CVE-2022-50084

Estado: AnalizadaAlta (7.1)—

In the Linux kernel, the following vulnerability has been resolved:

dm raid: fix address sanitizer warning in raid_status

There is this warning when using a kernel with the address sanitizer and running this testsuite: https://gitlab.com/cki-project/kernel-tests/-/tree/main/storage/swraid/scsi_raid

The warning is caused by reading conf->max_nr_stripes in raid_status. The code in raid_status reads mddev->private, casts it to struct r5conf and reads the entry max_nr_stripes.

However, if we have different raid type than 4/5/6, mddev->private doesn't point to struct r5conf; it may point to struct r0conf, struct r1conf, struct r10conf or struct mpconf. If we cast a pointer to one of these structs to struct r5conf, we will be reading invalid memory and KASAN warns about it.

Leer descripción completaMostrar menos

Fix this bug by reading struct r5conf only if raid type is 4, 5 or 6.

Detalles técnicos trazas, registros y código del informe original

==================================================================
BUG: KASAN: slab-out-of-bounds in raid_status+0x1747/0x2820 [dm_raid]
Read of size 4 at addr ffff888079d2c7e8 by task lvcreate/13319
CPU: 0 PID: 13319 Comm: lvcreate Not tainted 5.18.0-0.rc3.<snip> #1
Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011
Call Trace:
 <TASK>
 dump_stack_lvl+0x6a/0x9c
 print_address_description.constprop.0+0x1f/0x1e0
 print_report.cold+0x55/0x244
 kasan_report+0xc9/0x100
 raid_status+0x1747/0x2820 [dm_raid]
 dm_ima_measure_on_table_load+0x4b8/0xca0 [dm_mod]
 table_load+0x35c/0x630 [dm_mod]
 ctl_ioctl+0x411/0x630 [dm_mod]
 dm_ctl_ioctl+0xa/0x10 [dm_mod]
 __x64_sys_ioctl+0x12a/0x1a0
 do_syscall_64+0x5b/0x80

CVSS

Versión: 3.1
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Puntuación base: 7.1

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.20%
Percentil entre todas las CVEs puntuadas: 9
Fecha de la puntuación: 6/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1068 Exploitation for Privilege Escalationprivilege escalation65 %
Impacto principalT1005 Data from Local Systemcollection75 %
Impacto secundarioT1499.004 Application or System Exploitationimpact60 %

CWE-125 (buffer over-read) con AV:L/PR:L permite leer memoria fuera de límites; impacto en confidencialidad (C:H) y disponibilidad (A:H) por acceso a datos del kernel y potencial DoS al desestabilizar el sistema.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Threat Intelligence Program Filter Network Traffic Execution Prevention Application Isolation and Sandboxing Exploit Protection Update Software

Tecnologías afectadas (1)

Linux — Linux Kernel

CWE

CWE-125

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2022-50084",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.1,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3a1c1ef2fd62087c3d6521de217ddb9360776658",
              "lessThan": "1ae0ebfb576b72c2ef400917a5484ebe7892d80b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "3a1c1ef2fd62087c3d6521de217ddb9360776658",
              "lessThan": "90b006da40dd42285b24dd3c940d2c32aca9a70b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "3a1c1ef2fd62087c3d6521de217ddb9360776658",
              "lessThan": "b856ce5f4b55f752144baf17e9d5c415072652c5",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "3a1c1ef2fd62087c3d6521de217ddb9360776658",
              "lessThan": "cb583ca6125ac64c98e9d65128e95ebb5be7d322",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "3a1c1ef2fd62087c3d6521de217ddb9360776658",
              "lessThan": "49dba30638e091120256a9e89125340795f034dc",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "3a1c1ef2fd62087c3d6521de217ddb9360776658",
              "lessThan": "4c233811a49578634d10a5e70a9dfa569d451e94",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "3a1c1ef2fd62087c3d6521de217ddb9360776658",
              "lessThan": "d8971b595d7adac3421c21f59918241f1574061e",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "3a1c1ef2fd62087c3d6521de217ddb9360776658",
              "lessThan": "b4c6c07c92b6cba2bf3cb2dfa722debeaf8a8abe",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "3a1c1ef2fd62087c3d6521de217ddb9360776658",
              "lessThan": "1fbeea217d8f297fe0e0956a1516d14ba97d0396",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "drivers/md/dm-raid.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.8"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "4.8",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "4.9.326",
              "versionType": "semver",
              "lessThanOrEqual": "4.9.*"
            },
            {
              "status": "unaffected",
              "version": "4.14.291",
              "versionType": "semver",
              "lessThanOrEqual": "4.14.*"
            },
            {
              "status": "unaffected",
              "version": "4.19.256",
              "versionType": "semver",
              "lessThanOrEqual": "4.19.*"
            },
            {
              "status": "unaffected",
              "version": "5.4.211",
              "versionType": "semver",
              "lessThanOrEqual": "5.4.*"
            },
            {
              "status": "unaffected",
              "version": "5.10.137",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.61",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "5.18.18",
              "versionType": "semver",
              "lessThanOrEqual": "5.18.*"
            },
            {
              "status": "unaffected",
              "version": "5.19.2",
              "versionType": "semver",
              "lessThanOrEqual": "5.19.*"
            },
            {
              "status": "unaffected",
              "version": "6.0",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "drivers/md/dm-raid.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2025-06-18T11:15:37.460",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/1ae0ebfb576b72c2ef400917a5484ebe7892d80b",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/1fbeea217d8f297fe0e0956a1516d14ba97d0396",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/49dba30638e091120256a9e89125340795f034dc",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/4c233811a49578634d10a5e70a9dfa569d451e94",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/90b006da40dd42285b24dd3c940d2c32aca9a70b",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/b4c6c07c92b6cba2bf3cb2dfa722debeaf8a8abe",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/b856ce5f4b55f752144baf17e9d5c415072652c5",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/cb583ca6125ac64c98e9d65128e95ebb5be7d322",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/d8971b595d7adac3421c21f59918241f1574061e",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-125"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm raid: fix address sanitizer warning in raid_status\n\nThere is this warning when using a kernel with the address sanitizer\nand running this testsuite:\nhttps://gitlab.com/cki-project/kernel-tests/-/tree/main/storage/swraid/scsi_raid\n\n==================================================================\nBUG: KASAN: slab-out-of-bounds in raid_status+0x1747/0x2820 [dm_raid]\nRead of size 4 at addr ffff888079d2c7e8 by task lvcreate/13319\nCPU: 0 PID: 13319 Comm: lvcreate Not tainted 5.18.0-0.rc3.<snip> #1\nHardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011\nCall Trace:\n <TASK>\n dump_stack_lvl+0x6a/0x9c\n print_address_description.constprop.0+0x1f/0x1e0\n print_report.cold+0x55/0x244\n kasan_report+0xc9/0x100\n raid_status+0x1747/0x2820 [dm_raid]\n dm_ima_measure_on_table_load+0x4b8/0xca0 [dm_mod]\n table_load+0x35c/0x630 [dm_mod]\n ctl_ioctl+0x411/0x630 [dm_mod]\n dm_ctl_ioctl+0xa/0x10 [dm_mod]\n __x64_sys_ioctl+0x12a/0x1a0\n do_syscall_64+0x5b/0x80\n\nThe warning is caused by reading conf->max_nr_stripes in raid_status. The\ncode in raid_status reads mddev->private, casts it to struct r5conf and\nreads the entry max_nr_stripes.\n\nHowever, if we have different raid type than 4/5/6, mddev->private\ndoesn't point to struct r5conf; it may point to struct r0conf, struct\nr1conf, struct r10conf or struct mpconf. If we cast a pointer to one\nof these structs to struct r5conf, we will be reading invalid memory\nand KASAN warns about it.\n\nFix this bug by reading struct r5conf only if raid type is 4, 5 or 6."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: dm raid: corrección de la advertencia del depurador de direcciones en raid_status Existe esta advertencia cuando se usa un kernel con el depurador de direcciones y se ejecuta este conjunto de pruebas: https://gitlab.com/cki-project/kernel-tests/-/tree/main/storage/swraid/scsi_raid ====================================================================== ERROR: KASAN: slab-out-of-bounds en raid_status+0x1747/0x2820 [dm_raid] Lectura de tamaño 4 en la dirección ffff888079d2c7e8 por la tarea lvcreate/13319 CPU: 0 PID: 13319 Comm: lvcreate No contaminado 5.18.0-0.rc3. #1 Nombre del hardware: Red Hat KVM, BIOS 0.5.1 01/01/2011 Seguimiento de llamadas: dump_stack_lvl+0x6a/0x9c print_address_description.constprop.0+0x1f/0x1e0 print_report.cold+0x55/0x244 kasan_report+0xc9/0x100 raid_status+0x1747/0x2820 [dm_raid] dm_ima_measure_on_table_load+0x4b8/0xca0 [dm_mod] table_load+0x35c/0x630 [dm_mod] ctl_ioctl+0x411/0x630 [dm_mod] dm_ctl_ioctl+0xa/0x10 [dm_mod] __x64_sys_ioctl+0x12a/0x1a0 do_syscall_64+0x5b/0x80La advertencia se debe a la lectura de `conf-&gt;max_nr_stripes` en `raid_status`. El código en `raid_status` lee `mddev-&gt;private`, lo convierte a `struct r5conf` y lee la entrada `max_nr_stripes`. Sin embargo, si el tipo de raid es diferente al 4/5/6, `mddev-&gt;private` no apunta a `struct r5conf`; puede apuntar a `struct r0conf`, `struct r1conf`, `struct r10conf` o `struct mpconf`. Si convertimos un puntero a una de estas estructuras en struct r5conf, leeremos memoria no válida y KASAN emitirá una advertencia. Corrija este error leyendo struct r5conf solo si el tipo de RAID es 4, 5 o 6."
    }
  ],
  "lastModified": "2026-06-17T05:22:43.470",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5B4EA906-CFF9-4D4A-AFD7-43AC02C77E48",
              "versionEndExcluding": "4.9.326"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3BBC7E43-6161-4F21-977C-5BB7792C6C94",
              "versionEndExcluding": "4.14.291",
              "versionStartIncluding": "4.10"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6C47CDE3-B039-4AE5-B8E4-1DC820E473FF",
              "versionEndExcluding": "4.19.256",
              "versionStartIncluding": "4.15"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B1C63D19-C08C-4308-A848-B2523C9275BD",
              "versionEndExcluding": "5.4.211",
              "versionStartIncluding": "4.20"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C2BF720F-C5EE-4DE2-9BDF-CE4CFBC767F4",
              "versionEndExcluding": "5.10.137",
              "versionStartIncluding": "5.5"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "51861563-7F40-460F-82CD-2D3FBDAD6618",
              "versionEndExcluding": "5.15.61",
              "versionStartIncluding": "5.11"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5B42E453-8837-49D0-A5EF-03F818A6DC11",
              "versionEndExcluding": "5.18.18",
              "versionStartIncluding": "5.16"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A1A2A5A5-4598-4D7E-BA07-4660398D6C8F",
              "versionEndExcluding": "5.19.2",
              "versionStartIncluding": "5.19"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}