CVE-2022-49044 - dm integrity: fix memory corruption when tag_size is less than digest size

Back Back to CVE browser

HIGH

dm integrity: fix memory corruption when tag_size is less than digest size

Published Feb 26, 2025

7.8

HIGH

CVSS 3.1

EPSS 0.28%

Description

It is possible to set up dm-integrity in such a way that the "tag_size" parameter is less than the actual digest size. In this situation, a part of the digest beyond tag_size is ignored.

In this case, dm-integrity would write beyond the end of the ic->recalc_tags array and corrupt memory. The corruption happened in integrity_recalc->integrity_sector_checksum->crypto_shash_final.

Fix this corruption by increasing the tags array so that it has enough padding at the end to accomodate the loop in integrity_recalc() being able to write a full digest size for the last member of the tags array.

Affected products

Vendor Linux Product Linux Default
unaffected
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
Vendor Linux Product Linux Default
affected
- Version
  4.19
  Status
  affected
  Constraints
  -
- Version
  0
  Status
  unaffected
  Constraints
  <4.19
- Version
  4.19.240
  Status
  unaffected
  Constraints
  <=4.19.*
- Version
  5.10.112
  Status
  unaffected
  Constraints
  <=5.10.*
- Version
  5.15.35
  Status
  unaffected
  Constraints
  <=5.15.*
- Version
  5.17.4
  Status
  unaffected
  Constraints
  <=5.17.*
- Version
  5.18
  Status
  unaffected
  Constraints
  <=*
- Version
  5.4.190
  Status
  unaffected
  Constraints
  <=5.4.*

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Linux

unaffected

Version	Status	Constraints
	affected
	affected
	affected
	affected
	affected
	affected

Linux

affected

Version	Status	Constraints
4.19	affected	-
0	unaffected	<4.19
4.19.240	unaffected	<=4.19.*
5.10.112	unaffected	<=5.10.*
5.15.35	unaffected	<=5.15.*
5.17.4	unaffected	<=5.17.*
5.18	unaffected	<=*
5.4.190	unaffected	<=5.4.*

Red Hat Enterprise Linux 8

kernel-0:4.18.0-372.16.1.el8_6

Fixed · RHSA-2022:5564
Red Hat Enterprise Linux 8

kernel-0:4.18.0-425.3.1.el8

Fixed · RHSA-2022:7683
Red Hat Enterprise Linux 9

kernel-0:5.14.0-70.17.1.el9_0

Fixed · RHSA-2022:5249
Red Hat Enterprise Linux 9

kernel-0:5.14.0-70.17.1.el9_0

Fixed · RHSA-2022:5249
Red Hat Virtualization 4 for Red Hat Enterprise Linux 8

kernel-0:4.18.0-372.16.1.el8_6

Fixed · RHSA-2022:5564
Red Hat Enterprise Linux 10

kernel

Not affected
Red Hat Enterprise Linux 6

kernel

Not affected
Red Hat Enterprise Linux 7

kernel

Not affected
Red Hat Enterprise Linux 7

kernel-rt

Not affected
Red Hat Enterprise Linux 8

kernel-rt

Affected
Red Hat Enterprise Linux 9

kernel-rt

Affected

Product	Package	State	Advisory
Red Hat Enterprise Linux 8	kernel-0:4.18.0-372.16.1.el8_6	Fixed	RHSA-2022:5564
Red Hat Enterprise Linux 8	kernel-0:4.18.0-425.3.1.el8	Fixed	RHSA-2022:7683
Red Hat Enterprise Linux 9	kernel-0:5.14.0-70.17.1.el9_0	Fixed	RHSA-2022:5249
Red Hat Enterprise Linux 9	kernel-0:5.14.0-70.17.1.el9_0	Fixed	RHSA-2022:5249
Red Hat Virtualization 4 for Red Hat Enterprise Linux 8	kernel-0:4.18.0-372.16.1.el8_6	Fixed	RHSA-2022:5564
Red Hat Enterprise Linux 10	kernel	Not affected	n/a
Red Hat Enterprise Linux 6	kernel	Not affected	n/a
Red Hat Enterprise Linux 7	kernel	Not affected	n/a
Red Hat Enterprise Linux 7	kernel-rt	Not affected	n/a
Red Hat Enterprise Linux 8	kernel-rt	Affected	n/a
Red Hat Enterprise Linux 9	kernel-rt	Affected	n/a

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-787

Out-of-bounds Write

References (11)

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2022-49044		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2348282		Issue Tracking
https://git.kernel.org/stable/c/08c1af8f1c13bbf210f1760132f4df24d0ed46d6		Patch
https://git.kernel.org/stable/c/4d485cf9b609709e45d5113e6e2b1b01254b2fe9		Patch
https://git.kernel.org/stable/c/6a95d91c0b315c965198f6ab7dec7c94129e17e0		Patch
https://git.kernel.org/stable/c/6b4bf97587ef6c1927a78934b700204920655123		Patch
https://git.kernel.org/stable/c/7f84c937222944c03f4615ca4742df6bed0e5adf		Patch
https://git.kernel.org/stable/c/cd02b2687d66f0a8e716384de4b9a0671331f1dc		Patch
https://lore.kernel.org/linux-cve-announce/2025022650-CVE-2022-49044-43d1@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2022-49044
https://www.cve.org/CVERecord?id=CVE-2022-49044