CVE-2022-49846: Vulnerability in Linux Linux

Severity: highType: vulnerabilityCVE-2022-49846

In the Linux kernel, the following vulnerability has been resolved: udf: Fix a slab-out-of-bounds write bug in udf_find_entry() Syzbot reported a slab-out-of-bounds Write bug: loop0: detected capacity change from 0 to 2048 ================================================================== BUG: KASAN: slab-out-of-bounds in udf_find_entry+0x8a5/0x14f0 fs/udf/namei.c:253 Write of size 105 at addr ffff8880123ff896 by task syz-executor323/3610 CPU: 0 PID: 3610 Comm: syz-executor323 Not tainted 6.1.0-rc2-syzkaller-00105-gb229b6ca5abb #0 Hardware name: Google Compute Engine/Google Compute Engine, BIOS Google 10/11/2022 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1b1/0x28e lib/dump_stack.c:106 print_address_description+0x74/0x340 mm/kasan/report.c:284 print_report+0x107/0x1f0 mm/kasan/report.c:395 kasan_report+0xcd/0x100 mm/kasan/report.c:495 kasan_check_range+0x2a7/0x2e0 mm/kasan/generic.c:189 memcpy+0x3c/0x60 mm/kasan/shadow.c:66 udf_find_entry+0x8a5/0x14f0 fs/udf/namei.c:253 udf_lookup+0xef/0x340 fs/udf/namei.c:309 lookup_open fs/namei.c:3391 [inline] open_last_lookups fs/namei.c:3481 [inline] path_openat+0x10e6/0x2df0 fs/namei.c:3710 do_filp_open+0x264/0x4f0 fs/namei.c:3740 do_sys_openat2+0x124/0x4e0 fs/open.c:1310 do_sys_open fs/open.c:1326 [inline] __do_sys_creat fs/open.c:1402 [inline] __se_sys_creat fs/open.c:1396 [inline] __x64_sys_creat+0x11f/0x160 fs/open.c:1396 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7ffab0d164d9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffe1a7e6bb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000055 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007ffab0d164d9 RDX: 00007ffab0d164d9 RSI: 0000000000000000 RDI: 0000000020000180 RBP: 00007ffab0cd5a10 R08: 0000000000000000 R09: 0000000000000000 R10: 00005555573552c0 R11: 0000000000000246 R12: 00007ffab0cd5aa0 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 </TASK> Allocated by task 3610: kasan_save_stack mm/kasan/common.c:45 [inline] kasan_set_track+0x3d/0x60 mm/kasan/common.c:52 ____kasan_kmalloc mm/kasan/common.c:371 [inline] __kasan_kmalloc+0x97/0xb0 mm/kasan/common.c:380 kmalloc include/linux/slab.h:576 [inline] udf_find_entry+0x7b6/0x14f0 fs/udf/namei.c:243 udf_lookup+0xef/0x340 fs/udf/namei.c:309 lookup_open fs/namei.c:3391 [inline] open_last_lookups fs/namei.c:3481 [inline] path_openat+0x10e6/0x2df0 fs/namei.c:3710 do_filp_open+0x264/0x4f0 fs/namei.c:3740 do_sys_openat2+0x124/0x4e0 fs/open.c:1310 do_sys_open fs/open.c:1326 [inline] __do_sys_creat fs/open.c:1402 [inline] __se_sys_creat fs/open.c:1396 [inline] __x64_sys_creat+0x11f/0x160 fs/open.c:1396 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd The buggy address belongs to the object at ffff8880123ff800 which belongs to the cache kmalloc-256 of size 256 The buggy address is located 150 bytes inside of 256-byte region [ffff8880123ff800, ffff8880123ff900) The buggy address belongs to the physical page: page:ffffea000048ff80 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x123fe head:ffffea000048ff80 order:1 compound_mapcount:0 compound_pincount:0 flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000010200 ffffea00004b8500 dead000000000003 ffff888012041b40 raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x0(), pid 1, tgid 1 (swapper/0), ts 1841222404, free_ts 0 create_dummy_stack mm/page_owner.c: ---truncated---

AI Analysis

Technical Summary

CVE-2022-49846 is a vulnerability identified in the Linux kernel's Universal Disk Format (UDF) filesystem implementation, specifically within the udf_find_entry() function. The issue is a slab-out-of-bounds write bug, meaning that the kernel attempts to write data beyond the allocated memory boundary of a slab cache object. This bug was detected by Syzbot, an automated kernel fuzzing tool, which reported a write of 105 bytes outside the bounds of a 256-byte kmalloc-256 slab cache object. The vulnerability occurs during filesystem operations involving UDF, such as file lookups and opens, where udf_find_entry() is called to locate directory entries. The out-of-bounds write can corrupt kernel memory, potentially leading to system instability, crashes (kernel panic), or exploitation opportunities. The bug trace shows that the issue arises when the kernel processes changes in device capacity and attempts to access or modify UDF directory entries. The vulnerability affects Linux kernel versions identified by the commit hash 066b9cded00b8e3212df74a417bb074f3f3a1fe0 and likely other versions before the patch. No known exploits are currently reported in the wild, and no CVSS score has been assigned yet. The vulnerability requires local code execution context to trigger, as it involves filesystem operations, but it does not require user interaction beyond invoking file system calls. The vulnerability is serious because kernel memory corruption can lead to privilege escalation or denial of service. The patch details are not provided, but the issue is resolved in recent kernel updates.

Potential Impact

For European organizations, the impact of CVE-2022-49846 could be significant, especially for those relying on Linux-based infrastructure, servers, or embedded systems that utilize the UDF filesystem. The UDF filesystem is commonly used for optical media like DVDs and some removable storage devices. Organizations that mount or interact with UDF-formatted media could be exposed to this vulnerability. Exploitation could allow attackers to cause kernel crashes, leading to denial of service, or potentially escalate privileges if combined with other vulnerabilities. Critical infrastructure, cloud service providers, and enterprises running Linux servers in Europe could face operational disruptions or security breaches if this vulnerability is exploited. The lack of known exploits reduces immediate risk, but the potential for kernel-level memory corruption warrants prompt attention. The vulnerability could also affect Linux-based IoT devices or embedded systems used in industrial or governmental environments across Europe, increasing the attack surface. Overall, the threat could impact confidentiality, integrity, and availability of affected systems.

Mitigation Recommendations

European organizations should take the following specific mitigation steps: 1) Identify Linux systems that mount or interact with UDF filesystems, including servers, workstations, and embedded devices. 2) Apply the latest Linux kernel updates or patches that address CVE-2022-49846 as soon as they become available, prioritizing critical and exposed systems. 3) If immediate patching is not possible, consider disabling automatic mounting of UDF filesystems or restrict access to removable media formatted with UDF to trusted users only. 4) Implement strict access controls and monitoring on systems that handle UDF media to detect unusual filesystem activity or crashes. 5) Use kernel hardening features such as Kernel Address Sanitizer (KASAN) in testing environments to detect similar memory corruption issues proactively. 6) Conduct vulnerability scanning and penetration testing focused on filesystem operations to identify potential exploitation attempts. 7) Educate system administrators about the risks of mounting untrusted UDF media and enforce policies to limit usage. These measures go beyond generic advice by focusing on UDF-specific filesystem handling and kernel patch management.