CVE-2022-49846

一、漏洞信息
 漏洞编号：[CVE-2022-49846](https://nvd.nist.gov/vuln/detail/CVE-2022-49846)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.19,6.4.0,6.6.0
 CVSS V3.0分值：
  BaseScore：7.8 High
  Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:udf: Fix a slab-out-of-bounds write bug in udf_find_entry()Syzbot reported a slab-out-of-bounds Write bug:loop0: detected capacity change from 0 to 2048==================================================================BUG: KASAN: slab-out-of-bounds in udf_find_entry+0x8a5/0x14f0fs/udf/namei.c:253Write of size 105 at addr ffff8880123ff896 by task syz-executor323/3610CPU: 0 PID: 3610 Comm: syz-executor323 Not tainted6.1.0-rc2-syzkaller-00105-gb229b6ca5abb #0Hardware name: Google Compute Engine/Google Compute Engine, BIOSGoogle 10/11/2022Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1b1/0x28e lib/dump_stack.c:106 print_address_description+0x74/0x340 mm/kasan/report.c:284 print_report+0x107/0x1f0 mm/kasan/report.c:395 kasan_report+0xcd/0x100 mm/kasan/report.c:495 kasan_check_range+0x2a7/0x2e0 mm/kasan/generic.c:189 memcpy+0x3c/0x60 mm/kasan/shadow.c:66 udf_find_entry+0x8a5/0x14f0 fs/udf/namei.c:253 udf_lookup+0xef/0x340 fs/udf/namei.c:309 lookup_open fs/namei.c:3391 [inline] open_last_lookups fs/namei.c:3481 [inline] path_openat+0x10e6/0x2df0 fs/namei.c:3710 do_filp_open+0x264/0x4f0 fs/namei.c:3740 do_sys_openat2+0x124/0x4e0 fs/open.c:1310 do_sys_open fs/open.c:1326 [inline] __do_sys_creat fs/open.c:1402 [inline] __se_sys_creat fs/open.c:1396 [inline] __x64_sys_creat+0x11f/0x160 fs/open.c:1396 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcdRIP: 0033:0x7ffab0d164d9Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48RSP: 002b:00007ffe1a7e6bb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000055RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007ffab0d164d9RDX: 00007ffab0d164d9 RSI: 0000000000000000 RDI: 0000000020000180RBP: 00007ffab0cd5a10 R08: 0000000000000000 R09: 0000000000000000R10: 00005555573552c0 R11: 0000000000000246 R12: 00007ffab0cd5aa0R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 </TASK>Allocated by task 3610: kasan_save_stack mm/kasan/common.c:45 [inline] kasan_set_track+0x3d/0x60 mm/kasan/common.c:52 ____kasan_kmalloc mm/kasan/common.c:371 [inline] __kasan_kmalloc+0x97/0xb0 mm/kasan/common.c:380 kmalloc include/linux/slab.h:576 [inline] udf_find_entry+0x7b6/0x14f0 fs/udf/namei.c:243 udf_lookup+0xef/0x340 fs/udf/namei.c:309 lookup_open fs/namei.c:3391 [inline] open_last_lookups fs/namei.c:3481 [inline] path_openat+0x10e6/0x2df0 fs/namei.c:3710 do_filp_open+0x264/0x4f0 fs/namei.c:3740 do_sys_openat2+0x124/0x4e0 fs/open.c:1310 do_sys_open fs/open.c:1326 [inline] __do_sys_creat fs/open.c:1402 [inline] __se_sys_creat fs/open.c:1396 [inline] __x64_sys_creat+0x11f/0x160 fs/open.c:1396 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcdThe buggy address belongs to the object at ffff8880123ff800 which belongs to the cache kmalloc-256 of size 256The buggy address is located 150 bytes inside of 256-byte region [ffff8880123ff800, ffff8880123ff900)The buggy address belongs to the physical page:page:ffffea000048ff80 refcount:1 mapcount:0 mapping:0000000000000000index:0x0 pfn:0x123fehead:ffffea000048ff80 order:1 compound_mapcount:0 compound_pincount:0flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff)raw: 00fff00000010200 ffffea00004b8500 dead000000000003 ffff888012041b40raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000page dumped because: kasan: bad access detectedpage_owner tracks the page as allocatedpage last allocated via order 0, migratetype Unmovable, gfp_mask 0x0(),pid 1, tgid 1 (swapper/0), ts 1841222404, free_ts 0 create_dummy_stack mm/page_owner.c:---truncated---
 漏洞公开时间：2025-05-01 23:16:08
 漏洞创建时间：2025-05-02 00:16:48
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2022-49846
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/03f9582a6a2ebd25a440896475c968428c4b63e7 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/583fdd98d94acba1e7225e5cc29063aef0741030 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/7a6051d734f1ed0031e2216f9a538621235c11a4 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/ac79001b8e603226fab17240a79cb9ef679d3cd9 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/c736ed8541605e3a25075bb1cbf8f38cb3083238 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/c8af247de385ce49afabc3bf1cf4fd455c94bfe8 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/d8971f410739a864c537e0ac29344a7b6c450232 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/f1517721c408631f09d54c743aa70cb07fd3eebd |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-49846 | https://bugzilla.suse.com/show_bug.cgi?id=1242716 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2022-49846 | https://bugzilla.suse.com/show_bug.cgi?id=1242716 |
| suse_bugzilla | https://git.kernel.org/stable/c/03f9582a6a2ebd25a440896475c968428c4b63e7 | https://bugzilla.suse.com/show_bug.cgi?id=1242716 |
| suse_bugzilla | https://git.kernel.org/stable/c/583fdd98d94acba1e7225e5cc29063aef0741030 | https://bugzilla.suse.com/show_bug.cgi?id=1242716 |
| suse_bugzilla | https://git.kernel.org/stable/c/7a6051d734f1ed0031e2216f9a538621235c11a4 | https://bugzilla.suse.com/show_bug.cgi?id=1242716 |
| suse_bugzilla | https://git.kernel.org/stable/c/ac79001b8e603226fab17240a79cb9ef679d3cd9 | https://bugzilla.suse.com/show_bug.cgi?id=1242716 |
| suse_bugzilla | https://git.kernel.org/stable/c/c736ed8541605e3a25075bb1cbf8f38cb3083238 | https://bugzilla.suse.com/show_bug.cgi?id=1242716 |
| suse_bugzilla | https://git.kernel.org/stable/c/c8af247de385ce49afabc3bf1cf4fd455c94bfe8 | https://bugzilla.suse.com/show_bug.cgi?id=1242716 |
| suse_bugzilla | https://git.kernel.org/stable/c/d8971f410739a864c537e0ac29344a7b6c450232 | https://bugzilla.suse.com/show_bug.cgi?id=1242716 |
| suse_bugzilla | https://git.kernel.org/stable/c/f1517721c408631f09d54c743aa70cb07fd3eebd | https://bugzilla.suse.com/show_bug.cgi?id=1242716 |
| suse_bugzilla | https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2022/CVE-2022-49846.mbox | https://bugzilla.suse.com/show_bug.cgi?id=1242716 |
| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2363432 | https://bugzilla.suse.com/show_bug.cgi?id=1242716 |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
|  |  | https://git.kernel.org/stable/c/03f9582a6a2ebd25a440896475c968428c4b63e7 |  | nvd |
|  |  | https://git.kernel.org/stable/c/583fdd98d94acba1e7225e5cc29063aef0741030 |  | nvd |
|  |  | https://git.kernel.org/stable/c/7a6051d734f1ed0031e2216f9a538621235c11a4 |  | nvd |
|  |  | https://git.kernel.org/stable/c/ac79001b8e603226fab17240a79cb9ef679d3cd9 |  | nvd |
|  |  | https://git.kernel.org/stable/c/c736ed8541605e3a25075bb1cbf8f38cb3083238 |  | nvd |
|  |  | https://git.kernel.org/stable/c/c8af247de385ce49afabc3bf1cf4fd455c94bfe8 |  | nvd |
|  |  | https://git.kernel.org/stable/c/d8971f410739a864c537e0ac29344a7b6c450232 |  | nvd |
|  |  | https://git.kernel.org/stable/c/f1517721c408631f09d54c743aa70cb07fd3eebd |  | nvd |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
  In the Linux kernel, the following vulnerability has been resolved:udf: Fix a slab-out-of-bounds write bug in udf_find_entry()Syzbot reported a slab-out-of-bounds Write bug:loop0: detected capacity change from 0 to 2048==================================================================BUG: KASAN: slab-out-of-bounds in udf_find_entry+0x8a5/0x14f0fs/udf/namei.c:253Write of size 105 at addr ffff8880123ff896 by task syz-executor323/3610CPU: 0 PID: 3610 Comm: syz-executor323 Not tainted6.1.0-rc2-syzkaller-00105-gb229b6ca5abb #0Hardware name: Google Compute Engine/Google Compute Engine, BIOSGoogle 10/11/2022Call Trace: &lt;TASK&gt; __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1b1/0x28e lib/dump_stack.c:106 print_address_description+0x74/0x340 mm/kasan/report.c:284 print_report+0x107/0x1f0 mm/kasan/report.c:395 kasan_report+0xcd/0x100 mm/kasan/report.c:495 kasan_check_range+0x2a7/0x2e0 mm/kasan/generic.c:189 memcpy+0x3c/0x60 mm/kasan/shadow.c:66 udf_find_entry+0x8a5/0x14f0 fs/udf/namei.c:253 udf_lookup+0xef/0x340 fs/udf/namei.c:309 lookup_open fs/namei.c:3391 [inline] open_last_lookups fs/namei.c:3481 [inline] path_openat+0x10e6/0x2df0 fs/namei.c:3710 do_filp_open+0x264/0x4f0 fs/namei.c:3740 do_sys_openat2+0x124/0x4e0 fs/open.c:1310 do_sys_open fs/open.c:1326 [inline] __do_sys_creat fs/open.c:1402 [inline] __se_sys_creat fs/open.c:1396 [inline] __x64_sys_creat+0x11f/0x160 fs/open.c:1396 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcdRIP: 0033:0x7ffab0d164d9Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 &lt;48&gt; 3d 01f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48RSP: 002b:00007ffe1a7e6bb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000055RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007ffab0d164d9RDX: 00007ffab0d164d9 RSI: 0000000000000000 RDI: 0000000020000180RBP: 00007ffab0cd5a10 R08: 0000000000000000 R09: 0000000000000000R10: 00005555573552c0 R11: 0000000000000246 R12: 00007ffab0cd5aa0R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 &lt;/TASK&gt;Allocated by task 3610: kasan_save_stack mm/kasan/common.c:45 [inline] kasan_set_track+0x3d/0x60 mm/kasan/common.c:52 ____kasan_kmalloc mm/kasan/common.c:371 [inline] __kasan_kmalloc+0x97/0xb0 mm/kasan/common.c:380 kmalloc include/linux/slab.h:576 [inline] udf_find_entry+0x7b6/0x14f0 fs/udf/namei.c:243 udf_lookup+0xef/0x340 fs/udf/namei.c:309 lookup_open fs/namei.c:3391 [inline] open_last_lookups fs/namei.c:3481 [inline] path_openat+0x10e6/0x2df0 fs/namei.c:3710 do_filp_open+0x264/0x4f0 fs/namei.c:3740 do_sys_openat2+0x124/0x4e0 fs/open.c:1310 do_sys_open fs/open.c:1326 [inline] __do_sys_creat fs/open.c:1402 [inline] __se_sys_creat fs/open.c:1396 [inline] __x64_sys_creat+0x11f/0x160 fs/open.c:1396 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcdThe buggy address belongs to the object at ffff8880123ff800 which belongs to the cache kmalloc-256 of size 256The buggy address is located 150 bytes inside of 256-byte region [ffff8880123ff800, ffff8880123ff900)The buggy address belongs to the physical page:page:ffffea000048ff80 refcount:1 mapcount:0 mapping:0000000000000000index:0x0 pfn:0x123fehead:ffffea000048ff80 order:1 compound_mapcount:0 compound_pincount:0flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff)raw: 00fff00000010200 ffffea00004b8500 dead000000000003 ffff888012041b40raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000page dumped because: kasan: bad access detectedpage_owner tracks the page as allocatedpage last allocated via order 0, migratetype Unmovable, gfp_mask 0x0(),pid 1, tgid 1 (swapper/0), ts 1841222404, free_ts 0 create_dummy_stack mm/page_owner.c:67 [inline] register_early_stack+0x77/0xd0 mm/page_owner.c:83 init_page_owner+0x3a/0x731 mm/page_owner.c:93 kernel_init_freeable+0x41c/0x5d5 init/main.c:1629 kernel_init+0x19/0x2b0 ini
 openEuler评分：
  7.8
 Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
 受影响版本排查(受影响/不受影响)：
  1.openEuler-20.03-LTS-SP4(4.19.90):受影响
2.master(6.6.0):不受影响
3.openEuler-22.03-LTS-SP3(5.10.0):不受影响
4.openEuler-22.03-LTS-SP4(5.10.0):不受影响
5.openEuler-24.03-LTS(6.6.0):不受影响
6.openEuler-24.03-LTS-Next(6.6.0):不受影响
7.openEuler-24.03-LTS-SP1(6.6.0):不受影响
8.openEuler-24.03-LTS-SP2(6.6.0):不受影响

修复是否涉及abi变化(是/否)：
  1.master(6.6.0):否
2.openEuler-20.03-LTS-SP4(4.19.90):否
3.openEuler-22.03-LTS-SP3(5.10.0):否
4.openEuler-22.03-LTS-SP4(5.10.0):否
5.openEuler-24.03-LTS(6.6.0):否
6.openEuler-24.03-LTS-Next(6.6.0):否
7.openEuler-24.03-LTS-SP1(6.6.0):否
8.openEuler-24.03-LTS-SP2(6.6.0):否

原因说明：
  1.openEuler-20.03-LTS-SP4(4.19.90):正常修复
2.master(6.6.0):不受影响-漏洞代码不能被攻击者触发
3.openEuler-22.03-LTS-SP3(5.10.0):不受影响-漏洞代码不能被攻击者触发
4.openEuler-22.03-LTS-SP4(5.10.0):不受影响-漏洞代码不能被攻击者触发
5.openEuler-24.03-LTS(6.6.0):不受影响-漏洞代码不能被攻击者触发
6.openEuler-24.03-LTS-Next(6.6.0):不受影响-漏洞代码不能被攻击者触发
7.openEuler-24.03-LTS-SP1(6.6.0):不受影响-漏洞代码不能被攻击者触发
8.openEuler-24.03-LTS-SP2(6.6.0):不受影响-漏洞代码不能被攻击者触发

三、漏洞修复
安全公告链接：https://www.openeuler.org/zh/security/safety-bulletin/detail/?id=openEuler-SA-2025-1541

src-openEuler/kernel

内容风险标识

评论 (6)

src-openEuler/kernel .gitee-modal { width: 500px !important; }

内容风险标识

CVE-2022-49846

评论 (6)

搜索帮助

src-openEuler/kernel