Out of Bounds Access in Linux Kernel - CVE-2022-50147
Summary
CVE-2022-50147: In the Linux kernel, the following vulnerability has been resolved: mm/mempolicy: fix get_nodes out of bound access When user specified more nodes than supported, get_nodes will access nmask array out of bounds. Affects linux versions < 6.0.2-1. Fixed in 6.0.2-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing the essential interface between hardware and software. It manages system resources, hardware communication, and process management. This vulnerability affects the memory policy management in the kernel, specifically in the handling of node specifications, which can lead to security risks if exploited.
Vulnerability Detail
CVE-2022-50147 is a vulnerability in the Linux kernel that arises from improper handling of user-specified node counts in memory policy management. When a user specifies more nodes than the system supports, the function get_nodes accesses the nmask array out of bounds. This can lead to potential memory corruption, crashes, or unauthorized access to sensitive data, posing a significant risk to system integrity and security.
How To Fix
Minimum fixed version
6.0.2-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. It is recommended to apply the patch as soon as it is available.
Conclusion
CVE-2022-50147 is a critical vulnerability in the Linux kernel that can lead to serious security issues if not addressed. Users are advised to update their systems to the latest patched version to ensure protection against potential exploits.
See every vulnerability recorded for linux →
FAQ
CVE-2022-50147 is a vulnerability in the Linux kernel that allows out of bounds access due to improper handling of node specifications in memory policy management.
This vulnerability can lead to memory corruption, crashes, or unauthorized access to sensitive data, potentially compromising system security.
You should update your Linux package to version 6.0.2-1 or later to mitigate the risk associated with this vulnerability.
Currently, there are no specific workarounds available. The best course of action is to apply the patch as soon as it is released.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time using just a manifest file like package-lock.json. You can also check your application for this vulnerability using the Vulert playground without any signup.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
