CVE-2022-49289: uaccess: fix integer overflow on access_ok()
In the Linux kernel, the following vulnerability has been resolved:
uaccess: fix integer overflow on accessok()
Three architectures check the end of a user access against the address limit without taking a possible overflow into account. Passing a negative length or another overflow in here returns success when it should not.
Use the most common correct implementation here, which optimizes for a constant 'size' argument, and turns the common case into a single comparison.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.16.18-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
ubuntu/linux-azure-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1008.9~20.04.1 - Upgrade
Upgrade
ubuntu/linux-hwe-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-41.44~20.04.1 - Upgrade
Upgrade
ubuntu/linux-intel-iotg-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1008.11~20.04.1 - Upgrade
Upgrade
ubuntu/linux-lowlatency-hwe-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-42.45~20.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 5.15.0-37.39 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 5.15.0-1011.14 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 5.15.0-1010.12 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 5.15.0-1008.12 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 5.15.0-1008.10 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 5.15.0-1007.8 - Upgrade
Upgrade
ubuntu/linux-intel-iotgto a version that resolves this vulnerability.Fixed in 5.15.0-1008.11 - Upgrade
Upgrade
ubuntu/linux-kvmto a version that resolves this vulnerability.Fixed in 5.15.0-1010.11 - Upgrade
Upgrade
ubuntu/linux-lowlatencyto a version that resolves this vulnerability.Fixed in 5.15.0-37.39 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 5.15.0-1009.12 - Upgrade
Upgrade
ubuntu/linux-raspito a version that resolves this vulnerability.Fixed in 5.15.0-1011.13 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 5.15.0-1014.14
Event History
Frequently Asked Questions
What is the severity of CVE-2022-49289?
CVE-2022-49289 is classified as a moderate severity vulnerability that could lead to an integer overflow in the Linux kernel.
How do I fix CVE-2022-49289?
To fix CVE-2022-49289, update your Linux kernel to a version that includes the patch for this vulnerability, specifically beyond version 5.15.32 and 5.16.18 or 5.17.
What are the potential impacts of CVE-2022-49289?
The CVE-2022-49289 vulnerability may allow unauthorized access or corruption of memory, potentially compromising system security.
Which versions of the Linux kernel are affected by CVE-2022-49289?
CVE-2022-49289 affects Linux kernel versions from 3.2 up to 5.15.32 and also includes versions from 5.16.0 to 5.16.18 and version 5.17.
Is CVE-2022-49289 being actively exploited?
As of the latest information, there is no evidence of active exploitation of CVE-2022-49289 in the wild, but users are advised to patch their systems.