« Volver al listado

CVE-2022-49464

Estado: AnalizadaAlta (7.8)—

In the Linux kernel, the following vulnerability has been resolved:

erofs: fix buffer copy overflow of ztailpacking feature

I got some KASAN report as below:

The root cause is that the tail pcluster won't be a complete filesystem block anymore. So if ztailpacking is used, the second part of an uncompressed tail pcluster may not be ``rq->pageofs_out``.

Detalles técnicos trazas, registros y código del informe original
[   46.959738] ==================================================================
[   46.960430] BUG: KASAN: use-after-free in z_erofs_shifted_transform+0x2bd/0x370
[   46.960430] Read of size 4074 at addr ffff8880300c2f8e by task fssum/188
...
[   46.960430] Call Trace:
[   46.960430]  <TASK>
[   46.960430]  dump_stack_lvl+0x41/0x5e
[   46.960430]  print_report.cold+0xb2/0x6b7
[   46.960430]  ? z_erofs_shifted_transform+0x2bd/0x370
[   46.960430]  kasan_report+0x8a/0x140
[   46.960430]  ? z_erofs_shifted_transform+0x2bd/0x370
[   46.960430]  kasan_check_range+0x14d/0x1d0
[   46.960430]  memcpy+0x20/0x60
[   46.960430]  z_erofs_shifted_transform+0x2bd/0x370
[   46.960430]  z_erofs_decompress_pcluster+0xaae/0x1080

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

AV:L PR:L sin UI indica escalada de privilegios local. KASAN/use-after-free en kernel permite ejecución arbitraria de código con permisos elevados en contexto local.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Execution PreventionThreat Intelligence ProgramRestrict Web-Based ContentPrivileged Account ManagementLimit Software InstallationBehavior Prevention on Endpoint

Tecnologías afectadas (1)

Linux — Linux Kernel

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-49464",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2022-49464",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-02-27T18:16:06.988946Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "ab749badf9f41f32509cd103391b81ea7e684b76",
              "lessThan": "4d53a625f29074e7b8236c2c0e0922edb7608df9",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ab749badf9f41f32509cd103391b81ea7e684b76",
              "lessThan": "6b59e1907f58cf877c563dcf013159eb9f994b64",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ab749badf9f41f32509cd103391b81ea7e684b76",
              "lessThan": "dcbe6803fffd387f72b48c2373b5f5ed12a5804b",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "fs/erofs/decompressor.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.17"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "5.17",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.17.14",
              "versionType": "semver",
              "lessThanOrEqual": "5.17.*"
            },
            {
              "status": "unaffected",
              "version": "5.18.3",
              "versionType": "semver",
              "lessThanOrEqual": "5.18.*"
            },
            {
              "status": "unaffected",
              "version": "5.19",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "fs/erofs/decompressor.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2025-02-26T07:01:22.697",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/4d53a625f29074e7b8236c2c0e0922edb7608df9",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/6b59e1907f58cf877c563dcf013159eb9f994b64",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/dcbe6803fffd387f72b48c2373b5f5ed12a5804b",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-416"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nerofs: fix buffer copy overflow of ztailpacking feature\n\nI got some KASAN report as below:\n\n[   46.959738] ==================================================================\n[   46.960430] BUG: KASAN: use-after-free in z_erofs_shifted_transform+0x2bd/0x370\n[   46.960430] Read of size 4074 at addr ffff8880300c2f8e by task fssum/188\n...\n[   46.960430] Call Trace:\n[   46.960430]  <TASK>\n[   46.960430]  dump_stack_lvl+0x41/0x5e\n[   46.960430]  print_report.cold+0xb2/0x6b7\n[   46.960430]  ? z_erofs_shifted_transform+0x2bd/0x370\n[   46.960430]  kasan_report+0x8a/0x140\n[   46.960430]  ? z_erofs_shifted_transform+0x2bd/0x370\n[   46.960430]  kasan_check_range+0x14d/0x1d0\n[   46.960430]  memcpy+0x20/0x60\n[   46.960430]  z_erofs_shifted_transform+0x2bd/0x370\n[   46.960430]  z_erofs_decompress_pcluster+0xaae/0x1080\n\nThe root cause is that the tail pcluster won't be a complete filesystem\nblock anymore. So if ztailpacking is used, the second part of an\nuncompressed tail pcluster may not be ``rq->pageofs_out``."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: erofs: arregla el desbordamiento de copia de búfer de la función ztailpacking Recibí un informe de KASAN como el siguiente: [ 46.959738] ======================================================================== [ 46.960430] ERROR: KASAN: use-after-free in z_erofs_shifted_transform+0x2bd/0x370 [ 46.960430] Read of size 4074 at addr ffff8880300c2f8e by task fssum/188 ... [ 46.960430] Call Trace: [ 46.960430]  [ 46.960430] dump_stack_lvl+0x41/0x5e [ 46.960430] print_report.cold+0xb2/0x6b7 [ 46.960430] ? z_erofs_shifted_transform+0x2bd/0x370 [ 46.960430] kasan_report+0x8a/0x140 [ 46.960430] ? z_erofs_shifted_transform+0x2bd/0x370 [ 46.960430] kasan_check_range+0x14d/0x1d0 [ 46.960430] memcpy+0x20/0x60 [ 46.960430] z_erofs_shifted_transform+0x2bd/0x370 [ 46.960430] z_erofs_decompress_pcluster+0xaae/0x1080 La causa raíz es que el pcluster de cola ya no será un bloque de sistema de archivos completo. Por lo tanto, si se utiliza ztailpacking, la segunda parte de un pcluster de cola sin comprimir puede no ser ``rq-&gt;pageofs_out``."
    }
  ],
  "lastModified": "2026-06-17T05:18:07.613",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C48ED8B1-C02B-4764-9298-070E29EF1F88",
              "versionEndExcluding": "5.17.14",
              "versionStartIncluding": "5.17"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8E122216-2E9E-4B3E-B7B8-D575A45BA3C2",
              "versionEndExcluding": "5.18.3",
              "versionStartIncluding": "5.18"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}