Kernel Overflow Vulnerability in Linux Package - CVE-2022-49147
Summary
CVE-2022-49147: In the Linux kernel, the following vulnerability has been resolved: block: Fix the maximum minor value is blk_alloc_ext_minor() ida_alloc_range(..., min, max, ...) returns values from min to max, inclusive. Affects linux versions < 5.17.3-1. Fixed in 5.17.3-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Linux kernel is the core component of Linux operating systems, responsible for managing hardware resources and providing essential services for software applications. It is widely used across various platforms, including servers, desktops, and embedded systems. This vulnerability affects the Linux kernel versions prior to 5.17.3-1, where an overflow issue can occur due to improper handling of minor device numbers in the block device layer.
Vulnerability Detail
In the Linux kernel, a vulnerability identified as CVE-2022-49147 arises from the function blk_alloc_ext_minor(), which allocates minor device numbers. The function ida_alloc_range(..., min, max, ...) returns values from min to max, inclusive. The issue occurs when NR_EXT_DEVT, which is defined as '(1 << MINORBITS)', is used as the first minor number in device_add_disk(). If disk->first_minor is set to NR_EXT_DEVT, it leads to an overflow in the device number assignment, potentially causing system instability or crashes.
How To Fix
Minimum fixed version
5.17.3-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch as soon as it is available.
Conclusion
CVE-2022-49147 is a critical vulnerability in the Linux kernel that can lead to device number overflow, causing potential system crashes. It is essential to update to the patched version 5.17.3-1 to ensure system stability and security. Regular monitoring using tools like Vulert can help in identifying such vulnerabilities in real-time.
See every vulnerability recorded for linux →
FAQ
CVE-2022-49147 is a vulnerability in the Linux kernel that can lead to an overflow issue when handling minor device numbers.
If exploited, this vulnerability can cause system instability or crashes, particularly in systems that rely on block devices.
The vulnerability affects Linux kernel versions prior to 5.17.3-1.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring access to the code.
Currently, there are no specific workarounds available. The recommended action is to update to the patched version.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
