CVE-2022-49771

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

dm ioctl: fix misbehavior if list_versions races with module loading

__list_versions will first estimate the required space using the

"dm_target_iterate(list_version_get_needed, &needed)" call and then will

fill the space using the "dm_target_iterate(list_version_get_info,

&iter_info)" call. Each of these calls locks the targets using the

"down_read(&_lock)" and "up_read(&_lock)" calls, however between the first

and second "dm_target_iterate" there is no lock held and the target

modules can be loaded at this point, so the second "dm_target_iterate"

call may need more space than what was the first "dm_target_iterate"

returned.

The code tries to handle this overflow (see the beginning of

list_version_get_info), however this handling is incorrect.

The code sets "param->data_size = param->data_start + needed" and

"iter_info.end = (char *)vers+len" - "needed" is the size returned by the

first dm_target_iterate call; "le

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References