{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2022-48847", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-07-16T11:38:08.911Z", "datePublished": "2024-07-16T12:25:15.804Z", "dateUpdated": "2024-09-11T17:34:09.039Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2024-07-16T12:25:15.804Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwatch_queue: Fix filter limit check\n\nIn watch_queue_set_filter(), there are a couple of places where we check\nthat the filter type value does not exceed what the type_filter bitmap\ncan hold. One place calculates the number of bits by:\n\n if (tf[i].type >= sizeof(wfilter->type_filter) * 8)\n\nwhich is fine, but the second does:\n\n if (tf[i].type >= sizeof(wfilter->type_filter) * BITS_PER_LONG)\n\nwhich is not. This can lead to a couple of out-of-bounds writes due to\na too-large type:\n\n (1) __set_bit() on wfilter->type_filter\n (2) Writing more elements in wfilter->filters[] than we allocated.\n\nFix this by just using the proper WATCH_TYPE__NR instead, which is the\nnumber of types we actually know about.\n\nThe bug may cause an oops looking something like:\n\n BUG: KASAN: slab-out-of-bounds in watch_queue_set_filter+0x659/0x740\n Write of size 4 at addr ffff88800d2c66bc by task watch_queue_oob/611\n ...\n Call Trace:\n <TASK>\n dump_stack_lvl+0x45/0x59\n print_address_description.constprop.0+0x1f/0x150\n ...\n kasan_report.cold+0x7f/0x11b\n ...\n watch_queue_set_filter+0x659/0x740\n ...\n __x64_sys_ioctl+0x127/0x190\n do_syscall_64+0x43/0x90\n entry_SYSCALL_64_after_hwframe+0x44/0xae\n\n Allocated by task 611:\n kasan_save_stack+0x1e/0x40\n __kasan_kmalloc+0x81/0xa0\n watch_queue_set_filter+0x23a/0x740\n __x64_sys_ioctl+0x127/0x190\n do_syscall_64+0x43/0x90\n entry_SYSCALL_64_after_hwframe+0x44/0xae\n\n The buggy address belongs to the object at ffff88800d2c66a0\n which belongs to the cache kmalloc-32 of size 32\n The buggy address is located 28 bytes inside of\n 32-byte region [ffff88800d2c66a0, ffff88800d2c66c0)"}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["include/linux/watch_queue.h", "kernel/watch_queue.c"], "versions": [{"version": "c73be61cede5", "lessThan": "648895da69ce", "status": "affected", "versionType": "git"}, {"version": "c73be61cede5", "lessThan": "1b09f28f70a5", "status": "affected", "versionType": "git"}, {"version": "c73be61cede5", "lessThan": "b36588ebbcef", "status": "affected", "versionType": "git"}, {"version": "c73be61cede5", "lessThan": "c993ee0f9f81", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["include/linux/watch_queue.h", "kernel/watch_queue.c"], "versions": [{"version": "5.8", "status": "affected"}, {"version": "0", "lessThan": "5.8", "status": "unaffected", "versionType": "custom"}, {"version": "5.10.106", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "custom"}, {"version": "5.15.29", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "custom"}, {"version": "5.16.15", "lessThanOrEqual": "5.16.*", "status": "unaffected", "versionType": "custom"}, {"version": "5.17", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "references": [{"url": "https://git.kernel.org/stable/c/648895da69ced90ca770fd941c3d9479a9d72c16"}, {"url": "https://git.kernel.org/stable/c/1b09f28f70a5046acd64138075ae3f095238b045"}, {"url": "https://git.kernel.org/stable/c/b36588ebbcef74583824c08352e75838d6fb4ff2"}, {"url": "https://git.kernel.org/stable/c/c993ee0f9f81caf5767a50d1faeba39a0dc82af2"}], "title": "watch_queue: Fix filter limit check", "x_generator": {"engine": "bippy-c9c4e1df01b2"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T15:25:01.608Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/648895da69ced90ca770fd941c3d9479a9d72c16", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/1b09f28f70a5046acd64138075ae3f095238b045", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/b36588ebbcef74583824c08352e75838d6fb4ff2", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/c993ee0f9f81caf5767a50d1faeba39a0dc82af2", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2022-48847", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T16:56:35.105751Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T17:34:09.039Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/648895da69ced90ca770fd941c3d9479a9d72c16", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/1b09f28f70a5046acd64138075ae3f095238b045", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/b36588ebbcef74583824c08352e75838d6fb4ff2", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/c993ee0f9f81caf5767a50d1faeba39a0dc82af2", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T15:25:01.608Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2022-48847", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T16:56:35.105751Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T12:42:20.981Z"}}], "cna": {"title": "watch_queue: Fix filter limit check", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "c73be61cede5", "lessThan": "648895da69ce", "versionType": "git"}, {"status": "affected", "version": "c73be61cede5", "lessThan": "1b09f28f70a5", "versionType": "git"}, {"status": "affected", "version": "c73be61cede5", "lessThan": "b36588ebbcef", "versionType": "git"}, {"status": "affected", "version": "c73be61cede5", "lessThan": "c993ee0f9f81", "versionType": "git"}], "programFiles": ["include/linux/watch_queue.h", "kernel/watch_queue.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.8"}, {"status": "unaffected", "version": "0", "lessThan": "5.8", "versionType": "custom"}, {"status": "unaffected", "version": "5.10.106", "versionType": "custom", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.29", "versionType": "custom", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "5.16.15", "versionType": "custom", "lessThanOrEqual": "5.16.*"}, {"status": "unaffected", "version": "5.17", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["include/linux/watch_queue.h", "kernel/watch_queue.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/648895da69ced90ca770fd941c3d9479a9d72c16"}, {"url": "https://git.kernel.org/stable/c/1b09f28f70a5046acd64138075ae3f095238b045"}, {"url": "https://git.kernel.org/stable/c/b36588ebbcef74583824c08352e75838d6fb4ff2"}, {"url": "https://git.kernel.org/stable/c/c993ee0f9f81caf5767a50d1faeba39a0dc82af2"}], "x_generator": {"engine": "bippy-c9c4e1df01b2"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwatch_queue: Fix filter limit check\n\nIn watch_queue_set_filter(), there are a couple of places where we check\nthat the filter type value does not exceed what the type_filter bitmap\ncan hold. One place calculates the number of bits by:\n\n if (tf[i].type >= sizeof(wfilter->type_filter) * 8)\n\nwhich is fine, but the second does:\n\n if (tf[i].type >= sizeof(wfilter->type_filter) * BITS_PER_LONG)\n\nwhich is not. This can lead to a couple of out-of-bounds writes due to\na too-large type:\n\n (1) __set_bit() on wfilter->type_filter\n (2) Writing more elements in wfilter->filters[] than we allocated.\n\nFix this by just using the proper WATCH_TYPE__NR instead, which is the\nnumber of types we actually know about.\n\nThe bug may cause an oops looking something like:\n\n BUG: KASAN: slab-out-of-bounds in watch_queue_set_filter+0x659/0x740\n Write of size 4 at addr ffff88800d2c66bc by task watch_queue_oob/611\n ...\n Call Trace:\n <TASK>\n dump_stack_lvl+0x45/0x59\n print_address_description.constprop.0+0x1f/0x150\n ...\n kasan_report.cold+0x7f/0x11b\n ...\n watch_queue_set_filter+0x659/0x740\n ...\n __x64_sys_ioctl+0x127/0x190\n do_syscall_64+0x43/0x90\n entry_SYSCALL_64_after_hwframe+0x44/0xae\n\n Allocated by task 611:\n kasan_save_stack+0x1e/0x40\n __kasan_kmalloc+0x81/0xa0\n watch_queue_set_filter+0x23a/0x740\n __x64_sys_ioctl+0x127/0x190\n do_syscall_64+0x43/0x90\n entry_SYSCALL_64_after_hwframe+0x44/0xae\n\n The buggy address belongs to the object at ffff88800d2c66a0\n which belongs to the cache kmalloc-32 of size 32\n The buggy address is located 28 bytes inside of\n 32-byte region [ffff88800d2c66a0, ffff88800d2c66c0)"}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2024-07-16T12:25:15.804Z"}}}, "cveMetadata": {"cveId": "CVE-2022-48847", "state": "PUBLISHED", "dateUpdated": "2024-09-11T17:34:09.039Z", "dateReserved": "2024-07-16T11:38:08.911Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-07-16T12:25:15.804Z", "assignerShortName": "Linux"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "FFACA37D-D2EA-44A7-8ED6-E58EE2222AFE", "versionEndExcluding": "5.10.106", "versionStartIncluding": "5.8", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "15DC6588-B28F-4637-9A1E-3753B34A40CF", "versionEndExcluding": "5.15.29", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "83FDEDF2-0E19-4879-91FD-171E66D1B335", "versionEndExcluding": "5.16.15", "versionStartIncluding": "5.16", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwatch_queue: Fix filter limit check\n\nIn watch_queue_set_filter(), there are a couple of places where we check\nthat the filter type value does not exceed what the type_filter bitmap\ncan hold. One place calculates the number of bits by:\n\n if (tf[i].type >= sizeof(wfilter->type_filter) * 8)\n\nwhich is fine, but the second does:\n\n if (tf[i].type >= sizeof(wfilter->type_filter) * BITS_PER_LONG)\n\nwhich is not. This can lead to a couple of out-of-bounds writes due to\na too-large type:\n\n (1) __set_bit() on wfilter->type_filter\n (2) Writing more elements in wfilter->filters[] than we allocated.\n\nFix this by just using the proper WATCH_TYPE__NR instead, which is the\nnumber of types we actually know about.\n\nThe bug may cause an oops looking something like:\n\n BUG: KASAN: slab-out-of-bounds in watch_queue_set_filter+0x659/0x740\n Write of size 4 at addr ffff88800d2c66bc by task watch_queue_oob/611\n ...\n Call Trace:\n <TASK>\n dump_stack_lvl+0x45/0x59\n print_address_description.constprop.0+0x1f/0x150\n ...\n kasan_report.cold+0x7f/0x11b\n ...\n watch_queue_set_filter+0x659/0x740\n ...\n __x64_sys_ioctl+0x127/0x190\n do_syscall_64+0x43/0x90\n entry_SYSCALL_64_after_hwframe+0x44/0xae\n\n Allocated by task 611:\n kasan_save_stack+0x1e/0x40\n __kasan_kmalloc+0x81/0xa0\n watch_queue_set_filter+0x23a/0x740\n __x64_sys_ioctl+0x127/0x190\n do_syscall_64+0x43/0x90\n entry_SYSCALL_64_after_hwframe+0x44/0xae\n\n The buggy address belongs to the object at ffff88800d2c66a0\n which belongs to the cache kmalloc-32 of size 32\n The buggy address is located 28 bytes inside of\n 32-byte region [ffff88800d2c66a0, ffff88800d2c66c0)"}, {"lang": "es", "value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: watch_queue: corrige la verificaci\u00f3n del l\u00edmite del filtro En watch_queue_set_filter(), hay un par de lugares donde verificamos que el valor del tipo de filtro no exceda lo que puede contener el mapa de bits type_filter. Un lugar calcula el n\u00famero de bits mediante: if (tf[i].type &gt;= sizeof(wfilter-&gt;type_filter) * 8) lo cual est\u00e1 bien, pero el segundo s\u00ed: if (tf[i].type &gt;= sizeof( wfilter-&gt;type_filter) * BITS_PER_LONG) que no lo es. Esto puede provocar un par de escrituras fuera de los l\u00edmites debido a un tipo demasiado grande: (1) __set_bit() en wfilter-&gt;type_filter (2) Escribir m\u00e1s elementos en wfilter-&gt;filters[] de los que asignamos. Solucione este problema simplemente usando el WATCH_TYPE__NR adecuado, que es la cantidad de tipos que realmente conocemos. El error puede provocar un error parecido a: ERROR: KASAN: slab-out-of-bounds in watch_queue_set_filter+0x659/0x740 Escritura de tama\u00f1o 4 en la direcci\u00f3n ffff88800d2c66bc mediante la tarea watch_queue_oob/611... Seguimiento de llamadas: dump_stack_lvl+ 0x45/0x59 print_address_description.constprop.0+0x1f/0x150 ... kasan_report.cold+0x7f/0x11b ... watch_queue_set_filter+0x659/0x740 ... __x64_sys_ioctl+0x127/0x190 do_syscall_64+0x43/0x90 entrada_ SYSCALL_64_after_hwframe+0x44/0xae Asignado por tarea 611: kasan_save_stack+0x1e/0x40 __kasan_kmalloc+0x81/0xa0 watch_queue_set_filter+0x23a/0x740 __x64_sys_ioctl+0x127/0x190 do_syscall_64+0x43/0x90 Entry_SYSCALL_64_after_hwframe+0x 44/0xae La direcci\u00f3n con errores pertenece al objeto en ffff88800d2c66a0 que pertenece al cach\u00e9 kmalloc-32 de tama\u00f1o 32 La direcci\u00f3n con errores se encuentra a 28 bytes dentro de la regi\u00f3n de 32 bytes [ffff88800d2c66a0, ffff88800d2c66c0)"}], "id": "CVE-2022-48847", "lastModified": "2024-07-24T17:34:26.853", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2024-07-16T13:15:11.950", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/1b09f28f70a5046acd64138075ae3f095238b045"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/648895da69ced90ca770fd941c3d9479a9d72c16"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/b36588ebbcef74583824c08352e75838d6fb4ff2"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/c993ee0f9f81caf5767a50d1faeba39a0dc82af2"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: watch_queue: Fix filter limit check", "id": "2298188", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2298188"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-125", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nwatch_queue: Fix filter limit check\nIn watch_queue_set_filter(), there are a couple of places where we check\nthat the filter type value does not exceed what the type_filter bitmap\ncan hold. One place calculates the number of bits by:\nif (tf[i].type >= sizeof(wfilter->type_filter) * 8)\nwhich is fine, but the second does:\nif (tf[i].type >= sizeof(wfilter->type_filter) * BITS_PER_LONG)\nwhich is not. This can lead to a couple of out-of-bounds writes due to\na too-large type:\n(1) __set_bit() on wfilter->type_filter\n(2) Writing more elements in wfilter->filters[] than we allocated.\nFix this by just using the proper WATCH_TYPE__NR instead, which is the\nnumber of types we actually know about.\nThe bug may cause an oops looking something like:\nBUG: KASAN: slab-out-of-bounds in watch_queue_set_filter+0x659/0x740\nWrite of size 4 at addr ffff88800d2c66bc by task watch_queue_oob/611\n...\nCall Trace:\n<TASK>\ndump_stack_lvl+0x45/0x59\nprint_address_description.constprop.0+0x1f/0x150\n...\nkasan_report.cold+0x7f/0x11b\n...\nwatch_queue_set_filter+0x659/0x740\n...\n__x64_sys_ioctl+0x127/0x190\ndo_syscall_64+0x43/0x90\nentry_SYSCALL_64_after_hwframe+0x44/0xae\nAllocated by task 611:\nkasan_save_stack+0x1e/0x40\n__kasan_kmalloc+0x81/0xa0\nwatch_queue_set_filter+0x23a/0x740\n__x64_sys_ioctl+0x127/0x190\ndo_syscall_64+0x43/0x90\nentry_SYSCALL_64_after_hwframe+0x44/0xae\nThe buggy address belongs to the object at ffff88800d2c66a0\nwhich belongs to the cache kmalloc-32 of size 32\nThe buggy address is located 28 bytes inside of\n32-byte region [ffff88800d2c66a0, ffff88800d2c66c0)", "A slab-out-of-bounds vulnerability was found in the Linux kernel. This issue may lead to a crash."], "name": "CVE-2022-48847", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-07-16T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2022-48847\nhttps://nvd.nist.gov/vuln/detail/CVE-2022-48847\nhttps://lore.kernel.org/linux-cve-announce/2024071624-CVE-2022-48847-42ea@gregkh/T"], "statement": "No Red Hat products are affected by this vulnerability.", "threat_severity": "Moderate", "upstream_fix": "kernel 5.10.106, kernel 5.15.29, kernel 5.16.15, kernel 5.17"}