CVE-2022-49078: lz4: fix LZ4_decompress_safe_partial read out of bound
First published: Wed Feb 26 2025(Updated: )
In the Linux kernel, the following vulnerability has been resolved: lz4: fix LZ4_decompress_safe_partial read out of bound When partialDecoding, it is EOF if we've either filled the output buffer or can't proceed with reading an offset for following match. In some extreme corner cases when compressed data is suitably corrupted, UAF will occur. As reported by KASAN [1], LZ4_decompress_safe_partial may lead to read out of bound problem during decoding. lz4 upstream has fixed it [2] and this issue has been disscussed here [3] before. current decompression routine was ported from lz4 v1.8.3, bumping lib/lz4 to v1.9.+ is certainly a huge work to be done later, so, we'd better fix it first. [1] https://lore.kernel.org/all/000000000000830d1205cf7f0477@google.com/ [2] https://github.com/lz4/lz4/commit/c5d6f8a8be3927c0bec91bcc58667a6cfad244ad# [3] https://lore.kernel.org/all/CC666AE8-4CA4-4951-B6FB-A2EFDE3AC03B@fb.com/
Credit: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
| Affected Software | Affected Version | How to fix |
|---|---|---|
| LZ4 | >=1.8.3 | |
| Linux Kernel | <5.4.189 | |
| Linux Kernel | >=5.5<5.10.111 | |
| Linux Kernel | >=5.11<5.15.34 | |
| Linux Kernel | >=5.16<5.16.20 | |
| Linux Kernel | >=5.17<5.17.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://git.kernel.org/stable/c/73953dfa9d50e5c9fe98ee13fd1d3427aa12a0a3
- https://git.kernel.org/stable/c/6adc01a7aa37445dafe8846faa0610a86029b253
- https://git.kernel.org/stable/c/9fb8bc6cfc58773ce95414e11c9ccc8fc6ac4927
- https://git.kernel.org/stable/c/e64dbe97c05c769525cbca099ddbd22485630235
- https://git.kernel.org/stable/c/467d5e200ab4486b744fe1776154a43d1aa22d4b
- https://git.kernel.org/stable/c/eafc0a02391b7b36617b36c97c4b5d6832cf5e24
Frequently Asked Questions
What is the severity of CVE-2022-49078?
CVE-2022-49078 has a medium severity level, considering the potential impact on system memory and data integrity.
How do I fix CVE-2022-49078?
To fix CVE-2022-49078, upgrade the lz4 package to at least version 1.8.3 or later.
What systems are affected by CVE-2022-49078?
CVE-2022-49078 affects all versions of lz4 prior to version 1.8.3.
What are the potential consequences of CVE-2022-49078?
The vulnerability could lead to a read out of bounds condition, which may compromise memory and expose sensitive data.
Is CVE-2022-49078 being actively exploited?
As of the latest updates, there is no indication that CVE-2022-49078 is being actively exploited in the wild.
- agent/first-publish-date
- agent/type
- agent/title
- agent/author
- agent/references
- agent/source
- agent/description
- agent/severity
- agent/weakness
- agent/guess-ai
- agent/software-canonical-lookup
- collector/mitre-cve
- source/MITRE
- agent/event
- agent/remedy
- agent/last-modified-date
- agent/softwarecombine
- agent/tags
- collector/nvd-api
- source/NVD
- vendor/lz4
- canonical/lz4
- vendor/linux
- canonical/linux kernel
- version/linux kernel/5.5
- version/linux kernel/5.11
- version/linux kernel/5.16
- version/linux kernel/5.17