CVE-2022-49526

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

md/bitmap: don't set sb values if can't pass sanity check

If bitmap area contains invalid data, kernel will crash then mdadm

triggers "Segmentation fault".

This is cluster-md speical bug. In non-clustered env, mdadm will

handle broken metadata case. In clustered array, only kernel space

handles bitmap slot info. But even this bug only happened in clustered

env, current sanity check is wrong, the code should be changed.

How to trigger: (faulty injection)

dd if=/dev/zero bs=1M count=1 oflag=direct of=/dev/sda

dd if=/dev/zero bs=1M count=1 oflag=direct of=/dev/sdb

mdadm -C /dev/md0 -b clustered -e 1.2 -n 2 -l mirror /dev/sda /dev/sdb

mdadm -Ss

echo aaa > magic.txt

== below modifying slot 2 bitmap data ==

dd if=magic.txt of=/dev/sda seek=16384 bs=1 count=3 <== destroy magic

dd if=/dev/zero of=/dev/sda seek=16436 bs=1 count=4 <== ZERO chunksize

mdadm -A /dev/md0 /dev/sda /dev/sdb

== kernel crashes. mdadm outputs "Segm

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References