CVE-2022-49395

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> um: Fix out-of-bounds read in LDT setup<br /> <br /> syscall_stub_data() expects the data_count parameter to be the number of<br /> longs, not bytes.<br /> <br /> ==================================================================<br /> BUG: KASAN: stack-out-of-bounds in syscall_stub_data+0x70/0xe0<br /> Read of size 128 at addr 000000006411f6f0 by task swapper/1<br /> <br /> CPU: 0 PID: 1 Comm: swapper Not tainted 5.18.0+ #18<br /> Call Trace:<br /> show_stack.cold+0x166/0x2a7<br /> __dump_stack+0x3a/0x43<br /> dump_stack_lvl+0x1f/0x27<br /> print_report.cold+0xdb/0xf81<br /> kasan_report+0x119/0x1f0<br /> kasan_check_range+0x3a3/0x440<br /> memcpy+0x52/0x140<br /> syscall_stub_data+0x70/0xe0<br /> write_ldt_entry+0xac/0x190<br /> init_new_ldt+0x515/0x960<br /> init_new_context+0x2c4/0x4d0<br /> mm_init.constprop.0+0x5ed/0x760<br /> mm_alloc+0x118/0x170<br /> 0x60033f48<br /> do_one_initcall+0x1d7/0x860<br /> 0x60003e7b<br /> kernel_init+0x6e/0x3d4<br /> new_thread_handler+0x1e7/0x2c0<br /> <br /> The buggy address belongs to stack of task swapper/1<br /> and is located at offset 64 in frame:<br /> init_new_ldt+0x0/0x960<br /> <br /> This frame has 2 objects:<br /> [32, 40) &amp;#39;addr&amp;#39;<br /> [64, 80) &amp;#39;desc&amp;#39;<br /> ==================================================================