CVE-2022-50084
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2022-50084
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-50084.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2022-50084
- Related
- Published
- 2025-06-18T11:15:37Z
- Modified
- 2025-06-18T16:48:11.083548Z
- Downstream
- Summary
- [none]
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
dm raid: fix address sanitizer warning in raid_status
There is this warning when using a kernel with the address sanitizer and running this testsuite: https://gitlab.com/cki-project/kernel-tests/-/tree/main/storage/swraid/scsi_raid
================================================================== BUG: KASAN: slab-out-of-bounds in raidstatus+0x1747/0x2820 [dmraid] Read of size 4 at addr ffff888079d2c7e8 by task lvcreate/13319 CPU: 0 PID: 13319 Comm: lvcreate Not tainted 5.18.0-0.rc3.<snip> #1 Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 Call Trace: <TASK> dumpstacklvl+0x6a/0x9c printaddressdescription.constprop.0+0x1f/0x1e0 printreport.cold+0x55/0x244 kasanreport+0xc9/0x100 raidstatus+0x1747/0x2820 [dmraid] dmimameasureontableload+0x4b8/0xca0 [dmmod] tableload+0x35c/0x630 [dmmod] ctlioctl+0x411/0x630 [dmmod] dmctlioctl+0xa/0x10 [dmmod] _x64sysioctl+0x12a/0x1a0 dosyscall64+0x5b/0x80
The warning is caused by reading conf->maxnrstripes in raidstatus. The code in raidstatus reads mddev->private, casts it to struct r5conf and reads the entry maxnrstripes.
However, if we have different raid type than 4/5/6, mddev->private doesn't point to struct r5conf; it may point to struct r0conf, struct r1conf, struct r10conf or struct mpconf. If we cast a pointer to one of these structs to struct r5conf, we will be reading invalid memory and KASAN warns about it.
Fix this bug by reading struct r5conf only if raid type is 4, 5 or 6.
- References
-
- https://git.kernel.org/stable/c/1ae0ebfb576b72c2ef400917a5484ebe7892d80b
- https://git.kernel.org/stable/c/1fbeea217d8f297fe0e0956a1516d14ba97d0396
- https://git.kernel.org/stable/c/49dba30638e091120256a9e89125340795f034dc
- https://git.kernel.org/stable/c/4c233811a49578634d10a5e70a9dfa569d451e94
- https://git.kernel.org/stable/c/90b006da40dd42285b24dd3c940d2c32aca9a70b
- https://git.kernel.org/stable/c/b4c6c07c92b6cba2bf3cb2dfa722debeaf8a8abe
- https://git.kernel.org/stable/c/b856ce5f4b55f752144baf17e9d5c415072652c5
- https://git.kernel.org/stable/c/cb583ca6125ac64c98e9d65128e95ebb5be7d322
- https://git.kernel.org/stable/c/d8971b595d7adac3421c21f59918241f1574061e
- https://security-tracker.debian.org/tracker/CVE-2022-50084
Affected packages
Debian:11 / linux
Package
- Name
- linux
- Purl
- pkg:deb/debian/linux?arch=source
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed5.10.140-1
Debian:12 / linux
Package
- Name
- linux
- Purl
- pkg:deb/debian/linux?arch=source
Debian:13 / linux
Package
- Name
- linux
- Purl
- pkg:deb/debian/linux?arch=source