CVE-2022-49771
dm ioctl: fix misbehavior if list_versions races with module loading
- Published
- Updated
- Reserved
- Assigned by
- Linux
Description
In the Linux kernel, the following vulnerability has been resolved: dm ioctl: fix misbehavior if list_versions races with module loading __list_versions will first estimate the required space using the "dm_target_iterate(list_version_get_needed, &needed)" call and then will fill the space using the "dm_target_iterate(list_version_get_info, &iter_info)" call. Each of these calls locks the targets using the "down_read(&_lock)" and "up_read(&_lock)" calls, however between the first and second "dm_target_iterate" there is no lock held and the target modules can be loaded at this point, so the second "dm_target_iterate" call may need more space than what was the first "dm_target_iterate" returned. The code tries to handle this overflow (see the beginning of list_version_get_info), however this handling is incorrect. The code sets "param->data_size = param->data_start + needed" and "iter_info.end = (char *)vers+len" - "needed" is the size returned by the first dm_target_iterate call; "len" is the size of the buffer allocated by userspace. "len" may be greater than "needed"; in this case, the code will write up to "len" bytes into the buffer, however param->data_size is set to "needed", so it may write data past the param->data_size value. The ioctl interface copies only up to param->data_size into userspace, thus part of the result will be truncated. Fix this bug by setting "iter_info.end = (char *)vers + needed;" - this guarantees that the second "dm_target_iterate" call will write only up to the "needed" buffer and it will exit with "DM_BUFFER_FULL_FLAG" if it overflows the "needed" space - in this case, userspace will allocate a larger buffer and retry. Note that there is also a bug in list_version_get_needed - we need to add "strlen(tt->name) + 1" to the needed size, not "strlen(tt->name)".
Timeline
ID reserved
By Linux
- 15 days later
· 15 days later
Published
- 18 months later
· 18 months later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NVDNVD · Analyzed | 3.1 | Medium4.7 | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H |
- EPSS (exploitation in 30 days)
- 0.16% · top 95% of all CVEs (7 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 4.7.
Weakness
Affected products
- affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 – < 0c8d4112df329bf3dfbf27693f918c3b08676538
- affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 – < 6a818db0d5aecf80d4ba9e10ac153f60adc629ca
- affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 – < 3a1c35d72dc0b34d1e746ed705790c0f630aa427
- affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 – < b545c0e1e4094d4de2bdfe9a3823f9154b0c0005
- affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 – < f59f5a269ca5e43c567aca7f1f52500a0186e9b7
- affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 – < 6ffce7a92ef5c68f7e5d6f4d722c2f96280c064b
- affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 – < 5398b8e275bf81a2517b327d216c0f37ac9ac5ae
- affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 – < 4fe1ec995483737f3d2a14c3fe1d8fe634972979
- affected 2.6.12
- unaffected < 2.6.12
- unaffected 4.9.334 – ≤ 4.9.*
- unaffected 4.14.300 – ≤ 4.14.*
- unaffected 4.19.267 – ≤ 4.19.*
- unaffected 5.4.225 – ≤ 5.4.*
- unaffected 5.10.156 – ≤ 5.10.*
- unaffected 5.15.80 – ≤ 5.15.*
- unaffected 6.0.10 – ≤ 6.0.*
- unaffected 6.1 – ≤ *
References (8)
- https://git.kernel.org/stable/c/0c8d4112df329bf3dfbf27693f918c3b08676538 (opens in a new tab)
- https://git.kernel.org/stable/c/6a818db0d5aecf80d4ba9e10ac153f60adc629ca (opens in a new tab)
- https://git.kernel.org/stable/c/3a1c35d72dc0b34d1e746ed705790c0f630aa427 (opens in a new tab)
- https://git.kernel.org/stable/c/b545c0e1e4094d4de2bdfe9a3823f9154b0c0005 (opens in a new tab)
- https://git.kernel.org/stable/c/f59f5a269ca5e43c567aca7f1f52500a0186e9b7 (opens in a new tab)
- https://git.kernel.org/stable/c/6ffce7a92ef5c68f7e5d6f4d722c2f96280c064b (opens in a new tab)
- https://git.kernel.org/stable/c/5398b8e275bf81a2517b327d216c0f37ac9ac5ae (opens in a new tab)
- https://git.kernel.org/stable/c/4fe1ec995483737f3d2a14c3fe1d8fe634972979 (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2022-49771)Record last updated .