Integer Overflow Vulnerability in uaccess
Summary
GSD-2022-1001636: uaccess: fix integer overflow on access_ok(). Affects Kernel versions >= da551281947cb2c0ab6e0045529a706af5d79584, < 99801e2f457824955da4aadaa035913a6dede03a. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux Kernel is a widely used open-source operating system that serves as the foundation for various Linux distributions. It provides essential functionality for managing hardware resources, process scheduling, and device drivers. The uaccess subsystem is responsible for validating user space memory access requests. It ensures that user processes can only access memory regions they are authorized to access. However, a vulnerability has been discovered in the uaccess subsystem that allows for an integer overflow, potentially leading to unauthorized memory access.
Vulnerability Detail
The vulnerability arises from an integer overflow in the access_ok() function within the uaccess subsystem. This function is used to check whether a user space memory access request is valid or not. By manipulating the input parameters, an attacker can trigger an integer overflow, causing the access_ok() function to incorrectly validate the memory access request. This could lead to unauthorized access to sensitive kernel memory, potentially resulting in privilege escalation or information disclosure. The vulnerability was introduced in Linux Kernel version 4.20 and has been fixed in version 5.16.18.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can apply a patch provided by the Linux Kernel community to mitigate the vulnerability. The patch modifies the access_ok() function to handle integer overflow correctly. Here is an example of the patch:
--- a/arch/x86/include/asm/uaccess.h
+++ b/arch/x86/include/asm/uaccess.h
@@ -125,7 +125,7 @@ static inline int access_ok(const void __user *addr, unsigned long size)
unsigned long max_addr = current_thread_info()->addr_limit.seg;
unsigned long start = (unsigned long)addr;
unsigned long end = start + size;
- if (end < start || end > max_addr)
+ if (end < start || end > max_addr || size > max_addr)
return 0;
return 1;
}
Users can apply this patch manually by modifying the affected file in the Linux Kernel source code and recompiling the kernel.
Conclusion
The integer overflow vulnerability in the uaccess subsystem of the Linux Kernel can potentially lead to unauthorized access to sensitive kernel memory. It is crucial to update the Linux Kernel to version 5.16.18 or later to mitigate this vulnerability. Users can also apply a provided patch as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability allows for unauthorized access to sensitive kernel memory. This could potentially lead to privilege escalation or information disclosure, enabling attackers to gain elevated privileges or obtain sensitive information.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Vulert analyzes your package-lock.json file and provides real-time alerts for open-source vulnerabilities, including this one.
There is no evidence of this vulnerability being exploited in the wild at the time of discovery. However, it is crucial to apply the necessary updates or patches to mitigate the risk.
No, only Linux Kernel versions from 4.20 to 5.16.17 are affected by this vulnerability. The issue has been fixed in version 5.16.18 and later.
Yes, a temporary workaround is to apply a patch provided by the Linux Kernel community. The patch modifies the affected function to handle the integer overflow correctly. Instructions for applying the patch can be found in the Linux Kernel documentation.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
