PT-2023-9438 · Linux+1 · Linux Kernel+1

Denys Vlasenko · Published 2023-01-05 · Updated 2024-09-24 · CVE-2022-48897

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.1.0-rc3+

Description The issue is related to the arm64/mm component of the Linux kernel, where incorrect handling of memory allocation errors can lead to a denial of service. On arm64, the pmd leaf() function will return true even if the pmd is invalid due to the pmd present invalid() check. This can cause the file map count to decrease and then increase again, triggering a BUG ON() unexpectedly. The problem can be fixed by adding a !pmd present invalid() check in the pmd user accessible page() function.

Recommendations To resolve the issue, update the Linux kernel to a version that includes the fix for the arm64/mm component, specifically the patch that adds the !pmd present invalid() check in the pmd user accessible page() function. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-388

Related Identifiers

BDU:2024-07589

CVE-2022-48897

Affected Products

Linux Kernel

Red Os

References · 18

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/48xxx/CVE-2022-48897.json · Exploit
• https://security-tracker.debian.org/tracker/CVE-2022-48897 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-07589 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-48897 · Vendor Advisory
• https://git.kernel.org/stable/c/74c2f81054510d45b813548cb0a1c4ebf87cdd5f · Patch
• https://osv.dev/vulnerability/CVE-2022-48897 · Vendor Advisory
• https://git.kernel.org/stable/c/21e5eca0ac9046da9918a919bc92b7b5a78d27e7 · Patch
• https://cve.org/CVERecord?id=CVE-2022-48897 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-48897 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-48897 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-48897 · Vendor Advisory
• https://lore.kernel.org/linux-cve-announce/2024082110-CVE-2022-48897-5547@gregkh · Note
• https://redos.red-soft.ru/support/secure · Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-kernel-lt-24-09-24-1 · Note
• https://kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.7 · Note