| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <2025050150-CVE-2022-49870-774b@gregkh> Date: Thu, 1 May 2025 16:11:00 +0200 From: Greg Kroah-Hartman <gregkh@...uxfoundation.org> To: linux-cve-announce@...r.kernel.org Cc: Greg Kroah-Hartman <gregkh@...nel.org> Subject: CVE-2022-49870: capabilities: fix undefined behavior in bit shift for CAP_TO_MASK From: Greg Kroah-Hartman <gregkh@...nel.org> Description =========== In the Linux kernel, the following vulnerability has been resolved: capabilities: fix undefined behavior in bit shift for CAP_TO_MASK Shifting signed 32-bit value by 31 bits is undefined, so changing significant bit to unsigned. The UBSAN warning calltrace like below: UBSAN: shift-out-of-bounds in security/commoncap.c:1252:2 left shift of 1 by 31 places cannot be represented in type 'int' Call Trace: <TASK> dump_stack_lvl+0x7d/0xa5 dump_stack+0x15/0x1b ubsan_epilogue+0xe/0x4e __ubsan_handle_shift_out_of_bounds+0x1e7/0x20c cap_task_prctl+0x561/0x6f0 security_task_prctl+0x5a/0xb0 __x64_sys_prctl+0x61/0x8f0 do_syscall_64+0x58/0x80 entry_SYSCALL_64_after_hwframe+0x63/0xcd </TASK> The Linux kernel CVE team has assigned CVE-2022-49870 to this issue. Affected and fixed versions =========================== Issue introduced in 2.6.25 with commit e338d263a76af78fe8f38a72131188b58fceb591 and fixed in 4.9.334 with commit 5b79fa628e2ab789e629a83cd211ef9b4c1a593e Issue introduced in 2.6.25 with commit e338d263a76af78fe8f38a72131188b58fceb591 and fixed in 4.14.300 with commit 65b0bc7a0690861812ade523d19f82688ab819dc Issue introduced in 2.6.25 with commit e338d263a76af78fe8f38a72131188b58fceb591 and fixed in 4.19.267 with commit dbaab08c8677d598244d21afb7818e44e1c5d826 Issue introduced in 2.6.25 with commit e338d263a76af78fe8f38a72131188b58fceb591 and fixed in 5.4.225 with commit 5661f111a1616ac105ec8cec81bff99b60f847ac Issue introduced in 2.6.25 with commit e338d263a76af78fe8f38a72131188b58fceb591 and fixed in 5.10.155 with commit fcbd2b336834bd24e1d9454ad5737856470c10d7 Issue introduced in 2.6.25 with commit e338d263a76af78fe8f38a72131188b58fceb591 and fixed in 5.15.79 with commit 151dc8087b5609e53b069c068e3f3ee100efa586 Issue introduced in 2.6.25 with commit e338d263a76af78fe8f38a72131188b58fceb591 and fixed in 6.0.9 with commit 27bdb134c043ff32c459d98f16550d0ffa0b3c34 Issue introduced in 2.6.25 with commit e338d263a76af78fe8f38a72131188b58fceb591 and fixed in 6.1 with commit 46653972e3ea64f79e7f8ae3aa41a4d3fdb70a13 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2022-49870 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: include/uapi/linux/capability.h Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/5b79fa628e2ab789e629a83cd211ef9b4c1a593e https://git.kernel.org/stable/c/65b0bc7a0690861812ade523d19f82688ab819dc https://git.kernel.org/stable/c/dbaab08c8677d598244d21afb7818e44e1c5d826 https://git.kernel.org/stable/c/5661f111a1616ac105ec8cec81bff99b60f847ac https://git.kernel.org/stable/c/fcbd2b336834bd24e1d9454ad5737856470c10d7 https://git.kernel.org/stable/c/151dc8087b5609e53b069c068e3f3ee100efa586 https://git.kernel.org/stable/c/27bdb134c043ff32c459d98f16550d0ffa0b3c34 https://git.kernel.org/stable/c/46653972e3ea64f79e7f8ae3aa41a4d3fdb70a13
Powered by blists - more mailing lists