CVE-2022-49077
published 2025-02-26CVE-2022-49077: In the Linux kernel, the following vulnerability has been resolved: mmmremap.c: avoid pointless invalidate_range_start/end on mremap(old_size=0) If an mremap()…
PriorityP418medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.25%
16.0th percentile
In the Linux kernel, the following vulnerability has been resolved:
mmmremap.c: avoid pointless invalidate_range_start/end on mremap(old_size=0)
If an mremap() syscall with old_size=0 ends up in move_page_tables(), it
will call invalidate_range_start()/invalidate_range_end() unnecessarily,
i.e. with an empty range.
This causes a WARN in KVM's mmu_notifier. In the past, empty ranges
have been diagnosed to be off-by-one bugs, hence the WARNing. Given the
low (so far) number of unique reports, the benefits of detecting more
buggy callers seem to outweigh the cost of having to fix cases such as
this one, where userspace is doing something silly. In this particular
case, an early return from move_page_tables() is enough to fix the
issue.
Affected
24 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 5.17.3-1 (bookworm) | linux 5.17.3-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= 7b6efc2bc4f19952b25ebf9b236e5ac43cd386c2 < a05540f3903bd8295e8c4cd90dd3d416239a115b | a05540f3903bd8295e8c4cd90dd3d416239a115b |
| linux | linux | >= 7b6efc2bc4f19952b25ebf9b236e5ac43cd386c2 < eeaf28e2a0128147d687237e59d5407ee1b14693 | eeaf28e2a0128147d687237e59d5407ee1b14693 |
| linux | linux | >= 7b6efc2bc4f19952b25ebf9b236e5ac43cd386c2 < e2c328c2a8f9de8b761bd4025b66c63120c55761 | e2c328c2a8f9de8b761bd4025b66c63120c55761 |
| linux | linux | >= 7b6efc2bc4f19952b25ebf9b236e5ac43cd386c2 < c19d8de4e682ec4b0ea2b04a832cd8cc0be3bb31 | c19d8de4e682ec4b0ea2b04a832cd8cc0be3bb31 |
| linux | linux | >= 7b6efc2bc4f19952b25ebf9b236e5ac43cd386c2 < 7d659cb1763ff17d1c6ee082fa6feb4267c7a30b | 7d659cb1763ff17d1c6ee082fa6feb4267c7a30b |
| linux | linux | >= 7b6efc2bc4f19952b25ebf9b236e5ac43cd386c2 < a04cb99c5d4668fe3f5c0e5b6da1cecd34c3f219 | a04cb99c5d4668fe3f5c0e5b6da1cecd34c3f219 |
| linux | linux | >= 7b6efc2bc4f19952b25ebf9b236e5ac43cd386c2 < 2358aa84ef6dafcf544a557caaa6b91afb4a0bd2 | 2358aa84ef6dafcf544a557caaa6b91afb4a0bd2 |
| linux | linux | >= 7b6efc2bc4f19952b25ebf9b236e5ac43cd386c2 < 04bc13dae4a27b8d030843c85ae452bb2f1d9c1f | 04bc13dae4a27b8d030843c85ae452bb2f1d9c1f |
| linux | linux | >= 7b6efc2bc4f19952b25ebf9b236e5ac43cd386c2 < 01e67e04c28170c47700c2c226d732bbfedb1ad0 | 01e67e04c28170c47700c2c226d732bbfedb1ad0 |
| linux | linux_kernel | < 4.9.311 | 4.9.311 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 5.10.113-1 | 5.10.113-1 |
| linux | linux_kernel | >= 0 < 5.17.3-1 | 5.17.3-1 |
| linux | linux_kernel | >= 0 < 5.17.3-1 | 5.17.3-1 |
| linux | linux_kernel | >= 0 < 5.17.3-1 | 5.17.3-1 |
| linux | linux_kernel | >= 4.10 < 4.14.276 | 4.14.276 |
| linux | linux_kernel | >= 4.15 < 4.19.238 | 4.19.238 |
| linux | linux_kernel | >= 4.20 < 5.4.189 | 5.4.189 |
| linux | linux_kernel | >= 5.11 < 5.15.34 | 5.15.34 |
| linux | linux_kernel | >= 5.16 < 5.16.20 | 5.16.20 |
| linux | linux_kernel | >= 5.17 < 5.17.3 | 5.17.3 |
| linux | linux_kernel | >= 5.5 < 5.10.111 | 5.10.111 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-qx25-m2gm-9qrc: In the Linux kernel, the following vulnerability has been resolved:
mmmremap
ghsa_unreviewed·2025-10-14
CVE-2022-49077 [MEDIUM] CWE-193 GHSA-qx25-m2gm-9qrc: In the Linux kernel, the following vulnerability has been resolved:
mmmremap
In the Linux kernel, the following vulnerability has been resolved:
mmmremap.c: avoid pointless invalidate_range_start/end on mremap(old_size=0)
If an mremap() syscall with old_size=0 ends up in move_page_tables(), it
will call invalidate_range_start()/invalidate_range_end() unnecessarily,
i.e. with an empty range.
This causes a WARN in KVM's mmu_notifier. In the past, empty ranges
have been diagnosed to be off-by-one bugs, hence the WARNing. Given the
low (so far) number of unique reports, the benefits of detecting more
buggy callers seem to outweigh the cost of having to fix cases such as
this one, where userspace is doing something silly. In this particular
case, an early return from move_page_tables() is enough to fix the
issue.
OSV
CVE-2022-49077: In the Linux kernel, the following vulnerability has been resolved: mmmremap
osv·2025-02-26·CVSS 5.5
CVE-2022-49077 [MEDIUM] CVE-2022-49077: In the Linux kernel, the following vulnerability has been resolved: mmmremap
In the Linux kernel, the following vulnerability has been resolved: mmmremap.c: avoid pointless invalidate_range_start/end on mremap(old_size=0) If an mremap() syscall with old_size=0 ends up in move_page_tables(), it will call invalidate_range_start()/invalidate_range_end() unnecessarily, i.e. with an empty range. This causes a WARN in KVM's mmu_notifier. In the past, empty ranges have been diagnosed to be off-by-one bugs, hence the WARNing. Given the low (so far) number of unique reports, the benefits of detecting more buggy callers seem to outweigh the cost of having to fix cases such as this one, where userspace is doing something silly. In this particular case, an early return from move_page_tables() is enough to fix the issue.
Red Hat
kernel: mmmremap.c: avoid pointless invalidate_range_start/end on mremap(old_size=0)
vendor_redhat·2025-02-26·CVSS 5.5
CVE-2022-49077 [MEDIUM] CWE-193 kernel: mmmremap.c: avoid pointless invalidate_range_start/end on mremap(old_size=0)
kernel: mmmremap.c: avoid pointless invalidate_range_start/end on mremap(old_size=0)
In the Linux kernel, the following vulnerability has been resolved:
mmmremap.c: avoid pointless invalidate_range_start/end on mremap(old_size=0)
If an mremap() syscall with old_size=0 ends up in move_page_tables(), it
will call invalidate_range_start()/invalidate_range_end() unnecessarily,
i.e. with an empty range.
This causes a WARN in KVM's mmu_notifier. In the past, empty ranges
have been diagnosed to be off-by-one bugs, hence the WARNing. Given the
low (so far) number of unique reports, the benefits of detecting more
buggy callers seem to outweigh the cost of having to fix cases such as
this one, where userspace is doing something silly. In this particular
case, an early return from move_page_tables()
Debian
CVE-2022-49077: linux - In the Linux kernel, the following vulnerability has been resolved: mmmremap.c:...
vendor_debian·2022·CVSS 5.5
CVE-2022-49077 [MEDIUM] CVE-2022-49077: linux - In the Linux kernel, the following vulnerability has been resolved: mmmremap.c:...
In the Linux kernel, the following vulnerability has been resolved: mmmremap.c: avoid pointless invalidate_range_start/end on mremap(old_size=0) If an mremap() syscall with old_size=0 ends up in move_page_tables(), it will call invalidate_range_start()/invalidate_range_end() unnecessarily, i.e. with an empty range. This causes a WARN in KVM's mmu_notifier. In the past, empty ranges have been diagnosed to be off-by-one bugs, hence the WARNing. Given the low (so far) number of unique reports, the benefits of detecting more buggy callers seem to outweigh the cost of having to fix cases such as this one, where userspace is doing something silly. In this particular case, an early return from move_page_tables() is enough to fix the issue.
Scope: local
bookworm: resolved (fixed in 5.17.3-1)
bulls
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/01e67e04c28170c47700c2c226d732bbfedb1ad0https://git.kernel.org/stable/c/04bc13dae4a27b8d030843c85ae452bb2f1d9c1fhttps://git.kernel.org/stable/c/2358aa84ef6dafcf544a557caaa6b91afb4a0bd2https://git.kernel.org/stable/c/7d659cb1763ff17d1c6ee082fa6feb4267c7a30bhttps://git.kernel.org/stable/c/a04cb99c5d4668fe3f5c0e5b6da1cecd34c3f219https://git.kernel.org/stable/c/a05540f3903bd8295e8c4cd90dd3d416239a115bhttps://git.kernel.org/stable/c/c19d8de4e682ec4b0ea2b04a832cd8cc0be3bb31https://git.kernel.org/stable/c/e2c328c2a8f9de8b761bd4025b66c63120c55761https://git.kernel.org/stable/c/eeaf28e2a0128147d687237e59d5407ee1b14693
2025-02-26
Published