CVE-2022-49444
Published: 26 February 2025
Description
In the Linux kernel, the following vulnerability has been resolved: module: fix [e_shstrndx].sh_size=0 OOB access It is trivial to craft a module to trigger OOB access in this line: if (info->secstrings[strhdr->sh_size - 1] != '\0') { BUG: unable to handle page fault for address: ffffc90000aa0fff PGD 100000067 P4D 100000067 PUD 100066067 PMD 10436f067 PTE 0 Oops: 0000 [#1] PREEMPT SMP PTI CPU: 7 PID: 1215 Comm: insmod Not tainted 5.18.0-rc5-00007-g9bf578647087-dirty #10 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-4.fc34 04/01/2014 RIP: 0010:load_module+0x19b/0x2391 [rebased patch onto modules-next]
Security Summary
CVE-2022-49444 is an out-of-bounds read vulnerability in the Linux kernel's module loading subsystem. It occurs when processing ELF modules with a section header string table index (e_shstrndx) where sh_size is set to 0, leading to an invalid access in the check `if (info->secstrings[strhdr->sh_size - 1] != '\0')`. This can trigger a page fault and kernel oops during module loading, as demonstrated by a crafted module loaded via insmod. The issue affects the load_module function and has a CVSS v3.1 base score of 7.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H), mapped to CWE-125.
A local attacker with low privileges can exploit this vulnerability by crafting and loading a malicious kernel module. The low attack complexity and lack of user interaction requirement make it straightforward to trigger. Successful exploitation results in high-impact availability disruption through a kernel crash (denial of service via oops) and potential high confidentiality impact by exposing kernel memory contents during the fault.
Mitigation involves applying the upstream kernel patches referenced in the stable repository, such as commits 09cb6663618a74fe5572a4931ecbf098832e79ec, 391e982bfa632b8315235d8be9c0a81374c6a19c, 45a76414b6d8b8b39c23fea53b9d20e831ae72a0, and 921630e2e5124a04158129a8f22f4b425e61a858, which have been rebased onto the modules-next branch to fix the OOB access. Security practitioners should ensure systems run patched kernel versions to prevent module loading from untrusted sources.
Details
- CWE(s)