193 lines
9.4 KiB
JSON
193 lines
9.4 KiB
JSON
{
|
||
"dataType": "CVE_RECORD",
|
||
"dataVersion": "5.2",
|
||
"cveMetadata": {
|
||
"cveId": "CVE-2022-49178",
|
||
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||
"state": "PUBLISHED",
|
||
"assignerShortName": "Linux",
|
||
"dateReserved": "2025-02-26T01:49:39.281Z",
|
||
"datePublished": "2025-02-26T01:55:31.574Z",
|
||
"dateUpdated": "2026-10-15T21:21:07.471Z"
|
||
},
|
||
"containers": {
|
||
"cna": {
|
||
"providerMetadata": {
|
||
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||
"shortName": "Linux",
|
||
"dateUpdated": "2026-08-05T08:54:17.694Z"
|
||
},
|
||
"descriptions": [
|
||
{
|
||
"lang": "en",
|
||
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmemstick/mspro_block: fix handling of read-only devices\n\nUse set_disk_ro to propagate the read-only state to the block layer\ninstead of checking for it in ->open and leaking a reference in case\nof a read-only device."
|
||
}
|
||
],
|
||
"metrics": [
|
||
{
|
||
"cvssV3_1": {
|
||
"version": "3.1",
|
||
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
||
"baseScore": 7.8,
|
||
"baseSeverity": "HIGH"
|
||
},
|
||
"scenarios": [
|
||
{
|
||
"lang": "en",
|
||
"value": "AV:L - The bug is reached via open() on the local block device (/dev/mspblk*), not via network packets or by crafting USB/MemoryStick hardware descriptors as the attack itself.\nAC:L - Each write-open of a present read-only mspro_block device reliably leaks a usage_count reference with no race or nondeterministic condition; overflowing the counter and triggering the subsequent UAF is fully under attacker control via a tight open loop.\nPR:L - Exploitation needs only the ability to open the mspblk block device (typical disk-group or equivalent local access), not real root/CAP_SYS_ADMIN in the init namespace.\nUI:N - The attacker triggers the flaw themselves by opening the device for write; no separate victim action is required once a write-protected MemoryStick Pro volume is present.\nS:U - Impact stays within the kernel’s own authority (local memory corruption / DoS); there is no VM, IOMMU, or other security-boundary escape.\nC:H - After usage_count wraps, open/close frees mspro_block_data while memstick drvdata and the live gendisk still reference it, yielding a heap UAF that can be turned into an arbitrary read primitive.\nI:H - The same UAF enables heap spraying and control of the freed object, providing an arbitrary write / control-flow hijack path in the kernel.\nA:H - The UAF and related use of freed msb state can oops/panic the kernel; even without overflow, leaked references prevent cleanup on card removal and enable resource-exhaustion DoS."
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"affected": [
|
||
{
|
||
"product": "Linux",
|
||
"vendor": "Linux",
|
||
"defaultStatus": "unaffected",
|
||
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
||
"programFiles": [
|
||
"drivers/memstick/core/mspro_block.c"
|
||
],
|
||
"versions": [
|
||
{
|
||
"version": "baf8532a147d5b76681ce040e2c8f25a3f0e718d",
|
||
"lessThan": "057b53c4f87690d626203acef8b63d52a9bf2f43",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "baf8532a147d5b76681ce040e2c8f25a3f0e718d",
|
||
"lessThan": "6a0725b9d78ff6efdc95a37e4f05072e79c63918",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "baf8532a147d5b76681ce040e2c8f25a3f0e718d",
|
||
"lessThan": "6dab421bfe06a59bf8f212a72e34673e8acf2018",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"product": "Linux",
|
||
"vendor": "Linux",
|
||
"defaultStatus": "affected",
|
||
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
||
"programFiles": [
|
||
"drivers/memstick/core/mspro_block.c"
|
||
],
|
||
"versions": [
|
||
{
|
||
"version": "2.6.25",
|
||
"status": "affected"
|
||
},
|
||
{
|
||
"version": "0",
|
||
"lessThan": "2.6.25",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "5.16.19",
|
||
"lessThanOrEqual": "5.16.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "5.17.2",
|
||
"lessThanOrEqual": "5.17.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "5.18",
|
||
"lessThanOrEqual": "*",
|
||
"status": "unaffected",
|
||
"versionType": "original_commit_for_fix"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"cpeApplicability": [
|
||
{
|
||
"nodes": [
|
||
{
|
||
"operator": "OR",
|
||
"negate": false,
|
||
"cpeMatch": [
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "2.6.25",
|
||
"versionEndExcluding": "5.16.19"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "2.6.25",
|
||
"versionEndExcluding": "5.17.2"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "2.6.25",
|
||
"versionEndExcluding": "5.18"
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"references": [
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/057b53c4f87690d626203acef8b63d52a9bf2f43"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/6a0725b9d78ff6efdc95a37e4f05072e79c63918"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/6dab421bfe06a59bf8f212a72e34673e8acf2018"
|
||
}
|
||
],
|
||
"title": "memstick/mspro_block: fix handling of read-only devices",
|
||
"x_generator": {
|
||
"engine": "bippy-1.2.0"
|
||
}
|
||
},
|
||
"adp": [
|
||
{
|
||
"metrics": [
|
||
{
|
||
"other": {
|
||
"type": "ssvc",
|
||
"content": {
|
||
"id": "CVE-2022-49178",
|
||
"role": "CISA Coordinator",
|
||
"options": [
|
||
{
|
||
"Exploitation": "none"
|
||
},
|
||
{
|
||
"Automatable": "no"
|
||
},
|
||
{
|
||
"Technical Impact": "total"
|
||
}
|
||
],
|
||
"version": "2.0.3",
|
||
"timestamp": "2026-10-15T21:17:57.075062Z"
|
||
}
|
||
}
|
||
}
|
||
],
|
||
"title": "CISA ADP Vulnrichment",
|
||
"providerMetadata": {
|
||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||
"shortName": "CISA-ADP",
|
||
"dateUpdated": "2026-10-15T21:21:07.471Z"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
} |