Bug 2348257 (CVE-2022-49444) - CVE-2022-49444 kernel: module: fix [e_shstrndx].sh_size=0 OOB access
Summary: CVE-2022-49444 kernel: module: fix [e_shstrndx].sh_size=0 OOB access
Keywords:
Status: NEW
Alias: CVE-2022-49444
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2025-02-26 03:23 UTC by OSIDB Bzimport
Modified: 2025-02-28 04:37 UTC (History)
4 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2025-02-26 03:23:08 UTC 
In the Linux kernel, the following vulnerability has been resolved:

module: fix [e_shstrndx].sh_size=0 OOB access

It is trivial to craft a module to trigger OOB access in this line:

	if (info->secstrings[strhdr->sh_size - 1] != '\0') {

BUG: unable to handle page fault for address: ffffc90000aa0fff
PGD 100000067 P4D 100000067 PUD 100066067 PMD 10436f067 PTE 0
Oops: 0000 [#1] PREEMPT SMP PTI
CPU: 7 PID: 1215 Comm: insmod Not tainted 5.18.0-rc5-00007-g9bf578647087-dirty #10
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-4.fc34 04/01/2014
RIP: 0010:load_module+0x19b/0x2391

[rebased patch onto modules-next]
Comment 1 Avinash Hanwate 2025-02-26 13:38:36 UTC 
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2025022658-CVE-2022-49444-ff21@gregkh/T
Comment 3 Avinash Hanwate 2025-02-27 14:51:46 UTC 
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2025022658-CVE-2022-49444-ff21@gregkh/T
Note You need to log in before you can comment on or make changes to this bug.