CVE-2022-49743

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2022-49743", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-03-27T16:39:17.987Z", "datePublished": "2025-03-27T16:42:54.289Z", "dateUpdated": "2026-10-15T21:21:07.990Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T08:56:12.285Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\novl: Use \"buf\" flexible array for memcpy() destination\n\nThe \"buf\" flexible array needs to be the memcpy() destination to avoid\nfalse positive run-time warning from the recent FORTIFY_SOURCE\nhardening:\n\n memcpy: detected field-spanning write (size 93) of single field \"&fh->fb\"\n at fs/overlayfs/export.c:799 (size 21)"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:N - ovl_fid_to_fh() is reached via ovl_fh_to_dentry export_operations when an overlay is mounted with nfs_export=on and exported through nfsd; a remote NFS client triggers decode by sending a crafted OVL_FILEID_V0 (0xfb) filehandle.\nAC:L - The attacker fully controls the filehandle type and payload and can reliably force the V0 realignment memcpy path; no race or unpredictable victim state is required.\nPR:N - nfsd invokes exportfs_decode_fh during fh_verify before file permission checks; on common AUTH_SYS exports, any host permitted by the export list can send the crafted handle with no credentials.\nUI:N - Exploitation requires only sending an NFS request with a crafted filehandle; no victim user action is needed once the overlay is NFS-exported.\nS:U - Impact remains within the host kernel authority; this is not a VM escape, IOMMU bypass, or other cross-boundary breakout.\nC:N - The commit documents a FORTIFY_SOURCE false positive: kzalloc(buflen) correctly covers the memcpy of buflen-OVL_FH_WIRE_OFFSET, so there is no out-of-bounds read or information disclosure.\nI:N - There is no real buffer overflow or memory corruption\u2014only a mis-typed memcpy destination (&fh->fb vs fh->buf)\u2014so no write primitive or integrity impact exists.\nA:H - CONFIG_FORTIFY_SOURCE emits a kernel WARN_ONCE on the field-spanning write; with panic_on_warn (common on Android/hardened hosts) this becomes a kernel panic, matching DoS/crash severity."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/overlayfs/export.c", "fs/overlayfs/overlayfs.h"], "versions": [{"version": "cbe7fba8edfc8cb8e621599e376f8ac5c224fa72", "lessThan": "012cdef22000f3104e4fa8224ad29fde509b8caf", "status": "affected", "versionType": "git"}, {"version": "cbe7fba8edfc8cb8e621599e376f8ac5c224fa72", "lessThan": "a77141a06367825d639ac51b04703d551163e36c", "status": "affected", "versionType": "git"}, {"version": "cbe7fba8edfc8cb8e621599e376f8ac5c224fa72", "lessThan": "07a96977b2f462337a9121302de64277b8747ab1", "status": "affected", "versionType": "git"}, {"version": "cbe7fba8edfc8cb8e621599e376f8ac5c224fa72", "lessThan": "cf8aa9bf97cadf85745506c6a3e244b22c268d63", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/overlayfs/export.c", "fs/overlayfs/overlayfs.h"], "versions": [{"version": "5.5", "status": "affected"}, {"version": "0", "lessThan": "5.5", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.248", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.93", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.11", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.5", "versionEndExcluding": "5.10.248"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.5", "versionEndExcluding": "5.15.93"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.5", "versionEndExcluding": "6.1.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.5", "versionEndExcluding": "6.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/012cdef22000f3104e4fa8224ad29fde509b8caf"}, {"url": "https://git.kernel.org/stable/c/a77141a06367825d639ac51b04703d551163e36c"}, {"url": "https://git.kernel.org/stable/c/07a96977b2f462337a9121302de64277b8747ab1"}, {"url": "https://git.kernel.org/stable/c/cf8aa9bf97cadf85745506c6a3e244b22c268d63"}], "title": "ovl: Use \"buf\" flexible array for memcpy() destination", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2022-49743", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-15T21:18:12.828083Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:21:07.990Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2022-49743", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-15T21:18:12.828083Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:18:13.782Z"}}], "cna": {"title": "ovl: Use \"buf\" flexible array for memcpy() destination", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "scenarios": [{"lang": "en", "value": "AV:N - ovl_fid_to_fh() is reached via ovl_fh_to_dentry export_operations when an overlay is mounted with nfs_export=on and exported through nfsd; a remote NFS client triggers decode by sending a crafted OVL_FILEID_V0 (0xfb) filehandle.\nAC:L - The attacker fully controls the filehandle type and payload and can reliably force the V0 realignment memcpy path; no race or unpredictable victim state is required.\nPR:N - nfsd invokes exportfs_decode_fh during fh_verify before file permission checks; on common AUTH_SYS exports, any host permitted by the export list can send the crafted handle with no credentials.\nUI:N - Exploitation requires only sending an NFS request with a crafted filehandle; no victim user action is needed once the overlay is NFS-exported.\nS:U - Impact remains within the host kernel authority; this is not a VM escape, IOMMU bypass, or other cross-boundary breakout.\nC:N - The commit documents a FORTIFY_SOURCE false positive: kzalloc(buflen) correctly covers the memcpy of buflen-OVL_FH_WIRE_OFFSET, so there is no out-of-bounds read or information disclosure.\nI:N - There is no real buffer overflow or memory corruption\u2014only a mis-typed memcpy destination (&fh->fb vs fh->buf)\u2014so no write primitive or integrity impact exists.\nA:H - CONFIG_FORTIFY_SOURCE emits a kernel WARN_ONCE on the field-spanning write; with panic_on_warn (common on Android/hardened hosts) this becomes a kernel panic, matching DoS/crash severity."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "cbe7fba8edfc8cb8e621599e376f8ac5c224fa72", "lessThan": "012cdef22000f3104e4fa8224ad29fde509b8caf", "versionType": "git"}, {"status": "affected", "version": "cbe7fba8edfc8cb8e621599e376f8ac5c224fa72", "lessThan": "a77141a06367825d639ac51b04703d551163e36c", "versionType": "git"}, {"status": "affected", "version": "cbe7fba8edfc8cb8e621599e376f8ac5c224fa72", "lessThan": "07a96977b2f462337a9121302de64277b8747ab1", "versionType": "git"}, {"status": "affected", "version": "cbe7fba8edfc8cb8e621599e376f8ac5c224fa72", "lessThan": "cf8aa9bf97cadf85745506c6a3e244b22c268d63", "versionType": "git"}], "programFiles": ["fs/overlayfs/export.c", "fs/overlayfs/overlayfs.h"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.5"}, {"status": "unaffected", "version": "0", "lessThan": "5.5", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.248", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.93", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.11", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.2", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["fs/overlayfs/export.c", "fs/overlayfs/overlayfs.h"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/012cdef22000f3104e4fa8224ad29fde509b8caf"}, {"url": "https://git.kernel.org/stable/c/a77141a06367825d639ac51b04703d551163e36c"}, {"url": "https://git.kernel.org/stable/c/07a96977b2f462337a9121302de64277b8747ab1"}, {"url": "https://git.kernel.org/stable/c/cf8aa9bf97cadf85745506c6a3e244b22c268d63"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\novl: Use \"buf\" flexible array for memcpy() destination\n\nThe \"buf\" flexible array needs to be the memcpy() destination to avoid\nfalse positive run-time warning from the recent FORTIFY_SOURCE\nhardening:\n\n memcpy: detected field-spanning write (size 93) of single field \"&fh->fb\"\n at fs/overlayfs/export.c:799 (size 21)"}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.248", "versionStartIncluding": "5.5"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.93", "versionStartIncluding": "5.5"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.11", "versionStartIncluding": "5.5"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.2", "versionStartIncluding": "5.5"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T08:56:12.285Z"}}}, "cveMetadata": {"cveId": "CVE-2022-49743", "state": "PUBLISHED", "dateUpdated": "2026-10-15T21:21:07.990Z", "dateReserved": "2025-03-27T16:39:17.987Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2025-03-27T16:42:54.289Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/overlayfs/export.c", "fs/overlayfs/overlayfs.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "012cdef22000f3104e4fa8224ad29fde509b8caf", "status": "affected", "version": "cbe7fba8edfc8cb8e621599e376f8ac5c224fa72", "versionType": "git"}, {"lessThan": "a77141a06367825d639ac51b04703d551163e36c", "status": "affected", "version": "cbe7fba8edfc8cb8e621599e376f8ac5c224fa72", "versionType": "git"}, {"lessThan": "07a96977b2f462337a9121302de64277b8747ab1", "status": "affected", "version": "cbe7fba8edfc8cb8e621599e376f8ac5c224fa72", "versionType": "git"}, {"lessThan": "cf8aa9bf97cadf85745506c6a3e244b22c268d63", "status": "affected", "version": "cbe7fba8edfc8cb8e621599e376f8ac5c224fa72", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/overlayfs/export.c", "fs/overlayfs/overlayfs.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.5"}, {"lessThan": "5.5", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.248", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.93", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.11", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "5DF57B24-C3A2-4DF8-B3C1-A14A7C858DFE", "versionEndExcluding": "5.15.93", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "535D03F4-DA02-49FE-934E-668827E6407B", "versionEndExcluding": "6.1.11", "versionStartIncluding": "5.16", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\novl: Use \"buf\" flexible array for memcpy() destination\n\nThe \"buf\" flexible array needs to be the memcpy() destination to avoid\nfalse positive run-time warning from the recent FORTIFY_SOURCE\nhardening:\n\n memcpy: detected field-spanning write (size 93) of single field \"&fh->fb\"\n at fs/overlayfs/export.c:799 (size 21)"}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ovl: Usar la matriz flexible \"buf\" para el destino de memcpy() La matriz flexible \"buf\" debe ser el destino de memcpy() para evitar una advertencia de tiempo de ejecuci\u00f3n de falsos positivos del reciente endurecimiento de FORTIFY_SOURCE: memcpy: se detect\u00f3 una escritura que abarca el campo (tama\u00f1o 93) de un solo campo \"&fh->fb\" en fs/overlayfs/export.c:799 (tama\u00f1o 21)"}], "id": "CVE-2022-49743", "lastModified": "2026-10-15T22:17:24.880", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2022-49743", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-15T21:18:12.828083Z", "version": "2.0.3"}}]}, "published": "2025-03-27T17:15:38.967", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/012cdef22000f3104e4fa8224ad29fde509b8caf"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/07a96977b2f462337a9121302de64277b8747ab1"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/a77141a06367825d639ac51b04703d551163e36c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/cf8aa9bf97cadf85745506c6a3e244b22c268d63"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: ovl: Use \"buf\" flexible array for memcpy() destination", "id": "2355441", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2355441"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "details": ["In the Linux kernel, the following vulnerability has been resolved:\novl: Use \"buf\" flexible array for memcpy() destination\nThe \"buf\" flexible array needs to be the memcpy() destination to avoid\nfalse positive run-time warning from the recent FORTIFY_SOURCE\nhardening:\nmemcpy: detected field-spanning write (size 93) of single field \"&fh->fb\"\nat fs/overlayfs/export.c:799 (size 21)"], "name": "CVE-2022-49743", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-03-27T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2022-49743\nhttps://nvd.nist.gov/vuln/detail/CVE-2022-49743\nhttps://lore.kernel.org/linux-cve-announce/2025032758-CVE-2022-49743-a049@gregkh/T"], "threat_severity": "Low"}

{"created": "2025-07-13T11:32:28.608910+00:00", "updated": "2025-07-13T11:32:28.608965+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}