061814651038982",
"58492171781333060423044643936620055203",
"133414744950694686464413794908928952147",
"3635098251708203499889798814014394734",
"235430658397364936693103903779609247102",
"277826544257934791952818252337277934677",
"100366004700822125852010447419307043038",
"104594830691496027006687579546244797539"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6352b2f4d8e95ec0ae576d7705435d64cfa29503",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line"
},
{
"target": {
"function": "raid_iterate_devices",
"file": "drivers/md/dm-raid.c"
},
"id": "CVE-2022-49674-e5479f22",
"digest": {
"function_hash": "187271641569668872979013709375151490279",
"length": 358.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@332bd0778775d0cf105c4b9e03e460b590749916",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
},
{
"target": {
"function": "__rdev_sectors",
"file": "drivers/md/dm-raid.c"
},
"id": "CVE-2022-49674-e883a628",
"digest": {
"function_hash": "31685707425610628390011335314277083594",
"length": 277.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@332bd0778775d0cf105c4b9e03e460b590749916",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
}
]
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-49674.json"