CVE-2022-49674

Estado: AnalizadaAlta (7.1)—

In the Linux kernel, the following vulnerability has been resolved:

dm raid: fix accesses beyond end of raid member array

On dm-raid table load (using raid_ctr), dm-raid allocates an array rs->devs[rs->raid_disks] for the raid device members. rs->raid_disks is defined by the number of raid metadata and image tupples passed into the target's constructor.

In the case of RAID layout changes being requested, that number can be different from the current number of members for existing raid sets as defined in their superblocks. Example RAID layout changes include: - raid1 legs being added/removed - raid4/5/6/10 number of stripes changed (stripe reshaping) - takeover to higher raid level (e.g. raid5 -> raid6)

Leer descripción completaMostrar menos

When accessing array members, rs->raid_disks must be used in control loops instead of the potentially larger value in rs->md.raid_disks. Otherwise it will cause memory access beyond the end of the rs->devs array.

Fix this by changing code that is prone to out-of-bounds access. Also fix validate_raid_redundancy() to validate all devices that are added. Also, use braces to help clean up raid_iterate_devices().

The out-of-bounds memory accesses was discovered using KASAN.

This commit was verified to pass all LVM2 RAID tests (with KASAN enabled).

CVSS

Versión: 3.1
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Puntuación base: 7.1

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.29%
Percentil entre todas las CVEs puntuadas: 20
Fecha de la puntuación: 6/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1068 Exploitation for Privilege Escalationprivilege escalation75 %
Impacto principalT1005 Data from Local Systemcollection70 %
Impacto secundarioT1499.004 Application or System Exploitationimpact65 %

Acceso local (AV:L) sin interacción (UI:N) con privilegios (PR:L) permite leer memoria fuera de límites (KASAN) y causar DoS; el CWE-125 (out-of-bounds read) confirma lectura de datos sensibles del kernel.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Threat Intelligence Program Filter Network Traffic Execution Prevention Application Isolation and Sandboxing Exploit Protection Update Software

Tecnologías afectadas (1)

Linux — Linux Kernel

CWE

CWE-125

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2022-49674",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.1,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "33e53f06850f44ec9722e08a993ecf8816e447a5",
              "lessThan": "5e161a8826b63c0b8b43e4a7fad1f956780f42ab",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "33e53f06850f44ec9722e08a993ecf8816e447a5",
              "lessThan": "df1a5ab0dd0775f2ea101c71f2addbc4c0ea0f85",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "33e53f06850f44ec9722e08a993ecf8816e447a5",
              "lessThan": "90de15357504c8097ab29769dc6852e16281e9e8",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "33e53f06850f44ec9722e08a993ecf8816e447a5",
              "lessThan": "9bf2b0757b04c78dc5d6e3a198acca98457b32a1",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "33e53f06850f44ec9722e08a993ecf8816e447a5",
              "lessThan": "6352b2f4d8e95ec0ae576d7705435d64cfa29503",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "33e53f06850f44ec9722e08a993ecf8816e447a5",
              "lessThan": "bcff98500ea3b4e7615ec31d2bdd326bc1ef5134",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "33e53f06850f44ec9722e08a993ecf8816e447a5",
              "lessThan": "332bd0778775d0cf105c4b9e03e460b590749916",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "drivers/md/dm-raid.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.8"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "4.8",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "4.14.287",
              "versionType": "semver",
              "lessThanOrEqual": "4.14.*"
            },
            {
              "status": "unaffected",
              "version": "4.19.251",
              "versionType": "semver",
              "lessThanOrEqual": "4.19.*"
            },
            {
              "status": "unaffected",
              "version": "5.4.204",
              "versionType": "semver",
              "lessThanOrEqual": "5.4.*"
            },
            {
              "status": "unaffected",
              "version": "5.10.129",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.53",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "5.18.10",
              "versionType": "semver",
              "lessThanOrEqual": "5.18.*"
            },
            {
              "status": "unaffected",
              "version": "5.19",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "drivers/md/dm-raid.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2025-02-26T07:01:42.320",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/332bd0778775d0cf105c4b9e03e460b590749916",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/5e161a8826b63c0b8b43e4a7fad1f956780f42ab",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/6352b2f4d8e95ec0ae576d7705435d64cfa29503",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/90de15357504c8097ab29769dc6852e16281e9e8",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/9bf2b0757b04c78dc5d6e3a198acca98457b32a1",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/bcff98500ea3b4e7615ec31d2bdd326bc1ef5134",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/df1a5ab0dd0775f2ea101c71f2addbc4c0ea0f85",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-125"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm raid: fix accesses beyond end of raid member array\n\nOn dm-raid table load (using raid_ctr), dm-raid allocates an array\nrs->devs[rs->raid_disks] for the raid device members. rs->raid_disks\nis defined by the number of raid metadata and image tupples passed\ninto the target's constructor.\n\nIn the case of RAID layout changes being requested, that number can be\ndifferent from the current number of members for existing raid sets as\ndefined in their superblocks. Example RAID layout changes include:\n- raid1 legs being added/removed\n- raid4/5/6/10 number of stripes changed (stripe reshaping)\n- takeover to higher raid level (e.g. raid5 -> raid6)\n\nWhen accessing array members, rs->raid_disks must be used in control\nloops instead of the potentially larger value in rs->md.raid_disks.\nOtherwise it will cause memory access beyond the end of the rs->devs\narray.\n\nFix this by changing code that is prone to out-of-bounds access.\nAlso fix validate_raid_redundancy() to validate all devices that are\nadded. Also, use braces to help clean up raid_iterate_devices().\n\nThe out-of-bounds memory accesses was discovered using KASAN.\n\nThis commit was verified to pass all LVM2 RAID tests (with KASAN\nenabled)."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: dm raid: se corrigen los accesos más allá del final de la matriz de miembros raid Al cargar la tabla dm-raid (usando raid_ctr), dm-raid asigna una matriz rs-&gt;devs[rs-&gt;raid_disks] para los miembros del dispositivo raid. rs-&gt;raid_disks se define por la cantidad de metadatos raid y tuplas de imágenes pasadas al constructor del objetivo. En el caso de que se soliciten cambios en el diseño RAID, ese número puede ser diferente del número actual de miembros para los conjuntos raid existentes según lo definido en sus superbloques. Los ejemplos de cambios en el diseño RAID incluyen: - patas raid1 que se agregan/eliminan - número de franjas raid4/5/6/10 cambiado (remodelación de franjas) - toma de control a un nivel raid más alto (por ejemplo, raid5 -&gt; raid6) Al acceder a los miembros de la matriz, se debe usar rs-&gt;raid_disks en bucles de control en lugar del valor potencialmente más grande en rs-&gt;md.raid_disks. De lo contrario, se producirá un acceso a la memoria más allá del final de la matriz rs-&gt;devs. Solucione esto modificando el código que es propenso a accesos fuera de los límites. También corrija validation_raid_redundancy() para validar todos los dispositivos que se agregan. Además, use llaves para ayudar a limpiar raid_iterate_devices(). Los accesos a la memoria fuera de los límites se descubrieron utilizando KASAN. Se verificó que esta confirmación pasara todas las pruebas RAID LVM2 (con KASAN habilitado)."
    }
  ],
  "lastModified": "2026-06-17T05:18:49.283",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CBFBBF7F-3A45-4578-828E-639EFFEA2165",
              "versionEndExcluding": "4.14.287"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "83E1438F-F12B-4581-9EF4-B104DAEFFD41",
              "versionEndExcluding": "4.19.251",
              "versionStartIncluding": "4.15"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "73056417-5BD5-453F-8EEC-2D5C48185372",
              "versionEndExcluding": "5.4.204",
              "versionStartIncluding": "4.20"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DAAE3E52-3C60-40CA-A245-AE5660F45CD8",
              "versionEndExcluding": "5.10.129",
              "versionStartIncluding": "5.5"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "70DCF327-F4B6-4CDB-8C9E-98E909E60127",
              "versionEndExcluding": "5.15.53",
              "versionStartIncluding": "5.11"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8261A22B-B156-4045-AE8E-AA9E95E7930C",
              "versionEndExcluding": "5.18.10",
              "versionStartIncluding": "5.16"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:5.19:rc1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A8C30C2D-F82D-4D37-AB48-D76ABFBD5377"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:5.19:rc2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BF8547FC-C849-4F1B-804B-A93AE2F04A92"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:5.19:rc3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F3068028-F453-4A1C-B80F-3F5609ACEF60"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:5.19:rc4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2E9C0DB0-D349-489F-A3D6-B77214E93A8A"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}