Bug 2347643 (CVE-2022-49710) - CVE-2022-49710 kernel: dm mirror log: round up region bitmap size to BITS_PER_LONG
Summary: CVE-2022-49710 kernel: dm mirror log: round up region bitmap size to BITS_PER...
Keywords:
Status: NEW
Alias: CVE-2022-49710
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2025-02-26 03:01 UTC by OSIDB Bzimport
Modified: 2025-05-05 14:35 UTC (History)
4 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2025-02-26 03:01:30 UTC 
In the Linux kernel, the following vulnerability has been resolved:

dm mirror log: round up region bitmap size to BITS_PER_LONG

The code in dm-log rounds up bitset_size to 32 bits. It then uses
find_next_zero_bit_le on the allocated region. find_next_zero_bit_le
accesses the bitmap using unsigned long pointers. So, on 64-bit
architectures, it may access 4 bytes beyond the allocated size.

Fix this bug by rounding up bitset_size to BITS_PER_LONG.

This bug was found by running the lvm2 testsuite with kasan.
Comment 1 Mauro Matteo Cascella 2025-02-26 14:54:22 UTC 
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2025022630-CVE-2022-49710-0591@gregkh/T
Note You need to log in before you can comment on or make changes to this bug.