#VU104522 Out-of-bounds read in Linux kernel - CVE-2022-49674

Vulnerability identifier: #VU104522

Vulnerability risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-49674

CWE-ID: CWE-125

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the validate_region_size(), validate_raid_redundancy(), __rdev_sectors() and raid_iterate_devices() functions in drivers/md/dm-raid.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
https://git.kernel.org/stable/c/332bd0778775d0cf105c4b9e03e460b590749916
https://git.kernel.org/stable/c/5e161a8826b63c0b8b43e4a7fad1f956780f42ab
https://git.kernel.org/stable/c/6352b2f4d8e95ec0ae576d7705435d64cfa29503
https://git.kernel.org/stable/c/90de15357504c8097ab29769dc6852e16281e9e8
https://git.kernel.org/stable/c/9bf2b0757b04c78dc5d6e3a198acca98457b32a1
https://git.kernel.org/stable/c/bcff98500ea3b4e7615ec31d2bdd326bc1ef5134
https://git.kernel.org/stable/c/df1a5ab0dd0775f2ea101c71f2addbc4c0ea0f85

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.