CVE-2022-49152

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-49152
In the Linux kernel, the following vulnerability has been resolved: XArray: Fix xas_create_range() when multi-order entry present If there is already an entry present that is of order >= XA_CHUNK_SHIFT when we call xas_create_range(), xas_create_range() will misinterpret that entry as a node and dereference xa_node->parent, generally leading to a crash that looks something like this: general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] CPU: 0 PID: 32 Comm: khugepaged Not tainted 5.17.0-rc8-syzkaller-00003-g56e337f2cf13 #0 RIP: 0010:xa_parent_locked include/linux/xarray.h:1207 [inline] RIP: 0010:xas_create_range+0x2d9/0x6e0 lib/xarray.c:725 It's deterministically reproducable once you know what the problem is, but producing it in a live kernel requires khugepaged to hit a race. While the problem has been present since xas_create_range() was introduced, I'm not aware of a way to hit it before the page cache was converted to use multi-index entries.

4.7 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.0 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/18f13edf3424b3b61814b69d5269b2e14584800c Patch
https://git.kernel.org/stable/c/1ac49c8fd49fdf53d3cd8b77eb8ffda08d7fbe22 Patch
https://git.kernel.org/stable/c/29968329b926d238e3107ec071a250397555d264 Patch
https://git.kernel.org/stable/c/3e2852eda19ee1a400cd809d7a9322680f34a262 Patch
https://git.kernel.org/stable/c/3e3c658055c002900982513e289398a1aad4a488 Patch
https://git.kernel.org/stable/c/7521a97b1929042604bef6859f62fa8b4bbc077b Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

13 Mar 2025, 21:58

Type Values Removed Values Added
CWE CWE-476
First Time Linux linux Kernel
Linux
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 4.7
References () https://git.kernel.org/stable/c/18f13edf3424b3b61814b69d5269b2e14584800c - () https://git.kernel.org/stable/c/18f13edf3424b3b61814b69d5269b2e14584800c - Patch
References () https://git.kernel.org/stable/c/1ac49c8fd49fdf53d3cd8b77eb8ffda08d7fbe22 - () https://git.kernel.org/stable/c/1ac49c8fd49fdf53d3cd8b77eb8ffda08d7fbe22 - Patch
References () https://git.kernel.org/stable/c/29968329b926d238e3107ec071a250397555d264 - () https://git.kernel.org/stable/c/29968329b926d238e3107ec071a250397555d264 - Patch
References () https://git.kernel.org/stable/c/3e2852eda19ee1a400cd809d7a9322680f34a262 - () https://git.kernel.org/stable/c/3e2852eda19ee1a400cd809d7a9322680f34a262 - Patch
References () https://git.kernel.org/stable/c/3e3c658055c002900982513e289398a1aad4a488 - () https://git.kernel.org/stable/c/3e3c658055c002900982513e289398a1aad4a488 - Patch
References () https://git.kernel.org/stable/c/7521a97b1929042604bef6859f62fa8b4bbc077b - () https://git.kernel.org/stable/c/7521a97b1929042604bef6859f62fa8b4bbc077b - Patch
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: XArray: Arreglar xas_create_range() cuando hay una entrada de orden múltiple presente Si ya hay una entrada presente que es de orden >= XA_CHUNK_SHIFT cuando llamamos a xas_create_range(), xas_create_range() malinterpretará esa entrada como un nodo y desreferenciará xa_node->parent, generalmente provocando un bloqueo que se parece a esto: error de protección general, probablemente para una dirección no canónica 0xdffffc0000000001: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref en el rango [0x000000000000008-0x000000000000000f] CPU: 0 PID: 32 Comm: khugepaged No contaminado 5.17.0-rc8-syzkaller-00003-g56e337f2cf13 #0 RIP: 0010:xa_parent_locked include/linux/xarray.h:1207 [inline] RIP: 0010:xas_create_range+0x2d9/0x6e0 lib/xarray.c:725 Es deterministamente reproducible una vez que sabes cuál es el problema, pero producirlo en un núcleo en vivo requiere que khugepaged alcance una ejecución. Si bien el problema ha estado presente desde que se introdujo xas_create_range(), no conozco una forma de alcanzarlo antes de que la caché de páginas se convirtiera para usar entradas de índice múltiple.

26 Feb 2025, 07:00

Type Values Removed Values Added
New CVE
Information

Published : 2025-02-26 07:00

Updated : 2025-03-13 21:58

NVD link : CVE-2022-49152

Mitre link : CVE-2022-49152

CVE.ORG link : CVE-2022-49152

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-476

NULL Pointer Dereference