CVE-2022-48747 – A vulnerability in the Linux kernel's bio

Q: What is the severity of CVE-2022-48747?

CVE-2022-48747 has a CVSS score of 7.5 (HIGH). A vulnerability in the Linux kernel's bio_truncate() function could allow reading uninitialized data from block devices. This occurs when both a corrupted filesystem and userspace processes attempt to read the last block of a block device simultaneously. Systems running affected Linux kernel versions are vulnerable.

📋 TL;DR

A vulnerability in the Linux kernel's bio_truncate() function could allow reading uninitialized data from block devices. This occurs when both a corrupted filesystem and userspace processes attempt to read the last block of a block device simultaneously. Systems running affected Linux kernel versions are vulnerable.

💻 Affected Systems

Products:

Linux kernel

Versions: Specific affected versions not explicitly stated in CVE, but patches exist in stable kernel trees

Operating Systems: Linux distributions using vulnerable kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Requires both a truncated/corrupted filesystem and userspace access to block devices simultaneously.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Information disclosure of kernel memory contents, potentially exposing sensitive data or cryptographic keys.

🟠

Likely Case

Reading of random uninitialized memory data, causing application instability or crashes.

🟢

If Mitigated

Minimal impact if systems are patched or don't have corrupted filesystems accessing block devices.

🌐 Internet-Facing: LOW - This vulnerability requires local access to the system.

🏢 Internal Only: MEDIUM - Local attackers or malicious users could exploit this to read kernel memory.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Exploitation requires specific conditions: corrupted filesystem and concurrent block device access.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Patched in stable kernel commits referenced in CVE

Vendor Advisory: https://git.kernel.org/stable/c/3ee859e384d453d6ac68bfd5971f630d9fa46ad3

Restart Required: Yes

Instructions:

1. Update Linux kernel to patched version from your distribution's repositories. 2. Reboot system to load new kernel.

🔧 Temporary Workarounds

Restrict block device access

linux

Limit userspace access to block devices to reduce attack surface

chmod 600 /dev/sd*
setfacl -m u:root:rw /dev/sd*

🧯 If You Can't Patch

Monitor for filesystem corruption and repair immediately
Implement strict access controls on block device files

🔍 How to Verify

Check if Vulnerable:

Check kernel version and compare with patched versions from distribution vendor

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version after update matches patched version from vendor

📡 Detection & Monitoring

Log Indicators:

Kernel oops messages
Filesystem corruption warnings in dmesg

Network Indicators:

None - local vulnerability only

SIEM Query:

source="kernel" AND ("oops" OR "BUG" OR "filesystem corruption")

📊 Metadata

CVE ID: CVE-2022-48747

CVSS v3 Score: 7.5 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE: CWE-908

Published: June 20, 2024

Last Updated: March 24, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2022-48747, you might also want to check these: