CVE-2022-49870

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-49870
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-49870.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2022-49870
Downstream
Related
Published
2025-05-01T14:10:21.134Z
Modified
2026-04-11T12:44:36.689379Z
Summary
capabilities: fix undefined behavior in bit shift for CAP_TO_MASK
Details

In the Linux kernel, the following vulnerability has been resolved:

capabilities: fix undefined behavior in bit shift for CAPTOMASK

Shifting signed 32-bit value by 31 bits is undefined, so changing significant bit to unsigned. The UBSAN warning calltrace like below:

UBSAN: shift-out-of-bounds in security/commoncap.c:1252:2 left shift of 1 by 31 places cannot be represented in type 'int' Call Trace: <TASK> dumpstacklvl+0x7d/0xa5 dumpstack+0x15/0x1b ubsanepilogue+0xe/0x4e __ubsanhandleshift_outofbounds+0x1e7/0x20c captaskprctl+0x561/0x6f0 securitytaskprctl+0x5a/0xb0 __x64sysprctl+0x61/0x8f0 dosyscall64+0x58/0x80 entrySYSCALL64afterhwframe+0x63/0xcd </TASK>

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49870.json",
    "cna_assigner": "Linux"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
e338d263a76af78fe8f38a72131188b58fceb591
Fixed
5b79fa628e2ab789e629a83cd211ef9b4c1a593e
Fixed
65b0bc7a0690861812ade523d19f82688ab819dc
Fixed
dbaab08c8677d598244d21afb7818e44e1c5d826
Fixed
5661f111a1616ac105ec8cec81bff99b60f847ac
Fixed
fcbd2b336834bd24e1d9454ad5737856470c10d7
Fixed
151dc8087b5609e53b069c068e3f3ee100efa586
Fixed
27bdb134c043ff32c459d98f16550d0ffa0b3c34
Fixed
46653972e3ea64f79e7f8ae3aa41a4d3fdb70a13

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-49870.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.6.25
Fixed
4.9.334
Type
ECOSYSTEM
Events
Introduced
4.10.0
Fixed
4.14.300
Type
ECOSYSTEM
Events
Introduced
4.15.0
Fixed
4.19.267
Type
ECOSYSTEM
Events
Introduced
4.20.0
Fixed
5.4.225
Type
ECOSYSTEM
Events
Introduced
5.5.0
Fixed
5.10.155
Type
ECOSYSTEM
Events
Introduced
5.11.0
Fixed
5.15.79
Type
ECOSYSTEM
Events
Introduced
5.16.0
Fixed
6.0.9

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-49870.json"