CVE-2022-49464

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-49464
In the Linux kernel, the following vulnerability has been resolved: erofs: fix buffer copy overflow of ztailpacking feature I got some KASAN report as below: [ 46.959738] ================================================================== [ 46.960430] BUG: KASAN: use-after-free in z_erofs_shifted_transform+0x2bd/0x370 [ 46.960430] Read of size 4074 at addr ffff8880300c2f8e by task fssum/188 ... [ 46.960430] Call Trace: [ 46.960430] <TASK> [ 46.960430] dump_stack_lvl+0x41/0x5e [ 46.960430] print_report.cold+0xb2/0x6b7 [ 46.960430] ? z_erofs_shifted_transform+0x2bd/0x370 [ 46.960430] kasan_report+0x8a/0x140 [ 46.960430] ? z_erofs_shifted_transform+0x2bd/0x370 [ 46.960430] kasan_check_range+0x14d/0x1d0 [ 46.960430] memcpy+0x20/0x60 [ 46.960430] z_erofs_shifted_transform+0x2bd/0x370 [ 46.960430] z_erofs_decompress_pcluster+0xaae/0x1080 The root cause is that the tail pcluster won't be a complete filesystem block anymore. So if ztailpacking is used, the second part of an uncompressed tail pcluster may not be ``rq->pageofs_out``.

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/4d53a625f29074e7b8236c2c0e0922edb7608df9 Patch
https://git.kernel.org/stable/c/6b59e1907f58cf877c563dcf013159eb9f994b64 Patch
https://git.kernel.org/stable/c/dcbe6803fffd387f72b48c2373b5f5ed12a5804b Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

24 Mar 2025, 19:58

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: erofs: arregla el desbordamiento de copia de búfer de la función ztailpacking Recibí un informe de KASAN como el siguiente: [ 46.959738] ======================================================================== [ 46.960430] ERROR: KASAN: use-after-free in z_erofs_shifted_transform+0x2bd/0x370 [ 46.960430] Read of size 4074 at addr ffff8880300c2f8e by task fssum/188 ... [ 46.960430] Call Trace: [ 46.960430] [ 46.960430] dump_stack_lvl+0x41/0x5e [ 46.960430] print_report.cold+0xb2/0x6b7 [ 46.960430] ? z_erofs_shifted_transform+0x2bd/0x370 [ 46.960430] kasan_report+0x8a/0x140 [ 46.960430] ? z_erofs_shifted_transform+0x2bd/0x370 [ 46.960430] kasan_check_range+0x14d/0x1d0 [ 46.960430] memcpy+0x20/0x60 [ 46.960430] z_erofs_shifted_transform+0x2bd/0x370 [ 46.960430] z_erofs_decompress_pcluster+0xaae/0x1080 La causa raíz es que el pcluster de cola ya no será un bloque de sistema de archivos completo. Por lo tanto, si se utiliza ztailpacking, la segunda parte de un pcluster de cola sin comprimir puede no ser ``rq-&gt;pageofs_out``.
References () https://git.kernel.org/stable/c/4d53a625f29074e7b8236c2c0e0922edb7608df9 - () https://git.kernel.org/stable/c/4d53a625f29074e7b8236c2c0e0922edb7608df9 - Patch
References () https://git.kernel.org/stable/c/6b59e1907f58cf877c563dcf013159eb9f994b64 - () https://git.kernel.org/stable/c/6b59e1907f58cf877c563dcf013159eb9f994b64 - Patch
References () https://git.kernel.org/stable/c/dcbe6803fffd387f72b48c2373b5f5ed12a5804b - () https://git.kernel.org/stable/c/dcbe6803fffd387f72b48c2373b5f5ed12a5804b - Patch
First Time Linux linux Kernel
Linux
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

27 Feb 2025, 19:15

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.8
CWE CWE-416

26 Feb 2025, 07:01

Type Values Removed Values Added
New CVE
Information

Published : 2025-02-26 07:01

Updated : 2025-03-24 19:58

NVD link : CVE-2022-49464

Mitre link : CVE-2022-49464

CVE.ORG link : CVE-2022-49464

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-416

Use After Free