Integer Overflow Vulnerability in uaccess
Summary
GSD-2022-1001940: uaccess: fix integer overflow on access_ok(). Affects Kernel versions >= da551281947cb2c0ab6e0045529a706af5d79584, < e65d28d4e9bf90a35ba79c06661a572a38391dec. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux Kernel is a widely used open-source operating system that serves as the foundation for various Linux distributions. It provides essential functionality for managing hardware resources, process scheduling, and device drivers. The uaccess subsystem is responsible for validating user-space memory access requests and ensuring they are within the bounds of the process's address space.
Vulnerability Detail
The uaccess subsystem in the Linux Kernel is susceptible to an integer overflow vulnerability. This vulnerability arises from an incorrect calculation in the access_ok() function, which is used to determine if a user-space memory access request is valid. An attacker could exploit this vulnerability by crafting a malicious request that triggers the integer overflow, leading to unexpected memory access permissions. The impact of this vulnerability could range from information disclosure to privilege escalation, depending on how it is leveraged.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can apply the patch provided in the commit e65d28d4e9bf90a35ba79c06661a572a38391dec manually. Here is an example of how the patch can be applied:
--- a/arch/x86/mm/uaccess.c
+++ b/arch/x86/mm/uaccess.c
@@ -123,7 +123,7 @@ int access_ok(const void __user *addr, unsigned long size)
unsigned long max_addr;
max_addr = current_thread_info()->addr_limit.seg;
- if (unlikely((unsigned long)addr >= max_addr))
+ if (unlikely((unsigned long)addr >= max_addr || (unsigned long)addr + size > max_addr))
return 0;
return 1;
Conclusion
The integer overflow vulnerability in the uaccess subsystem of the Linux Kernel poses a potential security risk, allowing attackers to manipulate memory access permissions. It is crucial to update the kernel to the latest version to mitigate this vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The Linux Kernel is an open-source operating system kernel that serves as the core component of various Linux distributions. It provides essential functionality for managing hardware resources, process scheduling, and device drivers.
The uaccess subsystem in the Linux Kernel is responsible for validating user-space memory access requests and ensuring they are within the bounds of the process's address space.
An integer overflow vulnerability occurs when an arithmetic operation results in a value that exceeds the maximum representable value for the data type used to store the result. In the case of this vulnerability, an incorrect calculation in the access_ok() function leads to an integer overflow, potentially allowing an attacker to manipulate memory access permissions.
The impact of this vulnerability could range from information disclosure to privilege escalation. An attacker could leverage the integer overflow to gain unauthorized access to sensitive information or execute arbitrary code with elevated privileges.
To fix this vulnerability, it is recommended to update the Linux Kernel to version v5.15.32 or later. Users can obtain the updated kernel from the official Linux Kernel repository.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
