CVE-2022-48502 - OpenCVE

An issue was discovered in the Linux kernel before 6.2. The ntfs3 subsystem does not properly check for correctness during disk reads, leading to an out-of-bounds read in ntfs_set_ea in fs/ntfs3/xattr.c.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Linux	Linux Kernel
Netapp	H300s H410c H410s H500s H700s

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::

Configuration 2 [-]

OR	cpe:2.3:h:netapp:h300s:-:::::::*
	cpe:2.3:h:netapp:h410c:-:::::::*
	cpe:2.3:h:netapp:h410s:-:::::::*
	cpe:2.3:h:netapp:h500s:-:::::::*
	cpe:2.3:h:netapp:h700s:-:::::::*

No data.

References

Link	Providers
https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.2
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=0e8235d28f3a0e9eda9f02ff67ee566d5f42b66b
https://nvd.nist.gov/vuln/detail/CVE-2022-48502
https://security.netapp.com/advisory/ntap-20230703-0004/
https://syzkaller.appspot.com/bug?extid=8778f030156c6cd16d72
https://www.cve.org/CVERecord?id=CVE-2022-48502

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2023-05-31T00:00:00

Updated: 2024-08-03T15:17:55.289Z

Reserved: 2023-05-31T00:00:00

Link: CVE-2022-48502

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2023-05-31T20:15:10.303

Modified: 2023-12-15T15:47:33.157

Link: CVE-2022-48502

Redhat

Severity : Moderate

Publid Date: 2022-10-10T00:00:00Z

Links: CVE-2022-48502 - Bugzilla

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "D80EAC0B-0800-4E58-A184-64A1FA7F7EB2", "versionEndExcluding": "5.15.121", "versionStartIncluding": "5.15", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "69315BCC-36D2-45CD-84F8-381EDF8E38F3", "versionEndExcluding": "6.1.40", "versionStartIncluding": "5.16", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:*", "matchCriteriaId": "9F9C8C20-42EB-4AB5-BD97-212DEB070C43", "vulnerable": true}, {"criteria": "cpe:2.3:h:netapp:h410c:-:*:*:*:*:*:*:*", "matchCriteriaId": "CDDF61B7-EC5C-467C-B710-B89F502CD04F", "vulnerable": true}, {"criteria": "cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:*", "matchCriteriaId": "8497A4C9-8474-4A62-8331-3FE862ED4098", "vulnerable": true}, {"criteria": "cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:*", "matchCriteriaId": "E63D8B0F-006E-4801-BF9D-1C001BBFB4F9", "vulnerable": true}, {"criteria": "cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:*", "matchCriteriaId": "B06F4839-D16A-4A61-9BB5-55B13F41E47F", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An issue was discovered in the Linux kernel before 6.2. The ntfs3 subsystem does not properly check for correctness during disk reads, leading to an out-of-bounds read in ntfs_set_ea in fs/ntfs3/xattr.c."}, {"lang": "es", "value": "Se ha descubierto un problema en el kernel de Linux en las versiones anteriores a v6.2. El subsistema \"ntfs3\" no comprueba correctamente la correcci\u00f3n durante las lecturas de disco, lo que provoca una lectura fuera de los l\u00edmites en \"ntfs_set_ea\" en \"fs/ntfs3/xattr.c\". "}], "id": "CVE-2022-48502", "lastModified": "2023-12-15T15:47:33.157", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-05-31T20:15:10.303", "references": [{"source": "cve@mitre.org", "tags": ["Release Notes"], "url": "https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.2"}, {"source": "cve@mitre.org", "tags": ["Mailing List", "Patch"], "url": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=0e8235d28f3a0e9eda9f02ff67ee566d5f42b66b"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://security.netapp.com/advisory/ntap-20230703-0004/"}, {"source": "cve@mitre.org", "tags": ["Exploit", "Third Party Advisory"], "url": "https://syzkaller.appspot.com/bug?extid=8778f030156c6cd16d72"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: ntfs3 subsystem does not properly check for correctness during disk reads", "id": "2212763", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2212763"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.1", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "status": "draft"}, "details": ["An issue was discovered in the Linux kernel before 6.2. The ntfs3 subsystem does not properly check for correctness during disk reads, leading to an out-of-bounds read in ntfs_set_ea in fs/ntfs3/xattr.c.", "A flaw was found in the Linux kernel\u2019s ntfs3 subsystem, which does not properly check for correctness during disk reads. This issue leads to an out-of-bounds read in ntfs_set_ea in fs/ntfs3/xattr.c."], "name": "CVE-2022-48502", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2022-10-10T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2022-48502\nhttps://nvd.nist.gov/vuln/detail/CVE-2022-48502\nhttps://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=0e8235d28f3a0e9eda9f02ff67ee566d5f42b66b"], "statement": "No shipped kernel versions were seen affected by this problem. These files are not built in our source code.", "threat_severity": "Moderate", "upstream_fix": "Kernel 6.2-rc1"}