CVE-2022-48804 - vt_ioctl: fix array_index_nospec in vt_setactivate

Back Back to CVE browser

HIGH

vt_ioctl: fix array_index_nospec in vt_setactivate

Published Jul 16, 2024

7.1

HIGH

CVSS 3.1

EPSS 0.31%

Description

array_index_nospec ensures that an out-of-bounds value is set to zero on the transient path. Decreasing the value by one afterwards causes a transient integer underflow. vsa.console should be decreased first and then sanitized with array_index_nospec.

Kasper Acknowledgements: Jakob Koschel, Brian Johannesmeyer, Kaveh Razavi, Herbert Bos, Cristiano Giuffrida from the VUSec group at VU Amsterdam.

Affected products

Vendor Linux Product Linux Default
unaffected
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
  -
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
  -
- Version
  
  Status
  affected
  Constraints
  -
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
Vendor Linux Product Linux Default
unaffected
- Version
  3.16.62
  Status
  affected
  Constraints
  <3.17
- Version
  4.14.73
  Status
  affected
  Constraints
  <4.14.267
- Version
  4.18.11
  Status
  affected
  Constraints
  <4.19
- Version
  4.4.159
  Status
  affected
  Constraints
  <4.5
- Version
  4.9.130
  Status
  affected
  Constraints
  <4.9.302
Vendor Linux Product Linux Default
affected
- Version
  4.19
  Status
  affected
  Constraints
  -
- Version
  0
  Status
  unaffected
  Constraints
  <4.19
- Version
  4.14.267
  Status
  unaffected
  Constraints
  <=4.14.*
- Version
  4.19.230
  Status
  unaffected
  Constraints
  <=4.19.*
- Version
  4.9.302
  Status
  unaffected
  Constraints
  <=4.9.*
- Version
  5.10.101
  Status
  unaffected
  Constraints
  <=5.10.*
- Version
  5.15.24
  Status
  unaffected
  Constraints
  <=5.15.*
- Version
  5.16.10
  Status
  unaffected
  Constraints
  <=5.16.*
- Version
  5.17
  Status
  unaffected
  Constraints
  <=*
- Version
  5.4.180
  Status
  unaffected
  Constraints
  <=5.4.*

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Linux

unaffected

Version	Status	Constraints
	affected
	affected	-
	affected
	affected	-
	affected	-
	affected
	affected
	affected
	affected
	affected
	affected

Linux

unaffected

Version	Status	Constraints
3.16.62	affected	<3.17
4.14.73	affected	<4.14.267
4.18.11	affected	<4.19
4.4.159	affected	<4.5
4.9.130	affected	<4.9.302

Linux

affected

Version	Status	Constraints
4.19	affected	-
0	unaffected	<4.19
4.14.267	unaffected	<=4.14.*
4.19.230	unaffected	<=4.19.*
4.9.302	unaffected	<=4.9.*
5.10.101	unaffected	<=5.10.*
5.15.24	unaffected	<=5.15.*
5.16.10	unaffected	<=5.16.*
5.17	unaffected	<=*
5.4.180	unaffected	<=5.4.*

Red Hat Enterprise Linux 8

kernel-0:4.18.0-553.22.1.el8_10

Fixed · RHSA-2024:7000
Red Hat Enterprise Linux 8

kernel-rt-0:4.18.0-553.22.1.rt7.363.el8_10

Fixed · RHSA-2024:7001
Red Hat Enterprise Linux 9

kernel-0:5.14.0-503.11.1.el9_5

Fixed · RHSA-2024:9315
Red Hat Enterprise Linux 9

kernel-0:5.14.0-503.11.1.el9_5

Fixed · RHSA-2024:9315
Red Hat Enterprise Linux 9.4 Extended Update Support

kernel-0:5.14.0-427.47.1.el9_4

Fixed · RHSA-2024:10771
Red Hat Enterprise Linux 6

kernel

Not affected
Red Hat Enterprise Linux 7

kernel

Out of support scope
Red Hat Enterprise Linux 7

kernel-rt

Out of support scope
Red Hat Enterprise Linux 9

kernel-rt

Affected

Product	Package	State	Advisory
Red Hat Enterprise Linux 8	kernel-0:4.18.0-553.22.1.el8_10	Fixed	RHSA-2024:7000
Red Hat Enterprise Linux 8	kernel-rt-0:4.18.0-553.22.1.rt7.363.el8_10	Fixed	RHSA-2024:7001
Red Hat Enterprise Linux 9	kernel-0:5.14.0-503.11.1.el9_5	Fixed	RHSA-2024:9315
Red Hat Enterprise Linux 9	kernel-0:5.14.0-503.11.1.el9_5	Fixed	RHSA-2024:9315
Red Hat Enterprise Linux 9.4 Extended Update Support	kernel-0:5.14.0-427.47.1.el9_4	Fixed	RHSA-2024:10771
Red Hat Enterprise Linux 6	kernel	Not affected	n/a
Red Hat Enterprise Linux 7	kernel	Out of support scope	n/a
Red Hat Enterprise Linux 7	kernel-rt	Out of support scope	n/a
Red Hat Enterprise Linux 9	kernel-rt	Affected	n/a

Remediation

Red Hat mitigation

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

Weaknesses (1)

CWE-191

References (14)

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2022-48804		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2298140		Issue Tracking
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-53683		Advisory
https://git.kernel.org/stable/c/170325aba4608bde3e7d21c9c19b7bc266ac0885		Patch
https://git.kernel.org/stable/c/2a45a6bd1e6d651770aafff57ab3e1d3bb0b42e0		Patch
https://git.kernel.org/stable/c/61cc70d9e8ef5b042d4ed87994d20100ec8896d9		Patch
https://git.kernel.org/stable/c/6550bdf52846f85a2a3726a5aa0c7c4399f2fc02		Patch
https://git.kernel.org/stable/c/778302ca09498b448620edd372dc908bebf80bdf		Patch
https://git.kernel.org/stable/c/830c5aa302ec16b4ee641aec769462c37f802c90		Patch
https://git.kernel.org/stable/c/ae3d57411562260ee3f4fd5e875f410002341104		Patch
https://git.kernel.org/stable/c/ffe54289b02e9c732d6f04c8ebbe3b2d90d32118		Patch
https://lore.kernel.org/linux-cve-announce/2024071645-CVE-2022-48804-f191@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2022-48804
https://www.cve.org/CVERecord?id=CVE-2022-48804