CVE-2022-49674
📋 TL;DR
This CVE is an out-of-bounds memory access vulnerability in the Linux kernel's dm-raid subsystem. It allows attackers with local access to potentially cause kernel crashes or execute arbitrary code by triggering RAID layout changes. Systems using Linux kernel with dm-raid are affected.
💻 Affected Systems
- Linux kernel
📦 What is this software?
Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →⚠️ Risk & Real-World Impact
Worst Case
Kernel panic leading to system crash or potential privilege escalation to kernel-level code execution
Likely Case
Kernel crash causing system instability and denial of service
If Mitigated
No impact if patched or if dm-raid is not in use
🎯 Exploit Status
Requires local access and ability to trigger RAID layout changes. KASAN was used to discover the vulnerability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Kernel versions containing commit 332bd0778775d0cf105c4b9e03e460b590749916 or related fixes
Vendor Advisory: https://git.kernel.org/stable/c/332bd0778775d0cf105c4b9e03e460b590749916
Restart Required: Yes
Instructions:
1. Update Linux kernel to patched version from your distribution vendor. 2. Reboot system to load new kernel.
🔧 Temporary Workarounds
Disable dm-raid
LinuxRemove or disable dm-raid module if not needed
echo 'blacklist dm-raid' >> /etc/modprobe.d/blacklist.conf
rmmod dm-raid
🧯 If You Can't Patch
- Restrict local user access to systems with dm-raid
- Monitor for unusual RAID configuration changes or kernel crashes
🔍 How to Verify
Check if Vulnerable:
Check kernel version and if dm-raid module is loaded: lsmod | grep dm_raidCheck Version:
uname -rVerify Fix Applied:
Verify kernel version is patched and check for presence of fix commit in kernel source📡 Detection & Monitoring
Log Indicators:
- Kernel panic logs
- KASAN error reports
- dm-raid related errors in dmesg
Network Indicators:
- None - local vulnerability
SIEM Query:
Search for kernel panic events or dm-raid error messages in system logs🔗 References
- https://git.kernel.org/stable/c/332bd0778775d0cf105c4b9e03e460b590749916
- https://git.kernel.org/stable/c/5e161a8826b63c0b8b43e4a7fad1f956780f42ab
- https://git.kernel.org/stable/c/6352b2f4d8e95ec0ae576d7705435d64cfa29503
- https://git.kernel.org/stable/c/90de15357504c8097ab29769dc6852e16281e9e8
- https://git.kernel.org/stable/c/9bf2b0757b04c78dc5d6e3a198acca98457b32a1
- https://git.kernel.org/stable/c/bcff98500ea3b4e7615ec31d2bdd326bc1ef5134
- https://git.kernel.org/stable/c/df1a5ab0dd0775f2ea101c71f2addbc4c0ea0f85
