DEBIAN-CVE-2022-48847

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2022-48847
Import Source
https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2022-48847.json
JSON Data
https://api.test.osv.dev/v1/vulns/DEBIAN-CVE-2022-48847
Upstream
Published
2024-07-16T13:15:11.950Z
Modified
2026-03-11T07:35:26.297393Z
Severity
  • 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

In the Linux kernel, the following vulnerability has been resolved: watchqueue: Fix filter limit check In watchqueuesetfilter(), there are a couple of places where we check that the filter type value does not exceed what the typefilter bitmap can hold. One place calculates the number of bits by: if (tf[i].type >= sizeof(wfilter->typefilter) * 8) which is fine, but the second does: if (tf[i].type >= sizeof(wfilter->typefilter) * BITSPER_LONG) which is not. This can lead to a couple of out-of-bounds writes due to a too-large type: (1) setbit() on wfilter->typefilter (2) Writing more elements in wfilter->filters[] than we allocated. Fix this by just using the proper WATCH_TYPENR instead, which is the number of types we actually know about. The bug may cause an oops looking something like: BUG: KASAN: slab-out-of-bounds in watchqueuesetfilter+0x659/0x740 Write of size 4 at addr ffff88800d2c66bc by task watchqueueoob/611 ... Call Trace: <TASK> dumpstacklvl+0x45/0x59 printaddressdescription.constprop.0+0x1f/0x150 ... kasanreport.cold+0x7f/0x11b ... watchqueueset_filter+0x659/0x740 ... __x64sysioctl+0x127/0x190 dosyscall64+0x43/0x90 entrySYSCALL64afterhwframe+0x44/0xae Allocated by task 611: kasansavestack+0x1e/0x40 __kasankmalloc+0x81/0xa0 watchqueuesetfilter+0x23a/0x740 __x64sysioctl+0x127/0x190 dosyscall64+0x43/0x90 entrySYSCALL64afterhwframe+0x44/0xae The buggy address belongs to the object at ffff88800d2c66a0 which belongs to the cache kmalloc-32 of size 32 The buggy address is located 28 bytes inside of 32-byte region [ffff88800d2c66a0, ffff88800d2c66c0)

References

Affected packages

Debian:11 / linux

Package

Name
linux
Purl
pkg:deb/debian/linux?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
5.10.106-1

Affected versions

5.*
5.10.46-4
5.10.46-5
5.10.70-1~bpo10+1
5.10.70-1
5.10.84-1
5.10.92-1~bpo10+1
5.10.92-1
5.10.92-2
5.10.103-1~bpo10+1
5.10.103-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2022-48847.json"

Debian:12 / linux

Package

Name
linux
Purl
pkg:deb/debian/linux?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
5.16.18-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2022-48847.json"

Debian:13 / linux

Package

Name
linux
Purl
pkg:deb/debian/linux?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
5.16.18-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2022-48847.json"

Debian:14 / linux

Package

Name
linux
Purl
pkg:deb/debian/linux?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
5.16.18-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2022-48847.json"