CVE-2022-49744

{"id": "CVE-2022-49744", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "published": "2025-03-27T17:15:39.093", "references": [{"url": "https://git.kernel.org/stable/c/2d11727655bf931776fb541f5862daf04bd5bf02", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/49d6d7fb631345b0f2957a7c4be24ad63903150f", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/uffd: fix pte marker when fork() without fork event\n\nPatch series \"mm: Fixes on pte markers\".\n\nPatch 1 resolves the syzkiller report from Pengfei.\n\nPatch 2 further harden pte markers when used with the recent swapin error\nmarkers. The major case is we should persist a swapin error marker after\nfork(), so child shouldn't read a corrupted page.\n\n\nThis patch (of 2):\n\nWhen fork(), dst_vma is not guaranteed to have VM_UFFD_WP even if src may\nhave it and has pte marker installed. The warning is improper along with\nthe comment. The right thing is to inherit the pte marker when needed, or\nkeep the dst pte empty.\n\nA vague guess is this happened by an accident when there's the prior patch\nto introduce src/dst vma into this helper during the uffd-wp feature got\ndeveloped and I probably messed up in the rebase, since if we replace\ndst_vma with src_vma the warning & comment it all makes sense too.\n\nHugetlb did exactly the right here (copy_hugetlb_page_range()). Fix the\ngeneral path.\n\nReproducer:\n\nhttps://github.com/xupengfe/syzkaller_logs/blob/main/221208_115556_copy_page_range/repro.c\n\nBugzilla report: https://bugzilla.kernel.org/show_bug.cgi?id=216808"}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: mm/uffd: correcci\u00f3n del marcador pte cuando fork() no tiene evento fork. Serie de parches \"mm: Correcciones en marcadores pte\". El parche 1 resuelve el informe de syzkiller de Pengfei. El parche 2 refuerza a\u00fan m\u00e1s los marcadores pte cuando se usan con los recientes marcadores de error de intercambio. El caso principal es que debemos conservar un marcador de error de intercambio despu\u00e9s de fork(), para que el elemento secundario no lea una p\u00e1gina da\u00f1ada. Este parche (de 2): Al ejecutar fork(), no se garantiza que dst_vma tenga VM_UFFD_WP, incluso si src lo tiene y tiene instalado el marcador pte. La advertencia y el comentario son incorrectos. Lo correcto es heredar el marcador pte cuando sea necesario o dejar vac\u00edo el marcador pte de dst. Una vaga suposici\u00f3n es que esto ocurri\u00f3 accidentalmente durante el parche anterior para introducir src/dst vma en este ayudante durante el desarrollo de la funci\u00f3n uffd-wp, y probablemente comet\u00ed un error al rebasar, ya que si reemplazamos dst_vma con src_vma, la advertencia y el comentario tambi\u00e9n cobran sentido. Hugetlb hizo exactamente lo correcto aqu\u00ed (copy_hugetlb_page_range()). Corrija la ruta general. Reproductor: https://github.com/xupengfe/syzkaller_logs/blob/main/221208_115556_copy_page_range/repro.c. Informe de Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=216808"}], "lastModified": "2025-10-30T16:46:02.150", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1FE6CADC-5E71-433C-86B1-9DC752EEC806", "versionEndExcluding": "6.1.11", "versionStartIncluding": "5.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.2:rc1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FF501633-2F44-4913-A8EE-B021929F49F6"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.2:rc2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2BDA597B-CAC1-4DF0-86F0-42E142C654E9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.2:rc3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "725C78C9-12CE-406F-ABE8-0813A01D66E8"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.2:rc4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A127C155-689C-4F67-B146-44A57F4BFD85"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.2:rc5:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D34127CC-68F5-4703-A5F6-5006F803E4AE"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.2:rc6:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4AB8D555-648E-4F2F-98BD-3E7F45BD12A8"}], "operator": "OR"}]}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}