cve-2022-48847
Vulnerability from cvelistv5
Published
2024-07-16 12:25
Modified
2024-11-04 12:17
Severity ?
EPSS score ?
Summary
watch_queue: Fix filter limit check
References
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T15:25:01.608Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/648895da69ced90ca770fd941c3d9479a9d72c16"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/1b09f28f70a5046acd64138075ae3f095238b045"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/b36588ebbcef74583824c08352e75838d6fb4ff2"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/c993ee0f9f81caf5767a50d1faeba39a0dc82af2"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-48847",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-10T16:56:35.105751Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-11T17:34:09.039Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/linux/watch_queue.h",
"kernel/watch_queue.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "648895da69ce",
"status": "affected",
"version": "c73be61cede5",
"versionType": "git"
},
{
"lessThan": "1b09f28f70a5",
"status": "affected",
"version": "c73be61cede5",
"versionType": "git"
},
{
"lessThan": "b36588ebbcef",
"status": "affected",
"version": "c73be61cede5",
"versionType": "git"
},
{
"lessThan": "c993ee0f9f81",
"status": "affected",
"version": "c73be61cede5",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/linux/watch_queue.h",
"kernel/watch_queue.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.8"
},
{
"lessThan": "5.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.106",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.29",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.16.*",
"status": "unaffected",
"version": "5.16.15",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "5.17",
"versionType": "original_commit_for_fix"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwatch_queue: Fix filter limit check\n\nIn watch_queue_set_filter(), there are a couple of places where we check\nthat the filter type value does not exceed what the type_filter bitmap\ncan hold. One place calculates the number of bits by:\n\n if (tf[i].type \u003e= sizeof(wfilter-\u003etype_filter) * 8)\n\nwhich is fine, but the second does:\n\n if (tf[i].type \u003e= sizeof(wfilter-\u003etype_filter) * BITS_PER_LONG)\n\nwhich is not. This can lead to a couple of out-of-bounds writes due to\na too-large type:\n\n (1) __set_bit() on wfilter-\u003etype_filter\n (2) Writing more elements in wfilter-\u003efilters[] than we allocated.\n\nFix this by just using the proper WATCH_TYPE__NR instead, which is the\nnumber of types we actually know about.\n\nThe bug may cause an oops looking something like:\n\n BUG: KASAN: slab-out-of-bounds in watch_queue_set_filter+0x659/0x740\n Write of size 4 at addr ffff88800d2c66bc by task watch_queue_oob/611\n ...\n Call Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0x45/0x59\n print_address_description.constprop.0+0x1f/0x150\n ...\n kasan_report.cold+0x7f/0x11b\n ...\n watch_queue_set_filter+0x659/0x740\n ...\n __x64_sys_ioctl+0x127/0x190\n do_syscall_64+0x43/0x90\n entry_SYSCALL_64_after_hwframe+0x44/0xae\n\n Allocated by task 611:\n kasan_save_stack+0x1e/0x40\n __kasan_kmalloc+0x81/0xa0\n watch_queue_set_filter+0x23a/0x740\n __x64_sys_ioctl+0x127/0x190\n do_syscall_64+0x43/0x90\n entry_SYSCALL_64_after_hwframe+0x44/0xae\n\n The buggy address belongs to the object at ffff88800d2c66a0\n which belongs to the cache kmalloc-32 of size 32\n The buggy address is located 28 bytes inside of\n 32-byte region [ffff88800d2c66a0, ffff88800d2c66c0)"
}
],
"providerMetadata": {
"dateUpdated": "2024-11-04T12:17:44.668Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/648895da69ced90ca770fd941c3d9479a9d72c16"
},
{
"url": "https://git.kernel.org/stable/c/1b09f28f70a5046acd64138075ae3f095238b045"
},
{
"url": "https://git.kernel.org/stable/c/b36588ebbcef74583824c08352e75838d6fb4ff2"
},
{
"url": "https://git.kernel.org/stable/c/c993ee0f9f81caf5767a50d1faeba39a0dc82af2"
}
],
"title": "watch_queue: Fix filter limit check",
"x_generator": {
"engine": "bippy-9e1c9544281a"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2022-48847",
"datePublished": "2024-07-16T12:25:15.804Z",
"dateReserved": "2024-07-16T11:38:08.911Z",
"dateUpdated": "2024-11-04T12:17:44.668Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2022-48847\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-07-16T13:15:11.950\",\"lastModified\":\"2024-11-21T07:34:12.187\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nwatch_queue: Fix filter limit check\\n\\nIn watch_queue_set_filter(), there are a couple of places where we check\\nthat the filter type value does not exceed what the type_filter bitmap\\ncan hold. One place calculates the number of bits by:\\n\\n if (tf[i].type \u003e= sizeof(wfilter-\u003etype_filter) * 8)\\n\\nwhich is fine, but the second does:\\n\\n if (tf[i].type \u003e= sizeof(wfilter-\u003etype_filter) * BITS_PER_LONG)\\n\\nwhich is not. This can lead to a couple of out-of-bounds writes due to\\na too-large type:\\n\\n (1) __set_bit() on wfilter-\u003etype_filter\\n (2) Writing more elements in wfilter-\u003efilters[] than we allocated.\\n\\nFix this by just using the proper WATCH_TYPE__NR instead, which is the\\nnumber of types we actually know about.\\n\\nThe bug may cause an oops looking something like:\\n\\n BUG: KASAN: slab-out-of-bounds in watch_queue_set_filter+0x659/0x740\\n Write of size 4 at addr ffff88800d2c66bc by task watch_queue_oob/611\\n ...\\n Call Trace:\\n \u003cTASK\u003e\\n dump_stack_lvl+0x45/0x59\\n print_address_description.constprop.0+0x1f/0x150\\n ...\\n kasan_report.cold+0x7f/0x11b\\n ...\\n watch_queue_set_filter+0x659/0x740\\n ...\\n __x64_sys_ioctl+0x127/0x190\\n do_syscall_64+0x43/0x90\\n entry_SYSCALL_64_after_hwframe+0x44/0xae\\n\\n Allocated by task 611:\\n kasan_save_stack+0x1e/0x40\\n __kasan_kmalloc+0x81/0xa0\\n watch_queue_set_filter+0x23a/0x740\\n __x64_sys_ioctl+0x127/0x190\\n do_syscall_64+0x43/0x90\\n entry_SYSCALL_64_after_hwframe+0x44/0xae\\n\\n The buggy address belongs to the object at ffff88800d2c66a0\\n which belongs to the cache kmalloc-32 of size 32\\n The buggy address is located 28 bytes inside of\\n 32-byte region [ffff88800d2c66a0, ffff88800d2c66c0)\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: watch_queue: corrige la verificaci\u00f3n del l\u00edmite del filtro En watch_queue_set_filter(), hay un par de lugares donde verificamos que el valor del tipo de filtro no exceda lo que puede contener el mapa de bits type_filter. Un lugar calcula el n\u00famero de bits mediante: if (tf[i].type \u0026gt;= sizeof(wfilter-\u0026gt;type_filter) * 8) lo cual est\u00e1 bien, pero el segundo s\u00ed: if (tf[i].type \u0026gt;= sizeof( wfilter-\u0026gt;type_filter) * BITS_PER_LONG) que no lo es. Esto puede provocar un par de escrituras fuera de los l\u00edmites debido a un tipo demasiado grande: (1) __set_bit() en wfilter-\u0026gt;type_filter (2) Escribir m\u00e1s elementos en wfilter-\u0026gt;filters[] de los que asignamos. Solucione este problema simplemente usando el WATCH_TYPE__NR adecuado, que es la cantidad de tipos que realmente conocemos. El error puede provocar un error parecido a: ERROR: KASAN: slab-out-of-bounds in watch_queue_set_filter+0x659/0x740 Escritura de tama\u00f1o 4 en la direcci\u00f3n ffff88800d2c66bc mediante la tarea watch_queue_oob/611... Seguimiento de llamadas: dump_stack_lvl+ 0x45/0x59 print_address_description.constprop.0+0x1f/0x150 ... kasan_report.cold+0x7f/0x11b ... watch_queue_set_filter+0x659/0x740 ... __x64_sys_ioctl+0x127/0x190 do_syscall_64+0x43/0x90 entrada_ SYSCALL_64_after_hwframe+0x44/0xae Asignado por tarea 611: kasan_save_stack+0x1e/0x40 __kasan_kmalloc+0x81/0xa0 watch_queue_set_filter+0x23a/0x740 __x64_sys_ioctl+0x127/0x190 do_syscall_64+0x43/0x90 Entry_SYSCALL_64_after_hwframe+0x 44/0xae La direcci\u00f3n con errores pertenece al objeto en ffff88800d2c66a0 que pertenece al cach\u00e9 kmalloc-32 de tama\u00f1o 32 La direcci\u00f3n con errores se encuentra a 28 bytes dentro de la regi\u00f3n de 32 bytes [ffff88800d2c66a0, ffff88800d2c66c0)\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-787\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.8\",\"versionEndExcluding\":\"5.10.106\",\"matchCriteriaId\":\"FFACA37D-D2EA-44A7-8ED6-E58EE2222AFE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.29\",\"matchCriteriaId\":\"15DC6588-B28F-4637-9A1E-3753B34A40CF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"5.16.15\",\"matchCriteriaId\":\"83FDEDF2-0E19-4879-91FD-171E66D1B335\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1b09f28f70a5046acd64138075ae3f095238b045\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/648895da69ced90ca770fd941c3d9479a9d72c16\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b36588ebbcef74583824c08352e75838d6fb4ff2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c993ee0f9f81caf5767a50d1faeba39a0dc82af2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/1b09f28f70a5046acd64138075ae3f095238b045\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/648895da69ced90ca770fd941c3d9479a9d72c16\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b36588ebbcef74583824c08352e75838d6fb4ff2\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c993ee0f9f81caf5767a50d1faeba39a0dc82af2\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}"
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.