CVE-2022-49395

一、漏洞信息
 漏洞编号：[CVE-2022-49395](https://nvd.nist.gov/vuln/detail/CVE-2022-49395)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.19,6.1.8,6.4.0,6.6.0
 CVSS V3.0分值：
  BaseScore：5.5 Medium
  Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:um: Fix out-of-bounds read in LDT setupsyscall_stub_data() expects the data_count parameter to be the number oflongs, not bytes. ================================================================== BUG: KASAN: stack-out-of-bounds in syscall_stub_data+0x70/0xe0 Read of size 128 at addr 000000006411f6f0 by task swapper/1 CPU: 0 PID: 1 Comm: swapper Not tainted 5.18.0+ #18 Call Trace:  show_stack.cold+0x166/0x2a7  __dump_stack+0x3a/0x43  dump_stack_lvl+0x1f/0x27  print_report.cold+0xdb/0xf81  kasan_report+0x119/0x1f0  kasan_check_range+0x3a3/0x440  memcpy+0x52/0x140  syscall_stub_data+0x70/0xe0  write_ldt_entry+0xac/0x190  init_new_ldt+0x515/0x960  init_new_context+0x2c4/0x4d0  mm_init.constprop.0+0x5ed/0x760  mm_alloc+0x118/0x170  0x60033f48  do_one_initcall+0x1d7/0x860  0x60003e7b  kernel_init+0x6e/0x3d4  new_thread_handler+0x1e7/0x2c0 The buggy address belongs to stack of task swapper/1  and is located at offset 64 in frame:  init_new_ldt+0x0/0x960 This frame has 2 objects:  [32, 40)  addr   [64, 80)  desc  ==================================================================
 漏洞公开时间：2025-02-26 15:01:16
 漏洞创建时间：2025-02-26 18:41:55
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2022-49395
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/10995a382271254bd276627ec74136da4a23c4a6 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/24ca648bf5f72ed8878cf09b5d4431935779681e |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/2a4a62a14be1947fa945c5c11ebf67326381a568 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/3549ab4b962cf619e8c55484a0d870a34b3f845f |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/668ca34a428d6ffc0f99a1a6a9b661a288d4183b |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/91e5ba2af2d729d5126aefd5aa3eadc69b8426e5 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/9caad70819aef3431abaf73ba5163b55b161aba0 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/cf0dabc37446c5ee538ae7b4c467ab0e53fa5463 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/ef1dc929a1e5fa1b2d842256db9fb8710d3be910 |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-49395 | https://bugzilla.suse.com/show_bug.cgi?id=1237953 |
| suse_bugzilla | https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2022/CVE-2022-49395.mbox | https://bugzilla.suse.com/show_bug.cgi?id=1237953 |
| suse_bugzilla | https://git.kernel.org/stable/c/668ca34a428d6ffc0f99a1a6a9b661a288d4183b | https://bugzilla.suse.com/show_bug.cgi?id=1237953 |
| suse_bugzilla | https://git.kernel.org/stable/c/ef1dc929a1e5fa1b2d842256db9fb8710d3be910 | https://bugzilla.suse.com/show_bug.cgi?id=1237953 |
| suse_bugzilla | https://git.kernel.org/stable/c/3549ab4b962cf619e8c55484a0d870a34b3f845f | https://bugzilla.suse.com/show_bug.cgi?id=1237953 |
| suse_bugzilla | https://git.kernel.org/stable/c/9caad70819aef3431abaf73ba5163b55b161aba0 | https://bugzilla.suse.com/show_bug.cgi?id=1237953 |
| suse_bugzilla | https://git.kernel.org/stable/c/cf0dabc37446c5ee538ae7b4c467ab0e53fa5463 | https://bugzilla.suse.com/show_bug.cgi?id=1237953 |
| suse_bugzilla | https://git.kernel.org/stable/c/10995a382271254bd276627ec74136da4a23c4a6 | https://bugzilla.suse.com/show_bug.cgi?id=1237953 |
| suse_bugzilla | https://git.kernel.org/stable/c/24ca648bf5f72ed8878cf09b5d4431935779681e | https://bugzilla.suse.com/show_bug.cgi?id=1237953 |
| suse_bugzilla | https://git.kernel.org/stable/c/91e5ba2af2d729d5126aefd5aa3eadc69b8426e5 | https://bugzilla.suse.com/show_bug.cgi?id=1237953 |
| suse_bugzilla | https://git.kernel.org/stable/c/2a4a62a14be1947fa945c5c11ebf67326381a568 | https://bugzilla.suse.com/show_bug.cgi?id=1237953 |
| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2347899 | https://bugzilla.suse.com/show_bug.cgi?id=1237953 |
| redhat_bugzilla | https://lore.kernel.org/linux-cve-announce/2025022650-CVE-2022-49395-7419@gregkh/T | https://bugzilla.redhat.com/show_bug.cgi?id=2347899 |
| anolis |  | https://anas.openanolis.cn/cves/detail/CVE-2022-49395 |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

无
</details>

二、漏洞分析结构反馈
 影响性分析说明：
  In the Linux kernel, the following vulnerability has been resolved:um: Fix out-of-bounds read in LDT setupsyscall_stub_data() expects the data_count parameter to be the number oflongs, not bytes. ================================================================== BUG: KASAN: stack-out-of-bounds in syscall_stub_data+0x70/0xe0 Read of size 128 at addr 000000006411f6f0 by task swapper/1 CPU: 0 PID: 1 Comm: swapper Not tainted 5.18.0+ #18 Call Trace:  show_stack.cold+0x166/0x2a7  __dump_stack+0x3a/0x43  dump_stack_lvl+0x1f/0x27  print_report.cold+0xdb/0xf81  kasan_report+0x119/0x1f0  kasan_check_range+0x3a3/0x440  memcpy+0x52/0x140  syscall_stub_data+0x70/0xe0  write_ldt_entry+0xac/0x190  init_new_ldt+0x515/0x960  init_new_context+0x2c4/0x4d0  mm_init.constprop.0+0x5ed/0x760  mm_alloc+0x118/0x170  0x60033f48  do_one_initcall+0x1d7/0x860  0x60003e7b  kernel_init+0x6e/0x3d4  new_thread_handler+0x1e7/0x2c0 The buggy address belongs to stack of task swapper/1  and is located at offset 64 in frame:  init_new_ldt+0x0/0x960 This frame has 2 objects:  [32, 40)  addr   [64, 80)  desc  ==================================================================
 openEuler评分：
  5.5
 Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
 受影响版本排查(受影响/不受影响)：
  1.openEuler-20.03-LTS-SP4(4.19.90):受影响
2.openEuler-22.03-LTS-SP3(5.10.0):不受影响
3.openEuler-22.03-LTS-SP4(5.10.0):不受影响
4.master(6.6.0):不受影响
5.openEuler-24.03-LTS(6.6.0):不受影响
6.openEuler-24.03-LTS-Next(6.6.0):不受影响
7.openEuler-24.03-LTS-SP1(6.6.0):不受影响

修复是否涉及abi变化(是/否)：
  1.openEuler-20.03-LTS-SP4(4.19.90):否
2.openEuler-22.03-LTS-SP3(5.10.0):否
3.master(6.6.0):否
4.openEuler-24.03-LTS(6.6.0):否
5.openEuler-24.03-LTS-Next(6.6.0):否
6.openEuler-22.03-LTS-SP4(5.10.0):否
7.openEuler-24.03-LTS-SP1(6.6.0):否

原因说明：
  1.openEuler-20.03-LTS-SP4(4.19.90):正常修复
2.master(6.6.0):不受影响-漏洞代码不能被攻击者触发
3.openEuler-24.03-LTS-Next(6.6.0):不受影响-漏洞代码不能被攻击者触发
4.openEuler-22.03-LTS-SP3(5.10.0):不受影响-漏洞代码不存在
5.openEuler-22.03-LTS-SP4(5.10.0):不受影响-漏洞代码不存在
6.openEuler-24.03-LTS(6.6.0):不受影响-漏洞代码不存在
7.openEuler-24.03-LTS-SP1(6.6.0):不受影响-漏洞代码不存在

三、漏洞修复
安全公告链接：https://www.openeuler.org/zh/security/safety-bulletin/detail/?id=openEuler-SA-2025-1370

src-openEuler/kernel

内容风险标识

评论 (8)

src-openEuler/kernel .gitee-modal { width: 500px !important; }

内容风险标识

CVE-2022-49395

评论 (8)

搜索帮助

src-openEuler/kernel