Log in Start free

Vulnerability · Published Apr 28, 2024 · Assigned by Linux

CVE-2022-48659mm/slub: fix to return errno if kmalloc() fails

Medium 5.5

In plain English

A medium-severity security flaw in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)5.5Medium
Exploit odds (30 days)0.2%top 84.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In the Linux kernel, the following vulnerability has been resolved: mm/slub: fix to return errno if kmalloc() fails In create_unique_id(), kmalloc(, GFP_KERNEL) can fail due to out-of-memory, if it fails, return errno correctly rather than triggering panic via BUG_ON(); kernel BUG at mm/slub.c:5893! Internal error: Oops - BUG: 0 [#1] PREEMPT SMP Call trace: sysfs_slab_add+0x258/0x260 mm/slub.c:5973 __kmem_cache_create+0x60/0x118 mm/slub.c:4899 create_cache mm/slab_common.c:229 [inline] kmem_cache_create_usercopy+0x19c/0x31c mm/slab_common.c:335 kmem_cache_create+0x1c/0x28 mm/slab_common.c:390 f2fs_kmem_cache_create fs/f2fs/f2fs.h:2766 [inline] f2fs_init_xattr_caches+0x78/0xb4 fs/f2fs/xattr.c:808 f2fs_fill_super+0x1050/0x1e0c fs/f2fs/super.c:4149 mount_bdev+0x1b8/0x210 fs/super.c:1400 f2fs_mount+0x44/0x58 fs/f2fs/super.c:4512 legacy_get_tree+0x30/0x74 fs/fs_context.c:610 vfs_get_tree+0x40/0x140 fs/super.c:1530 do_new_mount+0x1dc/0x4e4 fs/namespace.c:3040 path_mount+0x358/0x914 fs/namespace.c:3370 do_mount fs/namespace.c:3383 [inline] __do_sys_mount fs/namespace.c:3591 [inline] __se_sys_mount fs/namespace.c:3568 [inline] __arm64_sys_mount+0x2f8/0x408 fs/namespace.c:3568

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12linux6.0.2-1DEBIAN-CVE-2022-48659
Debian:13linux6.0.2-1DEBIAN-CVE-2022-48659
Debian:14linux6.0.2-1DEBIAN-CVE-2022-48659
Ubuntu:22.04:LTSlinux5.15.0-57.63UBUNTU-CVE-2022-48659
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2022-48659
Ubuntu:22.04:LTSlinux-aws5.15.0-1027.31UBUNTU-CVE-2022-48659
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2022-48659
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2022-48659
Ubuntu:22.04:LTSlinux-azure5.15.0-1030.37UBUNTU-CVE-2022-48659
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2022-48659
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2022-48659
Ubuntu:22.04:LTSlinux-azure-fde5.15.0-1030.37.1UBUNTU-CVE-2022-48659
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2022-48659
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2022-48659
Ubuntu:22.04:LTSlinux-gcp5.15.0-1026.33UBUNTU-CVE-2022-48659
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2022-48659
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2022-48659
Ubuntu:22.04:LTSlinux-gke5.15.0-1024.29UBUNTU-CVE-2022-48659
Ubuntu:22.04:LTSlinux-gkeop5.15.0-1012.16UBUNTU-CVE-2022-48659
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2022-48659
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2022-48659
Ubuntu:22.04:LTSlinux-ibm5.15.0-1022.25UBUNTU-CVE-2022-48659
Ubuntu:22.04:LTSlinux-intel-iot-realtimeno fix listedUBUNTU-CVE-2022-48659
Ubuntu:22.04:LTSlinux-intel-iotg5.15.0-1023.28UBUNTU-CVE-2022-48659
Ubuntu:22.04:LTSlinux-kvm5.15.0-1025.30UBUNTU-CVE-2022-48659
Ubuntu:22.04:LTSlinux-lowlatency5.15.0-57.63UBUNTU-CVE-2022-48659
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2022-48659
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2022-48659
Ubuntu:22.04:LTSlinux-nvidia5.15.0-1015.15UBUNTU-CVE-2022-48659
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2022-48659
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2022-48659
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2022-48659
Ubuntu:22.04:LTSlinux-oem-6.1no fix listedUBUNTU-CVE-2022-48659
Ubuntu:22.04:LTSlinux-oracle5.15.0-1026.32UBUNTU-CVE-2022-48659
Ubuntu:22.04:LTSlinux-raspi5.15.0-1022.24UBUNTU-CVE-2022-48659
Ubuntu:24.04:LTSlinux-raspi-realtimeno fix listedUBUNTU-CVE-2022-48659
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2022-48659
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2022-48659
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2022-48659
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2022-48659
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2022-48659

Affected products (as reported)

VendorProductVersions
Linux Linux 81819f0fc8285a2a5a921c019e3e3d7b6169d225 – before e9219fa63c5c25804af82c7aa54d1ec770ebe45781819f0fc8285a2a5a921c019e3e3d7b6169d225 – before a1d83a19cec3bfeb2b3547a1f7631e432a766d1c81819f0fc8285a2a5a921c019e3e3d7b6169d225 – before e996821717c5cf8aa1e1abdb6b3d900a231e375581819f0fc8285a2a5a921c019e3e3d7b6169d225 – before 016b150992eebc32c4a18f783cf2bb6e2545a3d981819f0fc8285a2a5a921c019e3e3d7b6169d225 – before 379ac7905ff3f0a6a4e507d3e9f710ec4fab912481819f0fc8285a2a5a921c019e3e3d7b6169d225 – before 2d6e55e0c03804e1e227b80a5746e086d6c6696c81819f0fc8285a2a5a921c019e3e3d7b6169d225 – before 02bcd951aa3c2cea95fb241c20802e950194029681819f0fc8285a2a5a921c019e3e3d7b6169d225 – before 7e9c323c52b379d261a72dc7bd38120a761a93cd
Linux Linux 2.6.22

References