CVE-2022-48847

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> watch_queue: Fix filter limit check<br /> <br /> In watch_queue_set_filter(), there are a couple of places where we check<br /> that the filter type value does not exceed what the type_filter bitmap<br /> can hold. One place calculates the number of bits by:<br /> <br /> if (tf[i].type &gt;= sizeof(wfilter-&gt;type_filter) * 8)<br /> <br /> which is fine, but the second does:<br /> <br /> if (tf[i].type &gt;= sizeof(wfilter-&gt;type_filter) * BITS_PER_LONG)<br /> <br /> which is not. This can lead to a couple of out-of-bounds writes due to<br /> a too-large type:<br /> <br /> (1) __set_bit() on wfilter-&gt;type_filter<br /> (2) Writing more elements in wfilter-&gt;filters[] than we allocated.<br /> <br /> Fix this by just using the proper WATCH_TYPE__NR instead, which is the<br /> number of types we actually know about.<br /> <br /> The bug may cause an oops looking something like:<br /> <br /> BUG: KASAN: slab-out-of-bounds in watch_queue_set_filter+0x659/0x740<br /> Write of size 4 at addr ffff88800d2c66bc by task watch_queue_oob/611<br /> ...<br /> Call Trace:<br /> <br /> dump_stack_lvl+0x45/0x59<br /> print_address_description.constprop.0+0x1f/0x150<br /> ...<br /> kasan_report.cold+0x7f/0x11b<br /> ...<br /> watch_queue_set_filter+0x659/0x740<br /> ...<br /> __x64_sys_ioctl+0x127/0x190<br /> do_syscall_64+0x43/0x90<br /> entry_SYSCALL_64_after_hwframe+0x44/0xae<br /> <br /> Allocated by task 611:<br /> kasan_save_stack+0x1e/0x40<br /> __kasan_kmalloc+0x81/0xa0<br /> watch_queue_set_filter+0x23a/0x740<br /> __x64_sys_ioctl+0x127/0x190<br /> do_syscall_64+0x43/0x90<br /> entry_SYSCALL_64_after_hwframe+0x44/0xae<br /> <br /> The buggy address belongs to the object at ffff88800d2c66a0<br /> which belongs to the cache kmalloc-32 of size 32<br /> The buggy address is located 28 bytes inside of<br /> 32-byte region [ffff88800d2c66a0, ffff88800d2c66c0)