PT-2024-10492 · Linux+2 · Linux Kernel+2

Rolf Eike Beer · Published 2022-01-28 · Updated 2025-01-17 · CVE-2022-48795

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 5.15.4-gentoo-parisc64 #4

Description The vulnerability is caused by overrunning the sglist and incorrectly testing sg dma len(sglist) before nents. Normally, this doesn't cause a crash, but in this case, sglist crossed a page boundary. The bug occurs in the following code: while (sg dma len(sglist) && nents--). The fix is simply to test nents first and move the decrement of nents into the loop.

Recommendations To resolve the issue, update the Linux kernel to a version that includes the fix for the parisc: Fix data TLB miss in sba unmap sg vulnerability. Specifically, update to a version later than 5.15.4-gentoo-parisc64 #4.

Note: The provided information does not specify the exact version that includes the fix, so it is recommended to update to the latest available version of the Linux kernel.

Exploit

Fix

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

BDU:2025-01043

CVE-2022-48795

OESA-2024-2079

Affected Products

Astra Linux

Linux Kernel

Red Os

References · 55

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/48xxx/CVE-2022-48795.json · Exploit
• https://osv.dev/vulnerability/CVE-2022-48795 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-43879 · Security Note
• https://git.kernel.org/stable/c/867e50231c7605547d9334904d70a181f39f2d9e · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-43861 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-48795 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-48795 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-42271 · Security Note
• https://git.kernel.org/stable/c/de75676ee99bf9f25b1124ff301b3f7b8ba597d4 · Patch
• https://git.kernel.org/stable/c/b7d6f44a0fa716a82969725516dc0b16bc7cd514 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-42284 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-42265 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-42285 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-41015 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-48928 · Security Note