{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2022-48762", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-06-20T11:09:39.060Z", "datePublished": "2024-06-20T11:13:39.855Z", "dateUpdated": "2026-08-05T08:52:11.000Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T08:52:11.000Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\narm64: extable: fix load_unaligned_zeropad() reg indices\n\nIn ex_handler_load_unaligned_zeropad() we erroneously extract the data and\naddr register indices from ex->type rather than ex->data. As ex->type will\ncontain EX_TYPE_LOAD_UNALIGNED_ZEROPAD (i.e. 4):\n * We'll always treat X0 as the address register, since EX_DATA_REG_ADDR is\n extracted from bits [9:5]. Thus, we may attempt to dereference an\n arbitrary address as X0 may hold an arbitrary value.\n * We'll always treat X4 as the data register, since EX_DATA_REG_DATA is\n extracted from bits [4:0]. Thus we will corrupt X4 and cause arbitrary\n behaviour within load_unaligned_zeropad() and its caller.\n\nFix this by extracting both values from ex->data as originally intended.\n\nOn an MTE-enabled QEMU image we are hitting the following crash:\n Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000\n Call trace:\n fixup_exception+0xc4/0x108\n __do_kernel_fault+0x3c/0x268\n do_tag_check_fault+0x3c/0x104\n do_mem_abort+0x44/0xf4\n el1_abort+0x40/0x64\n el1h_64_sync_handler+0x60/0xa0\n el1h_64_sync+0x7c/0x80\n link_path_walk+0x150/0x344\n path_openat+0xa0/0x7dc\n do_filp_open+0xb8/0x168\n do_sys_openat2+0x88/0x17c\n __arm64_sys_openat+0x74/0xa0\n invoke_syscall+0x48/0x148\n el0_svc_common+0xb8/0xf8\n do_el0_svc+0x28/0x88\n el0_svc+0x24/0x84\n el0t_64_sync_handler+0x88/0xec\n el0t_64_sync+0x1b4/0x1b8\n Code: f8695a69 71007d1f 540000e0 927df12a (f940014a)" } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The bug is in the arm64 exception fixup for load_unaligned_zeropad(), reached when pathname hashing faults during local syscalls such as openat→link_path_walk→hash_name; it is not a network-protocol entry point.\nAC:L - On the worst reasonable deployment (MTE-enabled arm64, e.g. Android), an unprivileged attacker can craft a pathname so word-at-a-time hashing crosses a tag/allocation boundary and reliably invokes the broken fixup, with no attacker-uncontrollable race.\nPR:L - Triggering requires only an unprivileged local account able to call open/stat-style path lookups; no capabilities or init-namespace root are needed.\nUI:N - The attacker invokes the vulnerable path themselves via ordinary filesystem syscalls; no separate victim action is required.\nS:U - Impact is confined to the host kernel’s own privilege domain (oops or corrupted kernel register state during path walk); this is not a VM/IOMMU/sandbox boundary escape.\nC:H - The broken handler always dereferences X0 and loads an unsigned long from that address, so a non-NULL X0 yields an unintended kernel memory read; combined with X4 clobber this is a memory-safety read primitive scored as C:H.\nI:H - The handler always writes the loaded value into X4, and the fix commit explicitly notes this corrupts X4 and causes arbitrary behaviour in load_unaligned_zeropad() and its caller, which can turn corrupted pointer/state into integrity compromise.\nA:H - When X0 is NULL (common after may_lookup in link_path_walk), the fixup’s own load is a NULL deref that nests into die_kernel_fault, producing a documented kernel oops/panic." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "arch/arm64/mm/extable.c" ], "versions": [ { "version": "753b32368705c396000f95f33c3b7018474e33ad", "lessThan": "47fe7a1c5e3e011eeb4ab79f2d54a794fdd1c3eb", "status": "affected", "versionType": "git" }, { "version": "753b32368705c396000f95f33c3b7018474e33ad", "lessThan": "3758a6c74e08bdc15ccccd6872a6ad37d165239a", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "arch/arm64/mm/extable.c" ], "versions": [ { "version": "5.16", "status": "affected" }, { "version": "0", "lessThan": "5.16", "status": "unaffected", "versionType": "semver" }, { "version": "5.16.5", "lessThanOrEqual": "5.16.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.17", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "5.16.5" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "5.17" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/47fe7a1c5e3e011eeb4ab79f2d54a794fdd1c3eb" }, { "url": "https://git.kernel.org/stable/c/3758a6c74e08bdc15ccccd6872a6ad37d165239a" } ], "title": "arm64: extable: fix load_unaligned_zeropad() reg indices", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "problemTypes": [ { "descriptions": [ { "type": "CWE", "lang": "en", "description": "CWE-noinfo Not enough information" } ] } ], "metrics": [ { "cvssV3_1": { "scope": "UNCHANGED", "version": "3.1", "baseScore": 6.2, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE" } }, { "other": { "type": "ssvc", "content": { "timestamp": "2024-06-20T13:32:18.518076Z", "id": "CVE-2022-48762", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "version": "2.0.3" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-29T18:16:31.076Z" } }, { "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T15:25:01.535Z" }, "title": "CVE Program Container", "references": [ { "url": "https://git.kernel.org/stable/c/47fe7a1c5e3e011eeb4ab79f2d54a794fdd1c3eb", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/3758a6c74e08bdc15ccccd6872a6ad37d165239a", "tags": [ "x_transferred" ] } ] } ] } }