GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2022-49062 (GCVE-0-2022-49062)

Vulnerability from cvelistv5 – Published: 2025-02-26 01:54 – Updated: 2026-08-05 08:53
VLAI
Title
cachefiles: Fix KASAN slab-out-of-bounds in cachefiles_set_volume_xattr
Summary
In the Linux kernel, the following vulnerability has been resolved: cachefiles: Fix KASAN slab-out-of-bounds in cachefiles_set_volume_xattr Use the actual length of volume coherency data when setting the xattr to avoid the following KASAN report. BUG: KASAN: slab-out-of-bounds in cachefiles_set_volume_xattr+0xa0/0x350 [cachefiles] Write of size 4 at addr ffff888101e02af4 by task kworker/6:0/1347 CPU: 6 PID: 1347 Comm: kworker/6:0 Kdump: loaded Not tainted 5.18.0-rc1-nfs-fscache-netfs+ #13 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-4.fc34 04/01/2014 Workqueue: events fscache_create_volume_work [fscache] Call Trace: <TASK> dump_stack_lvl+0x45/0x5a print_report.cold+0x5e/0x5db ? __lock_text_start+0x8/0x8 ? cachefiles_set_volume_xattr+0xa0/0x350 [cachefiles] kasan_report+0xab/0x120 ? cachefiles_set_volume_xattr+0xa0/0x350 [cachefiles] kasan_check_range+0xf5/0x1d0 memcpy+0x39/0x60 cachefiles_set_volume_xattr+0xa0/0x350 [cachefiles] cachefiles_acquire_volume+0x2be/0x500 [cachefiles] ? __cachefiles_free_volume+0x90/0x90 [cachefiles] fscache_create_volume_work+0x68/0x160 [fscache] process_one_work+0x3b7/0x6a0 worker_thread+0x2c4/0x650 ? process_one_work+0x6a0/0x6a0 kthread+0x16c/0x1a0 ? kthread_complete_and_exit+0x20/0x20 ret_from_fork+0x22/0x30 </TASK> Allocated by task 1347: kasan_save_stack+0x1e/0x40 __kasan_kmalloc+0x81/0xa0 cachefiles_set_volume_xattr+0x76/0x350 [cachefiles] cachefiles_acquire_volume+0x2be/0x500 [cachefiles] fscache_create_volume_work+0x68/0x160 [fscache] process_one_work+0x3b7/0x6a0 worker_thread+0x2c4/0x650 kthread+0x16c/0x1a0 ret_from_fork+0x22/0x30 The buggy address belongs to the object at ffff888101e02af0 which belongs to the cache kmalloc-8 of size 8 The buggy address is located 4 bytes inside of 8-byte region [ffff888101e02af0, ffff888101e02af8) The buggy address belongs to the physical page: page:00000000a2292d70 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x101e02 flags: 0x17ffffc0000200(slab|node=0|zone=2|lastcpupid=0x1fffff) raw: 0017ffffc0000200 0000000000000000 dead000000000001 ffff888100042280 raw: 0000000000000000 0000000080660066 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff888101e02980: fc 00 fc fc fc fc 00 fc fc fc fc 00 fc fc fc fc ffff888101e02a00: 00 fc fc fc fc 00 fc fc fc fc 00 fc fc fc fc 00 >ffff888101e02a80: fc fc fc fc 00 fc fc fc fc 00 fc fc fc fc 04 fc ^ ffff888101e02b00: fc fc fc 00 fc fc fc fc 00 fc fc fc fc 00 fc fc ffff888101e02b80: fc fc 00 fc fc fc fc 00 fc fc fc fc 00 fc fc fc ==================================================================
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-10-01 19:49 UTC
CWE
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 413a4a6b0b5553f2423d210f65e98c211b99c3f8 , < 09a5df1b88c8f126c8ff9938edf160edd4e92f42 (git)
Affected: 413a4a6b0b5553f2423d210f65e98c211b99c3f8 , < 7b2f6c306601240635c72caa61f682e74d4591b2 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.17
Unaffected: 0 , < 5.17 (semver)
Unaffected: 5.17.4 , ≤ 5.17.* (semver)
Unaffected: 5.18 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-49062",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T19:49:46.162321Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-787",
                "description": "CWE-787 Out-of-bounds Write",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-01T19:57:06.281Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/cachefiles/xattr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "09a5df1b88c8f126c8ff9938edf160edd4e92f42",
              "status": "affected",
              "version": "413a4a6b0b5553f2423d210f65e98c211b99c3f8",
              "versionType": "git"
            },
            {
              "lessThan": "7b2f6c306601240635c72caa61f682e74d4591b2",
              "status": "affected",
              "version": "413a4a6b0b5553f2423d210f65e98c211b99c3f8",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/cachefiles/xattr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.17"
            },
            {
              "lessThan": "5.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.17.*",
              "status": "unaffected",
              "version": "5.17.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.17.4",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.18",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncachefiles: Fix KASAN slab-out-of-bounds in cachefiles_set_volume_xattr\n\nUse the actual length of volume coherency data when setting the\nxattr to avoid the following KASAN report.\n\n BUG: KASAN: slab-out-of-bounds in cachefiles_set_volume_xattr+0xa0/0x350 [cachefiles]\n Write of size 4 at addr ffff888101e02af4 by task kworker/6:0/1347\n\n CPU: 6 PID: 1347 Comm: kworker/6:0 Kdump: loaded Not tainted 5.18.0-rc1-nfs-fscache-netfs+ #13\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-4.fc34 04/01/2014\n Workqueue: events fscache_create_volume_work [fscache]\n Call Trace:\n  \u003cTASK\u003e\n  dump_stack_lvl+0x45/0x5a\n  print_report.cold+0x5e/0x5db\n  ? __lock_text_start+0x8/0x8\n  ? cachefiles_set_volume_xattr+0xa0/0x350 [cachefiles]\n  kasan_report+0xab/0x120\n  ? cachefiles_set_volume_xattr+0xa0/0x350 [cachefiles]\n  kasan_check_range+0xf5/0x1d0\n  memcpy+0x39/0x60\n  cachefiles_set_volume_xattr+0xa0/0x350 [cachefiles]\n  cachefiles_acquire_volume+0x2be/0x500 [cachefiles]\n  ? __cachefiles_free_volume+0x90/0x90 [cachefiles]\n  fscache_create_volume_work+0x68/0x160 [fscache]\n  process_one_work+0x3b7/0x6a0\n  worker_thread+0x2c4/0x650\n  ? process_one_work+0x6a0/0x6a0\n  kthread+0x16c/0x1a0\n  ? kthread_complete_and_exit+0x20/0x20\n  ret_from_fork+0x22/0x30\n  \u003c/TASK\u003e\n\n Allocated by task 1347:\n  kasan_save_stack+0x1e/0x40\n  __kasan_kmalloc+0x81/0xa0\n  cachefiles_set_volume_xattr+0x76/0x350 [cachefiles]\n  cachefiles_acquire_volume+0x2be/0x500 [cachefiles]\n  fscache_create_volume_work+0x68/0x160 [fscache]\n  process_one_work+0x3b7/0x6a0\n  worker_thread+0x2c4/0x650\n  kthread+0x16c/0x1a0\n  ret_from_fork+0x22/0x30\n\n The buggy address belongs to the object at ffff888101e02af0\n which belongs to the cache kmalloc-8 of size 8\n The buggy address is located 4 bytes inside of\n 8-byte region [ffff888101e02af0, ffff888101e02af8)\n\n The buggy address belongs to the physical page:\n page:00000000a2292d70 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x101e02\n flags: 0x17ffffc0000200(slab|node=0|zone=2|lastcpupid=0x1fffff)\n raw: 0017ffffc0000200 0000000000000000 dead000000000001 ffff888100042280\n raw: 0000000000000000 0000000080660066 00000001ffffffff 0000000000000000\n page dumped because: kasan: bad access detected\n\n Memory state around the buggy address:\n ffff888101e02980: fc 00 fc fc fc fc 00 fc fc fc fc 00 fc fc fc fc\n ffff888101e02a00: 00 fc fc fc fc 00 fc fc fc fc 00 fc fc fc fc 00\n \u003effff888101e02a80: fc fc fc fc 00 fc fc fc fc 00 fc fc fc fc 04 fc\n                                                            ^\n ffff888101e02b00: fc fc fc 00 fc fc fc fc 00 fc fc fc fc 00 fc fc\n ffff888101e02b80: fc fc 00 fc fc fc fc 00 fc fc fc fc 00 fc fc fc\n =================================================================="
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path runs in a local fscache workqueue (fscache_create_volume_work \u2192 cachefiles_acquire_volume \u2192 cachefiles_set_volume_xattr) when a netfs client sets up a cache volume; it is not reached by processing remote protocol packets.\nAC:L - Every new cache volume directory reliably takes the is_new path and performs the oversized memcpy; the overflow size is fixed at sizeof(__be32) with no race or attacker-uncontrollable memory-layout precondition.\nPR:L - With cachefiles already bound by the system (reasonable on NFS/CIFS caching hosts), an unprivileged local user can cause volume creation via automount or fstab user mounts of an fscache-enabled netfs; CAP_SYS_ADMIN is not required for that trigger path.\nUI:N - The attacker drives the sequence themselves by mounting or accessing an automount path that creates a new cache volume; no separate victim action is required.\nS:U - The heap corruption stays within the host kernel privilege domain and does not cross a VM, IOMMU, or sandbox boundary.\nC:H - The buggy memcpy also reads four bytes past the volume coherency object and the out-of-bounds write corrupts adjacent slab objects, which can be groomed into an arbitrary kernel read primitive.\nI:H - A heap out-of-bounds write past a kmalloc buffer enables adjacent-object corruption and, with spraying, write/control-flow hijacking primitives in kernel context.\nA:H - The slab-out-of-bounds write can oops/panic the kernel (as shown by the KASAN report) or otherwise crash the host when adjacent heap metadata or objects are corrupted."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:53:41.182Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/09a5df1b88c8f126c8ff9938edf160edd4e92f42"
        },
        {
          "url": "https://git.kernel.org/stable/c/7b2f6c306601240635c72caa61f682e74d4591b2"
        }
      ],
      "title": "cachefiles: Fix KASAN slab-out-of-bounds in cachefiles_set_volume_xattr",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-49062",
    "datePublished": "2025-02-26T01:54:31.788Z",
    "dateReserved": "2025-02-26T01:49:39.243Z",
    "dateUpdated": "2026-08-05T08:53:41.182Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-49062",
      "date": "2026-09-16",
      "epss": "0.00251",
      "percentile": "0.16701"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-49062\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-02-26T07:00:43.450\",\"lastModified\":\"2026-06-17T05:16:58.490\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ncachefiles: Fix KASAN slab-out-of-bounds in cachefiles_set_volume_xattr\\n\\nUse the actual length of volume coherency data when setting the\\nxattr to avoid the following KASAN report.\\n\\n BUG: KASAN: slab-out-of-bounds in cachefiles_set_volume_xattr+0xa0/0x350 [cachefiles]\\n Write of size 4 at addr ffff888101e02af4 by task kworker/6:0/1347\\n\\n CPU: 6 PID: 1347 Comm: kworker/6:0 Kdump: loaded Not tainted 5.18.0-rc1-nfs-fscache-netfs+ #13\\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-4.fc34 04/01/2014\\n Workqueue: events fscache_create_volume_work [fscache]\\n Call Trace:\\n  \u003cTASK\u003e\\n  dump_stack_lvl+0x45/0x5a\\n  print_report.cold+0x5e/0x5db\\n  ? __lock_text_start+0x8/0x8\\n  ? cachefiles_set_volume_xattr+0xa0/0x350 [cachefiles]\\n  kasan_report+0xab/0x120\\n  ? cachefiles_set_volume_xattr+0xa0/0x350 [cachefiles]\\n  kasan_check_range+0xf5/0x1d0\\n  memcpy+0x39/0x60\\n  cachefiles_set_volume_xattr+0xa0/0x350 [cachefiles]\\n  cachefiles_acquire_volume+0x2be/0x500 [cachefiles]\\n  ? __cachefiles_free_volume+0x90/0x90 [cachefiles]\\n  fscache_create_volume_work+0x68/0x160 [fscache]\\n  process_one_work+0x3b7/0x6a0\\n  worker_thread+0x2c4/0x650\\n  ? process_one_work+0x6a0/0x6a0\\n  kthread+0x16c/0x1a0\\n  ? kthread_complete_and_exit+0x20/0x20\\n  ret_from_fork+0x22/0x30\\n  \u003c/TASK\u003e\\n\\n Allocated by task 1347:\\n  kasan_save_stack+0x1e/0x40\\n  __kasan_kmalloc+0x81/0xa0\\n  cachefiles_set_volume_xattr+0x76/0x350 [cachefiles]\\n  cachefiles_acquire_volume+0x2be/0x500 [cachefiles]\\n  fscache_create_volume_work+0x68/0x160 [fscache]\\n  process_one_work+0x3b7/0x6a0\\n  worker_thread+0x2c4/0x650\\n  kthread+0x16c/0x1a0\\n  ret_from_fork+0x22/0x30\\n\\n The buggy address belongs to the object at ffff888101e02af0\\n which belongs to the cache kmalloc-8 of size 8\\n The buggy address is located 4 bytes inside of\\n 8-byte region [ffff888101e02af0, ffff888101e02af8)\\n\\n The buggy address belongs to the physical page:\\n page:00000000a2292d70 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x101e02\\n flags: 0x17ffffc0000200(slab|node=0|zone=2|lastcpupid=0x1fffff)\\n raw: 0017ffffc0000200 0000000000000000 dead000000000001 ffff888100042280\\n raw: 0000000000000000 0000000080660066 00000001ffffffff 0000000000000000\\n page dumped because: kasan: bad access detected\\n\\n Memory state around the buggy address:\\n ffff888101e02980: fc 00 fc fc fc fc 00 fc fc fc fc 00 fc fc fc fc\\n ffff888101e02a00: 00 fc fc fc fc 00 fc fc fc fc 00 fc fc fc fc 00\\n \u003effff888101e02a80: fc fc fc fc 00 fc fc fc fc 00 fc fc fc fc 04 fc\\n                                                            ^\\n ffff888101e02b00: fc fc fc 00 fc fc fc fc 00 fc fc fc fc 00 fc fc\\n ffff888101e02b80: fc fc 00 fc fc fc fc 00 fc fc fc fc 00 fc fc fc\\n ==================================================================\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: cachefiles: corrige el error KASAN slab-out-of-bounds en cachefiles_set_volume_xattr. Usa la longitud real de los datos de coherencia del volumen al configurar xattr para evitar el siguiente informe KASAN. ERROR: KASAN: slab-out-of-bounds en cachefiles_set_volume_xattr+0xa0/0x350 [cachefiles] Escritura de tama\u00f1o 4 en la direcci\u00f3n ffff888101e02af4 por la tarea kworker/6:0/1347 CPU: 6 PID: 1347 Comm: kworker/6:0 Kdump: cargado No contaminado 5.18.0-rc1-nfs-fscache-netfs+ #13 Nombre del hardware: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-4.fc34 04/01/2014 Cola de trabajo: eventos fscache_create_volume_work [fscache] Seguimiento de llamadas:  dump_stack_lvl+0x45/0x5a print_report.cold+0x5e/0x5db ? __lock_text_start+0x8/0x8 ? cachefiles_set_volume_xattr+0xa0/0x350 [cachefiles] kasan_report+0xab/0x120 ? cachefiles_set_volume_xattr+0xa0/0x350 [cachefiles] kasan_check_range+0xf5/0x1d0 memcpy+0x39/0x60 cachefiles_set_volume_xattr+0xa0/0x350 [cachefiles] cachefiles_acquire_volume+0x2be/0x500 [cachefiles] ? __cachefiles_free_volume+0x90/0x90 [cachefiles] fscache_create_volume_work+0x68/0x160 [fscache] process_one_work+0x3b7/0x6a0 worker_thread+0x2c4/0x650 ? process_one_work+0x6a0/0x6a0 kthread+0x16c/0x1a0 ? kthread_complete_and_exit+0x20/0x20 ret_from_fork+0x22/0x30  Asignado por la tarea 1347: kasan_save_stack+0x1e/0x40 __kasan_kmalloc+0x81/0xa0 cachefiles_set_volume_xattr+0x76/0x350 [archivos de cach\u00e9] cachefiles_acquire_volume+0x2be/0x500 [archivos de cach\u00e9] fscache_create_volume_work+0x68/0x160 [fscache] process_one_work+0x3b7/0x6a0 worker_thread+0x2c4/0x650 kthread+0x16c/0x1a0 ret_from_fork+0x22/0x30 La direcci\u00f3n con errores pertenece a el objeto en ffff888101e02af0 que pertenece al cach\u00e9 kmalloc-8 de tama\u00f1o 8 La direcci\u00f3n con errores se encuentra 4 bytes dentro de la regi\u00f3n de 8 bytes [ffff888101e02af0, ffff888101e02af8) La direcci\u00f3n con errores pertenece a la p\u00e1gina f\u00edsica: page:00000000a2292d70 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x101e02 flags: 0x17ffffc0000200(slab|node=0|zone=2|lastcpupid=0x1fffff) raw: 0017ffffc0000200 0000000000000000 dead000000000001 ffff888100042280 raw: 0000000000000000 0000000080660066 00000001ffffffff 00000000000000000 p\u00e1gina volcada porque: kasan: se detect\u00f3 mal acceso Estado de la memoria alrededor de la direcci\u00f3n con errores: ffff888101e02980: FC 00 FC FC FC FC 00 FC FC FC FC 00 FC FC FC FC ffff888101e02a00: 00 FC FC FC FC 00 FC FC FC FC 00 FC FC FC FC 00 \u0026gt;ffff888101e02a80: FC FC FC FC 00 FC FC fc fc 00 fc fc fc fc 04 fc ^ ffff888101e02b00: fc fc fc 00 fc fc fc fc 00 fc fc fc fc 00 fc fc ffff888101e02b80: fc fc 00 fc fc fc fc 00 fc fc fc fc 00 fc fc fc =====================================================================\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/cachefiles/xattr.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"413a4a6b0b5553f2423d210f65e98c211b99c3f8\",\"lessThan\":\"09a5df1b88c8f126c8ff9938edf160edd4e92f42\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"413a4a6b0b5553f2423d210f65e98c211b99c3f8\",\"lessThan\":\"7b2f6c306601240635c72caa61f682e74d4591b2\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/cachefiles/xattr.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.17\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.17\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.17.4\",\"lessThanOrEqual\":\"5.17.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.18\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-10-01T19:49:46.162321Z\",\"id\":\"CVE-2022-49062\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-787\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-787\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.17\",\"versionEndExcluding\":\"5.17.4\",\"matchCriteriaId\":\"62D8CC4C-A7BD-4651-8B8B-B5D5AABB585E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.18:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"6AD94161-84BB-42E6-9882-4FC0C42E9FC1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.18:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"7AB06DDF-3C2B-416D-B448-E990D8FF67A9\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/09a5df1b88c8f126c8ff9938edf160edd4e92f42\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7b2f6c306601240635c72caa61f682e74d4591b2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-06-29T20:54:54+00:00",
      "cve": "CVE-2022-49062",
      "id": "CVE-2022-49062",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:known_affected": "150",
      "product_status:known_not_affected": "124",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: cachefiles: Fix KASAN slab-out-of-bounds in cachefiles_set_volume_xattr",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-49062.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-31T01:34:27Z",
      "cve": "CVE-2022-49062",
      "id": "CVE-2022-49062",
      "initial_release_date": "2025-02-27T03:12:52Z",
      "product_status:known_affected": "364",
      "product_status:known_not_affected": "409",
      "product_status:recommended": "100",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2022-49062",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2022-49062.json",
      "version": "36"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.8, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2022-49062\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-10-01T19:49:46.162321Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-787\", \"description\": \"CWE-787 Out-of-bounds Write\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-10-01T16:03:53.291Z\"}}], \"cna\": {\"title\": \"cachefiles: Fix KASAN slab-out-of-bounds in cachefiles_set_volume_xattr\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The vulnerable path runs in a local fscache workqueue (fscache_create_volume_work \\u2192 cachefiles_acquire_volume \\u2192 cachefiles_set_volume_xattr) when a netfs client sets up a cache volume; it is not reached by processing remote protocol packets.\\nAC:L - Every new cache volume directory reliably takes the is_new path and performs the oversized memcpy; the overflow size is fixed at sizeof(__be32) with no race or attacker-uncontrollable memory-layout precondition.\\nPR:L - With cachefiles already bound by the system (reasonable on NFS/CIFS caching hosts), an unprivileged local user can cause volume creation via automount or fstab user mounts of an fscache-enabled netfs; CAP_SYS_ADMIN is not required for that trigger path.\\nUI:N - The attacker drives the sequence themselves by mounting or accessing an automount path that creates a new cache volume; no separate victim action is required.\\nS:U - The heap corruption stays within the host kernel privilege domain and does not cross a VM, IOMMU, or sandbox boundary.\\nC:H - The buggy memcpy also reads four bytes past the volume coherency object and the out-of-bounds write corrupts adjacent slab objects, which can be groomed into an arbitrary kernel read primitive.\\nI:H - A heap out-of-bounds write past a kmalloc buffer enables adjacent-object corruption and, with spraying, write/control-flow hijacking primitives in kernel context.\\nA:H - The slab-out-of-bounds write can oops/panic the kernel (as shown by the KASAN report) or otherwise crash the host when adjacent heap metadata or objects are corrupted.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"413a4a6b0b5553f2423d210f65e98c211b99c3f8\", \"lessThan\": \"09a5df1b88c8f126c8ff9938edf160edd4e92f42\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"413a4a6b0b5553f2423d210f65e98c211b99c3f8\", \"lessThan\": \"7b2f6c306601240635c72caa61f682e74d4591b2\", \"versionType\": \"git\"}], \"programFiles\": [\"fs/cachefiles/xattr.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.17\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.17\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.17.4\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.17.*\"}, {\"status\": \"unaffected\", \"version\": \"5.18\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"fs/cachefiles/xattr.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/09a5df1b88c8f126c8ff9938edf160edd4e92f42\"}, {\"url\": \"https://git.kernel.org/stable/c/7b2f6c306601240635c72caa61f682e74d4591b2\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ncachefiles: Fix KASAN slab-out-of-bounds in cachefiles_set_volume_xattr\\n\\nUse the actual length of volume coherency data when setting the\\nxattr to avoid the following KASAN report.\\n\\n BUG: KASAN: slab-out-of-bounds in cachefiles_set_volume_xattr+0xa0/0x350 [cachefiles]\\n Write of size 4 at addr ffff888101e02af4 by task kworker/6:0/1347\\n\\n CPU: 6 PID: 1347 Comm: kworker/6:0 Kdump: loaded Not tainted 5.18.0-rc1-nfs-fscache-netfs+ #13\\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-4.fc34 04/01/2014\\n Workqueue: events fscache_create_volume_work [fscache]\\n Call Trace:\\n  \u003cTASK\u003e\\n  dump_stack_lvl+0x45/0x5a\\n  print_report.cold+0x5e/0x5db\\n  ? __lock_text_start+0x8/0x8\\n  ? cachefiles_set_volume_xattr+0xa0/0x350 [cachefiles]\\n  kasan_report+0xab/0x120\\n  ? cachefiles_set_volume_xattr+0xa0/0x350 [cachefiles]\\n  kasan_check_range+0xf5/0x1d0\\n  memcpy+0x39/0x60\\n  cachefiles_set_volume_xattr+0xa0/0x350 [cachefiles]\\n  cachefiles_acquire_volume+0x2be/0x500 [cachefiles]\\n  ? __cachefiles_free_volume+0x90/0x90 [cachefiles]\\n  fscache_create_volume_work+0x68/0x160 [fscache]\\n  process_one_work+0x3b7/0x6a0\\n  worker_thread+0x2c4/0x650\\n  ? process_one_work+0x6a0/0x6a0\\n  kthread+0x16c/0x1a0\\n  ? kthread_complete_and_exit+0x20/0x20\\n  ret_from_fork+0x22/0x30\\n  \u003c/TASK\u003e\\n\\n Allocated by task 1347:\\n  kasan_save_stack+0x1e/0x40\\n  __kasan_kmalloc+0x81/0xa0\\n  cachefiles_set_volume_xattr+0x76/0x350 [cachefiles]\\n  cachefiles_acquire_volume+0x2be/0x500 [cachefiles]\\n  fscache_create_volume_work+0x68/0x160 [fscache]\\n  process_one_work+0x3b7/0x6a0\\n  worker_thread+0x2c4/0x650\\n  kthread+0x16c/0x1a0\\n  ret_from_fork+0x22/0x30\\n\\n The buggy address belongs to the object at ffff888101e02af0\\n which belongs to the cache kmalloc-8 of size 8\\n The buggy address is located 4 bytes inside of\\n 8-byte region [ffff888101e02af0, ffff888101e02af8)\\n\\n The buggy address belongs to the physical page:\\n page:00000000a2292d70 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x101e02\\n flags: 0x17ffffc0000200(slab|node=0|zone=2|lastcpupid=0x1fffff)\\n raw: 0017ffffc0000200 0000000000000000 dead000000000001 ffff888100042280\\n raw: 0000000000000000 0000000080660066 00000001ffffffff 0000000000000000\\n page dumped because: kasan: bad access detected\\n\\n Memory state around the buggy address:\\n ffff888101e02980: fc 00 fc fc fc fc 00 fc fc fc fc 00 fc fc fc fc\\n ffff888101e02a00: 00 fc fc fc fc 00 fc fc fc fc 00 fc fc fc fc 00\\n \u003effff888101e02a80: fc fc fc fc 00 fc fc fc fc 00 fc fc fc fc 04 fc\\n                                                            ^\\n ffff888101e02b00: fc fc fc 00 fc fc fc fc 00 fc fc fc fc 00 fc fc\\n ffff888101e02b80: fc fc 00 fc fc fc fc 00 fc fc fc fc 00 fc fc fc\\n ==================================================================\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.17.4\", \"versionStartIncluding\": \"5.17\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.18\", \"versionStartIncluding\": \"5.17\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T08:53:41.182Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2022-49062\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T08:53:41.182Z\", \"dateReserved\": \"2025-02-26T01:49:39.243Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2025-02-26T01:54:31.788Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.