What is CVE-2022-48923?

CVE-2022-48923 is a Medium severity Linux kernel vulnerability with a CVSS score of 5.5 out of 10, classified as a Out-of-bounds Write flaw (CWE-787), affecting Linux kernel versions from 5.15 onward and patched in 5.15.26, 5.16.12 and 5.17. CVE-2022-48923 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

What is the CVSS score for CVE-2022-48923?

CVE-2022-48923 has a CVSS score of 5.5 out of 10, rated Medium severity. The vector string is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.

Is there a patch available for CVE-2022-48923?

Yes, CVE-2022-48923 has been patched. Fixed versions include 5.15.26, 5.16.12 and 5.17. If you are running Linux kernel 5.15 or later up to the fix versions, apply the relevant patch for your kernel branch.

Is CVE-2022-48923 actively exploited?

CVE-2022-48923 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

What is Out-of-bounds Write (CWE-787)?

The product writes data past the end or before the beginning of the intended buffer. See MITRE CWE for full details: https://cwe.mitre.org/data/definitions/787.html

CVE-2022-48923

Medium

In the Linux kernel, the following vulnerability has been resolved: btrfs: prevent copying too big compressed lzo segment Compressed length can be corrupted to be a lot larger than memory we have allocated for buffer. This will cause memcpy in copy_compressed_segment to write outside of allocated memory. This mostly results in stuck read syscall but sometimes when using btrfs send can get #GP kernel: general protection fault, probably for non-canonical address 0x841551d5c1000: 0000 [#1] PREEMPT SMP NOPTI kernel: CPU: 17 PID: 264 Comm: kworker/u256:7 Tainted: P OE 5.17.0-rc2-1 #12 kernel: Workqueue: btrfs-endio btrfs_work_helper [btrfs] kernel: RIP: 0010:lzo_decompress_bio (./include/linux/fortify-string.h:225 fs/btrfs/lzo.c:322 fs/btrfs/lzo.c:394) btrfs Code starting with the faulting instruction =========================================== 0:* 48 8b 06 mov (%rsi),%rax <-- trapping instruction 3: 48 8d 79 08 lea 0x8(%rcx),%rdi 7: 48 83 e7 f8 and $0xfffffffffffffff8,%rdi b: 48 89 01 mov %rax,(%rcx) e: 44 89 f0 mov %r14d,%eax 11: 48 8b 54 06 f8 mov -0x8(%rsi,%rax,1),%rdx kernel: RSP: 0018:ffffb110812efd50 EFLAGS: 00010212 kernel: RAX: 0000000000001000 RBX: 000000009ca264c8 RCX: ffff98996e6d8ff8 kernel: RDX: 0000000000000064 RSI: 000841551d5c1000 RDI: ffffffff9500435d kernel: RBP: ffff989a3be856c0 R08: 0000000000000000 R09: 0000000000000000 kernel: R10: 0000000000000000 R11: 0000000000001000 R12: ffff98996e6d8000 kernel: R13: 0000000000000008 R14: 0000000000001000 R15: 000841551d5c1000 kernel: FS: 0000000000000000(0000) GS:ffff98a09d640000(0000) knlGS:0000000000000000 kernel: CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 kernel: CR2: 00001e9f984d9ea8 CR3: 000000014971a000 CR4: 00000000003506e0 kernel: Call Trace: kernel: <TASK> kernel: end_compressed_bio_read (fs/btrfs/compression.c:104 fs/btrfs/compression.c:1363 fs/btrfs/compression.c:323) btrfs kernel: end_workqueue_fn (fs/btrfs/disk-io.c:1923) btrfs kernel: btrfs_work_helper (fs/btrfs/async-thread.c:326) btrfs kernel: process_one_work (./arch/x86/include/asm/jump_label.h:27 ./include/linux/jump_label.h:212 ./include/trace/events/workqueue.h:108 kernel/workqueue.c:2312) kernel: worker_thread (./include/linux/list.h:292 kernel/workqueue.c:2455) kernel: ? process_one_work (kernel/workqueue.c:2397) kernel: kthread (kernel/kthread.c:377) kernel: ? kthread_complete_and_exit (kernel/kthread.c:332) kernel: ret_from_fork (arch/x86/entry/entry_64.S:301) kernel: </TASK>

Package Linux Kernel

Published 2024-08-22

Last modified 2024-09-12

CVSS version 3.1

Patch available

Yes

CVSS 3.1 score

5.5

out of 10

Medium

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

High

Vector string

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness type

CWE-787

CVE-2022-48923 is a Out-of-bounds Write vulnerability

What is Out-of-bounds Write?

The product writes data past the end or before the beginning of the intended buffer. Learn more on MITRE CWE

Affected versions

Linux kernel versions 5.15 and later are affected. Fixed in 5.15.26, 5.16.12, 5.17 and their respective stable series.

Affected from

≥ 5.15

Fixed in

✓ 5.15.26 5.15.x ✓ 5.16.12 5.16.x ✓ 5.17

References

The following references provide additional information about CVE-2022-48923 including vendor advisories, patch commits, exploit details, and third-party analysis. Links are sourced from the NIST NVD database.

Kernel patch commit
https://git.kernel.org/stable/c/741b23a970a79d5d3a1db2d64fa2c7b375a4febb
Patch
Kernel patch commit
https://git.kernel.org/stable/c/8df508b7a44cd8110c726057cd28e8f8116885eb
Patch
Kernel patch commit
https://git.kernel.org/stable/c/e326bd06cdde46df952361456232022298281d16
Patch

Details

CVE ID CVE-2022-48923

Severity Medium

CVSS score 5.5 / 10

CVSS version 3.1

Published 2024-08-22

Modified 2024-09-12

KEV No

Patch

Yes

Package linux

Frequently asked questions

What is CVE-2022-48923?

CVE-2022-48923 is a Medium severity Linux kernel vulnerability with a CVSS score of 5.5 out of 10 , classified as an Out-of-bounds Write flaw (CWE-787) . It affects Linux kernel versions from 5.15 onward and has been patched in 5.15.26, 5.16.12 and 5.17. CVE-2022-48923 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
What is the CVSS score for CVE-2022-48923?

CVE-2022-48923 has a CVSS score of 5.5 out of 10, rated Medium severity (CVSS 3.1). The vector string is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.
Is there a patch available for CVE-2022-48923?

Yes — CVE-2022-48923 has been patched. Fixed versions include 5.15.26, 5.16.12 and 5.17. If you are running Linux kernel 5.15 or later up to the fix versions, apply the relevant patch for your kernel branch.
Is CVE-2022-48923 actively exploited?

No — CVE-2022-48923 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.
What is Out-of-bounds Write (CWE-787)?

The product writes data past the end or before the beginning of the intended buffer. View CWE-787 on MITRE CWE →