CVE-2022-49073

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: ata: sata_dwc_460ex: Fix crash due to OOB write the driver uses libata's "tag" values from in various arrays. Since the mentioned patch bumped the ATA_TAG_INTERNAL to 32, the value of the SATA_DWC_QCMD_MAX needs to account for that. Otherwise ATA_TAG_INTERNAL usage cause similar crashes like this as reported by Tice Rex on the OpenWrt Forum and reproduced (with symbols) here: | BUG: Kernel NULL pointer dereference at 0x00000000 | Faulting instruction address: 0xc03ed4b8 | Oops: Kernel access of bad area, sig: 11 [#1] | BE P...

Affected product and versions

Product

Linux Linux, linux kernel

Affected versions

>= 28361c403683c2b00d4f5e76045f3ccd299bf99d < 596c7efd69aae94f4b0e91172b075eb197958b99, >= 28361c403683c2b00d4f5e76045f3ccd299bf99d < 55e1465ba79562a191708a40eeae3f8082a209e3, >= 28361c403683c2b00d4f5e76045f3ccd299bf99d < fc629224aa62f23849cae83717932985ac51232d, >= 28361c403683c2b00d4f5e76045f3ccd299bf99d < 8a05a6952ecd59aaa62cbdcdaf523ae2c8f436e8, >= 28361c403683c2b00d4f5e76045f3ccd299bf99d < 234c0132f76f0676d175757f61b0025191a3d935, >= 28361c403683c2b00d4f5e76045f3ccd299bf99d < 3a8751c0d4e24129e72dcec0139e99833b13904a, >= 28361c403683c2b00d4f5e76045f3ccd299bf99d < 7aa8104a554713b685db729e66511b93d989dd6a, >= 4.18, >= 4.18 < 4.19.238, >= 4.20 < 5.4.189, >= 5.5 < 5.10.111, >= 5.11 < 5.15.34, >= 5.16 < 5.16.20, >= 5.17 < 5.17.3, 5.18

Fixed versions

4.19.238, 5.4.189, 5.10.111, 5.15.34, 5.16.20, 5.17.3

Technical data

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-787