In the Linux kernel, the following vulnerability has been resolved:
dm raid: fix address sanitizer warning in raid_status
There is this warning when using a kernel with the address sanitizer and running this testsuite: https://gitlab.com/cki-project/kernel-tests/-/tree/main/storage/swraid/scsi_raid
================================================================== BUG: KASAN: slab-out-of-bounds in raidstatus+0x1747/0x2820 [dmraid] Read of size 4 at addr ffff888079d2c7e8 by task lvcreate/13319 CPU: 0 PID: 13319 Comm: lvcreate Not tainted 5.18.0-0.rc3.<snip> #1 Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 Call Trace: <TASK> dumpstacklvl+0x6a/0x9c printaddressdescription.constprop.0+0x1f/0x1e0 printreport.cold+0x55/0x244 kasanreport+0xc9/0x100 raidstatus+0x1747/0x2820 [dmraid] dmimameasureontableload+0x4b8/0xca0 [dmmod] tableload+0x35c/0x630 [dmmod] ctlioctl+0x411/0x630 [dmmod] dmctlioctl+0xa/0x10 [dmmod] _x64sysioctl+0x12a/0x1a0 dosyscall64+0x5b/0x80
The warning is caused by reading conf->maxnrstripes in raidstatus. The code in raidstatus reads mddev->private, casts it to struct r5conf and reads the entry maxnrstripes.
However, if we have different raid type than 4/5/6, mddev->private doesn't point to struct r5conf; it may point to struct r0conf, struct r1conf, struct r10conf or struct mpconf. If we cast a pointer to one of these structs to struct r5conf, we will be reading invalid memory and KASAN warns about it.
Fix this bug by reading struct r5conf only if raid type is 4, 5 or 6.
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@49dba30638e091120256a9e89125340795f034dc",
"target": {
"file": "drivers/md/dm-raid.c"
},
"signature_version": "v1",
"deprecated": false,
"digest": {
"line_hashes": [
"269855199655647660574316379661430241179",
"276691980513703928215268427944265155687",
"218030016517554792418974928004740919738",
"86787598810918901218252946492377765017"
],
"threshold": 0.9
},
"id": "CVE-2022-50084-03d9b44e",
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4c233811a49578634d10a5e70a9dfa569d451e94",
"target": {
"function": "raid_status",
"file": "drivers/md/dm-raid.c"
},
"signature_version": "v1",
"deprecated": false,
"digest": {
"function_hash": "68125650037296050298756743263267762390",
"length": 5868.0
},
"id": "CVE-2022-50084-076fd55c",
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d8971b595d7adac3421c21f59918241f1574061e",
"target": {
"file": "drivers/md/dm-raid.c"
},
"signature_version": "v1",
"deprecated": false,
"digest": {
"line_hashes": [
"269855199655647660574316379661430241179",
"276691980513703928215268427944265155687",
"218030016517554792418974928004740919738",
"86787598810918901218252946492377765017"
],
"threshold": 0.9
},
"id": "CVE-2022-50084-289ec825",
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b856ce5f4b55f752144baf17e9d5c415072652c5",
"target": {
"file": "drivers/md/dm-raid.c"
},
"signature_version": "v1",
"deprecated": false,
"digest": {
"line_hashes": [
"269855199655647660574316379661430241179",
"276691980513703928215268427944265155687",
"218030016517554792418974928004740919738",
"86787598810918901218252946492377765017"
],
"threshold": 0.9
},
"id": "CVE-2022-50084-5089ddcb",
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1ae0ebfb576b72c2ef400917a5484ebe7892d80b",
"target": {
"function": "raid_status",
"file": "drivers/md/dm-raid.c"
},
"signature_version": "v1",
"deprecated": false,
"digest": {
"function_hash": "303787757021098067376165898453408149374",
"length": 4229.0
},
"id": "CVE-2022-50084-52431b8e",
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b4c6c07c92b6cba2bf3cb2dfa722debeaf8a8abe",
"target": {
"function": "raid_status",
"file": "drivers/md/dm-raid.c"
},
"signature_version": "v1",
"deprecated": false,
"digest": {
"function_hash": "68125650037296050298756743263267762390",
"length": 5868.0
},
"id": "CVE-2022-50084-583f3d48",
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cb583ca6125ac64c98e9d65128e95ebb5be7d322",
"target": {
"function": "raid_status",
"file": "drivers/md/dm-raid.c"
},
"signature_version": "v1",
"deprecated": false,
"digest": {
"function_hash": "182726271376844002336111480074937443823",
"length": 4927.0
},
"id": "CVE-2022-50084-6ab9a510",
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cb583ca6125ac64c98e9d65128e95ebb5be7d322",
"target": {
"file": "drivers/md/dm-raid.c"
},
"signature_version": "v1",
"deprecated": false,
"digest": {
"line_hashes": [
"269855199655647660574316379661430241179",
"276691980513703928215268427944265155687",
"218030016517554792418974928004740919738",
"86787598810918901218252946492377765017"
],
"threshold": 0.9
},
"id": "CVE-2022-50084-8acb3d8e",
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1fbeea217d8f297fe0e0956a1516d14ba97d0396",
"target": {
"function": "raid_status",
"file": "drivers/md/dm-raid.c"
},
"signature_version": "v1",
"deprecated": false,
"digest": {
"function_hash": "68125650037296050298756743263267762390",
"length": 5868.0
},
"id": "CVE-2022-50084-b1012673",
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@49dba30638e091120256a9e89125340795f034dc",
"target": {
"function": "raid_status",
"file": "drivers/md/dm-raid.c"
},
"signature_version": "v1",
"deprecated": false,
"digest": {
"function_hash": "3764150050065884649803442867029115266",
"length": 4929.0
},
"id": "CVE-2022-50084-b4316419",
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@90b006da40dd42285b24dd3c940d2c32aca9a70b",
"target": {
"function": "raid_status",
"file": "drivers/md/dm-raid.c"
},
"signature_version": "v1",
"deprecated": false,
"digest": {
"function_hash": "233466213584881051894844307342199765131",
"length": 4887.0
},
"id": "CVE-2022-50084-b701c959",
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1fbeea217d8f297fe0e0956a1516d14ba97d0396",
"target": {
"file": "drivers/md/dm-raid.c"
},
"signature_version": "v1",
"deprecated": false,
"digest": {
"line_hashes": [
"269855199655647660574316379661430241179",
"276691980513703928215268427944265155687",
"218030016517554792418974928004740919738",
"86787598810918901218252946492377765017"
],
"threshold": 0.9
},
"id": "CVE-2022-50084-b8f54ec2",
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1ae0ebfb576b72c2ef400917a5484ebe7892d80b",
"target": {
"file": "drivers/md/dm-raid.c"
},
"signature_version": "v1",
"deprecated": false,
"digest": {
"line_hashes": [
"269855199655647660574316379661430241179",
"276691980513703928215268427944265155687",
"124008474370222680385231668819777674378",
"252957272936657315149905501261377347091"
],
"threshold": 0.9
},
"id": "CVE-2022-50084-c1b312fd",
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4c233811a49578634d10a5e70a9dfa569d451e94",
"target": {
"file": "drivers/md/dm-raid.c"
},
"signature_version": "v1",
"deprecated": false,
"digest": {
"line_hashes": [
"269855199655647660574316379661430241179",
"276691980513703928215268427944265155687",
"218030016517554792418974928004740919738",
"86787598810918901218252946492377765017"
],
"threshold": 0.9
},
"id": "CVE-2022-50084-cc68d88b",
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b856ce5f4b55f752144baf17e9d5c415072652c5",
"target": {
"function": "raid_status",
"file": "drivers/md/dm-raid.c"
},
"signature_version": "v1",
"deprecated": false,
"digest": {
"function_hash": "182726271376844002336111480074937443823",
"length": 4927.0
},
"id": "CVE-2022-50084-d53574ee",
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@90b006da40dd42285b24dd3c940d2c32aca9a70b",
"target": {
"file": "drivers/md/dm-raid.c"
},
"signature_version": "v1",
"deprecated": false,
"digest": {
"line_hashes": [
"269855199655647660574316379661430241179",
"276691980513703928215268427944265155687",
"124008474370222680385231668819777674378",
"252957272936657315149905501261377347091"
],
"threshold": 0.9
},
"id": "CVE-2022-50084-d705d3f5",
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d8971b595d7adac3421c21f59918241f1574061e",
"target": {
"function": "raid_status",
"file": "drivers/md/dm-raid.c"
},
"signature_version": "v1",
"deprecated": false,
"digest": {
"function_hash": "68125650037296050298756743263267762390",
"length": 5868.0
},
"id": "CVE-2022-50084-db93bf65",
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b4c6c07c92b6cba2bf3cb2dfa722debeaf8a8abe",
"target": {
"file": "drivers/md/dm-raid.c"
},
"signature_version": "v1",
"deprecated": false,
"digest": {
"line_hashes": [
"269855199655647660574316379661430241179",
"276691980513703928215268427944265155687",
"218030016517554792418974928004740919738",
"86787598810918901218252946492377765017"
],
"threshold": 0.9
},
"id": "CVE-2022-50084-eb7205f7",
"signature_type": "Line"
}
]