CVE-2022-49744 (GCVE-0-2022-49744)
Vulnerability from cvelistv5
Published
2025-03-27 16:42
Modified
2025-05-04 08:44
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: mm/uffd: fix pte marker when fork() without fork event Patch series "mm: Fixes on pte markers". Patch 1 resolves the syzkiller report from Pengfei. Patch 2 further harden pte markers when used with the recent swapin error markers. The major case is we should persist a swapin error marker after fork(), so child shouldn't read a corrupted page. This patch (of 2): When fork(), dst_vma is not guaranteed to have VM_UFFD_WP even if src may have it and has pte marker installed. The warning is improper along with the comment. The right thing is to inherit the pte marker when needed, or keep the dst pte empty. A vague guess is this happened by an accident when there's the prior patch to introduce src/dst vma into this helper during the uffd-wp feature got developed and I probably messed up in the rebase, since if we replace dst_vma with src_vma the warning & comment it all makes sense too. Hugetlb did exactly the right here (copy_hugetlb_page_range()). Fix the general path. Reproducer: https://github.com/xupengfe/syzkaller_logs/blob/main/221208_115556_copy_page_range/repro.c Bugzilla report: https://bugzilla.kernel.org/show_bug.cgi?id=216808
References
Impacted products
Vendor Product Version
Linux Linux Version: c56d1b62cce83695823c13e52f73e92eb568c0c1
Version: c56d1b62cce83695823c13e52f73e92eb568c0c1
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "mm/memory.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2d11727655bf931776fb541f5862daf04bd5bf02",
              "status": "affected",
              "version": "c56d1b62cce83695823c13e52f73e92eb568c0c1",
              "versionType": "git"
            },
            {
              "lessThan": "49d6d7fb631345b0f2957a7c4be24ad63903150f",
              "status": "affected",
              "version": "c56d1b62cce83695823c13e52f73e92eb568c0c1",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "mm/memory.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.19"
            },
            {
              "lessThan": "5.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.11",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.2",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/uffd: fix pte marker when fork() without fork event\n\nPatch series \"mm: Fixes on pte markers\".\n\nPatch 1 resolves the syzkiller report from Pengfei.\n\nPatch 2 further harden pte markers when used with the recent swapin error\nmarkers.  The major case is we should persist a swapin error marker after\nfork(), so child shouldn\u0027t read a corrupted page.\n\n\nThis patch (of 2):\n\nWhen fork(), dst_vma is not guaranteed to have VM_UFFD_WP even if src may\nhave it and has pte marker installed.  The warning is improper along with\nthe comment.  The right thing is to inherit the pte marker when needed, or\nkeep the dst pte empty.\n\nA vague guess is this happened by an accident when there\u0027s the prior patch\nto introduce src/dst vma into this helper during the uffd-wp feature got\ndeveloped and I probably messed up in the rebase, since if we replace\ndst_vma with src_vma the warning \u0026 comment it all makes sense too.\n\nHugetlb did exactly the right here (copy_hugetlb_page_range()).  Fix the\ngeneral path.\n\nReproducer:\n\nhttps://github.com/xupengfe/syzkaller_logs/blob/main/221208_115556_copy_page_range/repro.c\n\nBugzilla report: https://bugzilla.kernel.org/show_bug.cgi?id=216808"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-04T08:44:27.429Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2d11727655bf931776fb541f5862daf04bd5bf02"
        },
        {
          "url": "https://git.kernel.org/stable/c/49d6d7fb631345b0f2957a7c4be24ad63903150f"
        }
      ],
      "title": "mm/uffd: fix pte marker when fork() without fork event",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-49744",
    "datePublished": "2025-03-27T16:42:54.897Z",
    "dateReserved": "2025-03-27T16:39:17.987Z",
    "dateUpdated": "2025-05-04T08:44:27.429Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-49744\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-03-27T17:15:39.093\",\"lastModified\":\"2025-03-28T18:11:49.747\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmm/uffd: fix pte marker when fork() without fork event\\n\\nPatch series \\\"mm: Fixes on pte markers\\\".\\n\\nPatch 1 resolves the syzkiller report from Pengfei.\\n\\nPatch 2 further harden pte markers when used with the recent swapin error\\nmarkers.  The major case is we should persist a swapin error marker after\\nfork(), so child shouldn\u0027t read a corrupted page.\\n\\n\\nThis patch (of 2):\\n\\nWhen fork(), dst_vma is not guaranteed to have VM_UFFD_WP even if src may\\nhave it and has pte marker installed.  The warning is improper along with\\nthe comment.  The right thing is to inherit the pte marker when needed, or\\nkeep the dst pte empty.\\n\\nA vague guess is this happened by an accident when there\u0027s the prior patch\\nto introduce src/dst vma into this helper during the uffd-wp feature got\\ndeveloped and I probably messed up in the rebase, since if we replace\\ndst_vma with src_vma the warning \u0026 comment it all makes sense too.\\n\\nHugetlb did exactly the right here (copy_hugetlb_page_range()).  Fix the\\ngeneral path.\\n\\nReproducer:\\n\\nhttps://github.com/xupengfe/syzkaller_logs/blob/main/221208_115556_copy_page_range/repro.c\\n\\nBugzilla report: https://bugzilla.kernel.org/show_bug.cgi?id=216808\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: mm/uffd: correcci\u00f3n del marcador pte cuando fork() no tiene evento fork. Serie de parches \\\"mm: Correcciones en marcadores pte\\\". El parche 1 resuelve el informe de syzkiller de Pengfei. El parche 2 refuerza a\u00fan m\u00e1s los marcadores pte cuando se usan con los recientes marcadores de error de intercambio. El caso principal es que debemos conservar un marcador de error de intercambio despu\u00e9s de fork(), para que el elemento secundario no lea una p\u00e1gina da\u00f1ada. Este parche (de 2): Al ejecutar fork(), no se garantiza que dst_vma tenga VM_UFFD_WP, incluso si src lo tiene y tiene instalado el marcador pte. La advertencia y el comentario son incorrectos. Lo correcto es heredar el marcador pte cuando sea necesario o dejar vac\u00edo el marcador pte de dst. Una vaga suposici\u00f3n es que esto ocurri\u00f3 accidentalmente durante el parche anterior para introducir src/dst vma en este ayudante durante el desarrollo de la funci\u00f3n uffd-wp, y probablemente comet\u00ed un error al rebasar, ya que si reemplazamos dst_vma con src_vma, la advertencia y el comentario tambi\u00e9n cobran sentido. Hugetlb hizo exactamente lo correcto aqu\u00ed (copy_hugetlb_page_range()). Corrija la ruta general. Reproductor: https://github.com/xupengfe/syzkaller_logs/blob/main/221208_115556_copy_page_range/repro.c. Informe de Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=216808\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/2d11727655bf931776fb541f5862daf04bd5bf02\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/49d6d7fb631345b0f2957a7c4be24ad63903150f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.