CVE-2022-49674

HIGH EPSS 19.4%

Published Feb 26, 20251y ago · Modified Jun 17, 20262w ago

7.1 CVSS 3.1

High

Published Feb 26, 2025 1y ago

Last Modified Jun 17, 2026 2w ago

Description

In the Linux kernel, the following vulnerability has been resolved: dm raid: fix accesses beyond end of raid member array On dm-raid table load (using raid_ctr), dm-raid allocates an array rs->devs[rs->raid_disks] for the raid device members. rs->raid_disks is defined by the number of raid metadata and image tupples passed into the target's constructor. In the case of RAID layout changes being requested, that number can be different from the current number of members for existing raid sets as defined in their superblocks. Example RAID layout changes include: - raid1 legs being added/removed - raid4/5/6/10 number of stripes changed (stripe reshaping) - takeover to higher raid level (e.g. raid5 -> raid6) When accessing array members, rs->raid_disks must be used in control loops instead of the potentially larger value in rs->md.raid_disks. Otherwise it will cause memory access beyond the end of the rs->devs array. Fix this by changing code that is prone to out-of-bounds access. Also fix validate_raid_redundancy() to validate all devices that are added. Also, use braces to help clean up raid_iterate_devices(). The out-of-bounds memory accesses was discovered using KASAN. This commit was verified to pass all LVM2 RAID tests (with KASAN enabled).

CVSS Details

Base Score

7.1

Exploitability

1.8

Impact

5.2

Vector string

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Attack Vector Local

Attack Complexity Low

Privileges Required Low

User Interaction None

Scope Unchanged

Confidentiality High

Integrity None

Availability High

Threat Intelligence

EPSS Exploit Probability

19.4% percentile

Exploit & Patch Status

No Known Exploit

Patch Available

Weaknesses 1

CWE-125 Out-of-bounds Read Memory Safety

Affected Products 10

Vendor	Product	Version	Range
linux	linux_kernel	*	<4.14.287
linux	linux_kernel	*	≥4.15 – <4.19.251
linux	linux_kernel	*	≥4.20 – <5.4.204
linux	linux_kernel	*	≥5.5 – <5.10.129
linux	linux_kernel	*	≥5.11 – <5.15.53
linux	linux_kernel	*	≥5.16 – <5.18.10
linux	linux_kernel	5.19	any
linux	linux_kernel	5.19	any
linux	linux_kernel	5.19	any
linux	linux_kernel	5.19	any

References 7

git.kernel.org https://git.kernel.org/stable/c/332bd0778775d0cf105c4b9e03e460b590749916

Patch
git.kernel.org https://git.kernel.org/stable/c/5e161a8826b63c0b8b43e4a7fad1f956780f42ab

Patch
git.kernel.org https://git.kernel.org/stable/c/6352b2f4d8e95ec0ae576d7705435d64cfa29503

Patch
git.kernel.org https://git.kernel.org/stable/c/90de15357504c8097ab29769dc6852e16281e9e8

Patch
git.kernel.org https://git.kernel.org/stable/c/9bf2b0757b04c78dc5d6e3a198acca98457b32a1

Patch
git.kernel.org https://git.kernel.org/stable/c/bcff98500ea3b4e7615ec31d2bdd326bc1ef5134

Patch
git.kernel.org https://git.kernel.org/stable/c/df1a5ab0dd0775f2ea101c71f2addbc4c0ea0f85

Patch

Remediation

git.kernel.org https://git.kernel.org/stable/c/332bd0778775d0cf105c4b9e03e460b590749916

Patch
git.kernel.org https://git.kernel.org/stable/c/5e161a8826b63c0b8b43e4a7fad1f956780f42ab

Patch
git.kernel.org https://git.kernel.org/stable/c/6352b2f4d8e95ec0ae576d7705435d64cfa29503

Patch
git.kernel.org https://git.kernel.org/stable/c/90de15357504c8097ab29769dc6852e16281e9e8

Patch
git.kernel.org https://git.kernel.org/stable/c/9bf2b0757b04c78dc5d6e3a198acca98457b32a1

Patch
git.kernel.org https://git.kernel.org/stable/c/bcff98500ea3b4e7615ec31d2bdd326bc1ef5134

Patch
git.kernel.org https://git.kernel.org/stable/c/df1a5ab0dd0775f2ea101c71f2addbc4c0ea0f85

Patch