CVE-2022-48747

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-48747
In the Linux kernel, the following vulnerability has been resolved: block: Fix wrong offset in bio_truncate() bio_truncate() clears the buffer outside of last block of bdev, however current bio_truncate() is using the wrong offset of page. So it can return the uninitialized data. This happened when both of truncated/corrupted FS and userspace (via bdev) are trying to read the last of bdev.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/3ee859e384d453d6ac68bfd5971f630d9fa46ad3 Patch
https://git.kernel.org/stable/c/4633a79ff8bc82770486a063a08b55e5162521d8 Patch
https://git.kernel.org/stable/c/6cbf4c731d7812518cd857c2cfc3da9fd120f6ae Patch
https://git.kernel.org/stable/c/941d5180c430ce5b0f7a3622ef9b76077bfa3d82 Patch
https://git.kernel.org/stable/c/b63e120189fd92aff00096d11e2fc5253f60248b Patch
https://git.kernel.org/stable/c/3ee859e384d453d6ac68bfd5971f630d9fa46ad3 Patch
https://git.kernel.org/stable/c/4633a79ff8bc82770486a063a08b55e5162521d8 Patch
https://git.kernel.org/stable/c/6cbf4c731d7812518cd857c2cfc3da9fd120f6ae Patch
https://git.kernel.org/stable/c/941d5180c430ce5b0f7a3622ef9b76077bfa3d82 Patch
https://git.kernel.org/stable/c/b63e120189fd92aff00096d11e2fc5253f60248b Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

24 Mar 2025, 18:24

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/3ee859e384d453d6ac68bfd5971f630d9fa46ad3 - () https://git.kernel.org/stable/c/3ee859e384d453d6ac68bfd5971f630d9fa46ad3 - Patch
References () https://git.kernel.org/stable/c/4633a79ff8bc82770486a063a08b55e5162521d8 - () https://git.kernel.org/stable/c/4633a79ff8bc82770486a063a08b55e5162521d8 - Patch
References () https://git.kernel.org/stable/c/6cbf4c731d7812518cd857c2cfc3da9fd120f6ae - () https://git.kernel.org/stable/c/6cbf4c731d7812518cd857c2cfc3da9fd120f6ae - Patch
References () https://git.kernel.org/stable/c/941d5180c430ce5b0f7a3622ef9b76077bfa3d82 - () https://git.kernel.org/stable/c/941d5180c430ce5b0f7a3622ef9b76077bfa3d82 - Patch
References () https://git.kernel.org/stable/c/b63e120189fd92aff00096d11e2fc5253f60248b - () https://git.kernel.org/stable/c/b63e120189fd92aff00096d11e2fc5253f60248b - Patch
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
First Time Linux linux Kernel
Linux

21 Nov 2024, 07:33

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/3ee859e384d453d6ac68bfd5971f630d9fa46ad3 - () https://git.kernel.org/stable/c/3ee859e384d453d6ac68bfd5971f630d9fa46ad3 -
References () https://git.kernel.org/stable/c/4633a79ff8bc82770486a063a08b55e5162521d8 - () https://git.kernel.org/stable/c/4633a79ff8bc82770486a063a08b55e5162521d8 -
References () https://git.kernel.org/stable/c/6cbf4c731d7812518cd857c2cfc3da9fd120f6ae - () https://git.kernel.org/stable/c/6cbf4c731d7812518cd857c2cfc3da9fd120f6ae -
References () https://git.kernel.org/stable/c/941d5180c430ce5b0f7a3622ef9b76077bfa3d82 - () https://git.kernel.org/stable/c/941d5180c430ce5b0f7a3622ef9b76077bfa3d82 -
References () https://git.kernel.org/stable/c/b63e120189fd92aff00096d11e2fc5253f60248b - () https://git.kernel.org/stable/c/b63e120189fd92aff00096d11e2fc5253f60248b -

03 Jul 2024, 01:39

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se resolvió la siguiente vulnerabilidad: bloque: corrige el desplazamiento incorrecto en bio_truncate() bio_truncate() borra el búfer fuera del último bloque de bdev, sin embargo, el bio_truncate() actual está usando el desplazamiento de página incorrecto. Entonces puede devolver los datos no inicializados. Esto sucedió cuando tanto el FS truncado/corrupto como el espacio de usuario (a través de bdev) intentaban leer lo último de bdev.
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.5
CWE CWE-908

20 Jun 2024, 12:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-06-20 12:15

Updated : 2025-03-24 18:24

NVD link : CVE-2022-48747

Mitre link : CVE-2022-48747

CVE.ORG link : CVE-2022-48747

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-908

Use of Uninitialized Resource