cbcvebase.
CVE-2022-49674
published 2025-02-26

CVE-2022-49674: In the Linux kernel, the following vulnerability has been resolved: dm raid: fix accesses beyond end of raid member array On dm-raid table load (using…

PriorityP431high7.1CVSS 3.1
AVLACLPRLUINSUCHINAH
EPSS
0.29%
21.4th percentile
In the Linux kernel, the following vulnerability has been resolved: dm raid: fix accesses beyond end of raid member array On dm-raid table load (using raid_ctr), dm-raid allocates an array rs->devs[rs->raid_disks] for the raid device members. rs->raid_disks is defined by the number of raid metadata and image tupples passed into the target's constructor. In the case of RAID layout changes being requested, that number can be different from the current number of members for existing raid sets as defined in their superblocks. Example RAID layout changes include: - raid1 legs being added/removed - raid4/5/6/10 number of stripes changed (stripe reshaping) - takeover to higher raid level (e.g. raid5 -> raid6) When accessing array members, rs->raid_disks must be used in control loops instead of the potentially larger value in rs->md.raid_disks. Otherwise it will cause memory access beyond the end of the rs->devs array. Fix this by changing code that is prone to out-of-bounds access. Also fix validate_raid_redundancy() to validate all devices that are added. Also, use braces to help clean up raid_iterate_devices(). The out-of-bounds memory accesses was discovered using KASAN. This commit was verified to pass all LVM2 RAID tests (with KASAN enabled).

Affected

20 ranges
VendorProductVersion rangeFixed in
debianlinux< linux 5.18.14-1 (bookworm)linux 5.18.14-1 (bookworm)
linuxlinux——
linuxlinux>= 33e53f06850f44ec9722e08a993ecf8816e447a5 < 5e161a8826b63c0b8b43e4a7fad1f956780f42ab5e161a8826b63c0b8b43e4a7fad1f956780f42ab
linuxlinux>= 33e53f06850f44ec9722e08a993ecf8816e447a5 < df1a5ab0dd0775f2ea101c71f2addbc4c0ea0f85df1a5ab0dd0775f2ea101c71f2addbc4c0ea0f85
linuxlinux>= 33e53f06850f44ec9722e08a993ecf8816e447a5 < 90de15357504c8097ab29769dc6852e16281e9e890de15357504c8097ab29769dc6852e16281e9e8
linuxlinux>= 33e53f06850f44ec9722e08a993ecf8816e447a5 < 9bf2b0757b04c78dc5d6e3a198acca98457b32a19bf2b0757b04c78dc5d6e3a198acca98457b32a1
linuxlinux>= 33e53f06850f44ec9722e08a993ecf8816e447a5 < 6352b2f4d8e95ec0ae576d7705435d64cfa295036352b2f4d8e95ec0ae576d7705435d64cfa29503
linuxlinux>= 33e53f06850f44ec9722e08a993ecf8816e447a5 < bcff98500ea3b4e7615ec31d2bdd326bc1ef5134bcff98500ea3b4e7615ec31d2bdd326bc1ef5134
linuxlinux>= 33e53f06850f44ec9722e08a993ecf8816e447a5 < 332bd0778775d0cf105c4b9e03e460b590749916332bd0778775d0cf105c4b9e03e460b590749916
linuxlinux_kernel< 4.14.2874.14.287
linuxlinux_kernel——
linuxlinux_kernel>= 0 < 5.10.136-15.10.136-1
linuxlinux_kernel>= 0 < 5.18.14-15.18.14-1
linuxlinux_kernel>= 0 < 5.18.14-15.18.14-1
linuxlinux_kernel>= 0 < 5.18.14-15.18.14-1
linuxlinux_kernel>= 4.15 < 4.19.2514.19.251
linuxlinux_kernel>= 4.20 < 5.4.2045.4.204
linuxlinux_kernel>= 5.11 < 5.15.535.15.53
linuxlinux_kernel>= 5.16 < 5.18.105.18.10
linuxlinux_kernel>= 5.5 < 5.10.1295.10.129

CVSS provenance

nvdv3.17.1HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
osv7.1HIGH
vendor_debian7.1HIGH
vendor_redhat7.1HIGH
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.