From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 194AA21A432 for ; Wed, 26 Feb 2025 02:24:42 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1740536682; cv=none; b=qIuxankzCL+U0MtCc6Kpb8vCUSmBUKfgeh4JoC4+yZnOIf7+nHBh9AwU3VpaSEyWKYXd62xLH4yHcAnUqwf3ign0mSbulvlnN9tJZyIFJ5r4fQHHoOfrXb77tx3astAvof8iNxDIeb/8biJAqih5WUhBOi8L0HjFkPJ0cJAMss0= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1740536682; c=relaxed/simple; bh=zns14J0EfiehLP4xZYPx1gLXr7c0LokS/5/qoRp7Nys=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=i8+NzEcQyqUSnEejo6ikcEVJctCzvFOatE8sa41ohTKagzape3UVMr3w3wdafzf9tQZ9fy6IX3MfcvRvMKsAeJ84Bd2MFW5l17rSXQ3T1G0l2J1iC/d8u2iEkGreFkLgXmStfRDLPWUIRitUFtkUYdkO0kBpXnsMWZV64tA6ovo= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=iUWFM28s; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="iUWFM28s" Received: by smtp.kernel.org (Postfix) with ESMTPSA id DECE3C4CEDD; Wed, 26 Feb 2025 02:24:41 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1740536682; bh=zns14J0EfiehLP4xZYPx1gLXr7c0LokS/5/qoRp7Nys=; h=From:To:Cc:Subject:Date:Reply-to:From; b=iUWFM28sgT98wOuoFBz6xwYzrFaMnF/2iwEFGghhAsxJe+9noGdDMftpOwxu0n8tQ IliU9o634vx9RPHJ5VMYQ4y0NnYTEP8Qg79+ai+ntpmkfLSEB2PbKOr+SU1wamXsnW ZYyCIbVEfIXAnTIP6MSMQzSlxeapw95ukvgoQi7k= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2022-49643: ima: Fix a potential integer overflow in ima_appraise_measurement Date: Wed, 26 Feb 2025 03:23:26 +0100 Message-ID: <2025022619-CVE-2022-49643-ae05@gregkh> X-Mailer: git-send-email 2.48.1 Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Reply-to: , X-Developer-Signature: v=1; a=openpgp-sha256; l=2600; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=zns14J0EfiehLP4xZYPx1gLXr7c0LokS/5/qoRp7Nys=; b=owGbwMvMwCRo6H6F97bub03G02pJDOn7qm5zMTEoHI4O3tDQeL0y7dLVwDPTKi19PLve+TOFP bp69t+cjlgWBkEmBlkxRZYv23iO7q84pOhlaHsaZg4rE8gQBi5OAZiI8AqG+XFtl/kOLzDm/Zq8 +J4ei1PB1iAjR4Z5qiG8E6O+L3yaaXfbIE2iJkOz+60jAA== X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit Description =========== In the Linux kernel, the following vulnerability has been resolved: ima: Fix a potential integer overflow in ima_appraise_measurement When the ima-modsig is enabled, the rc passed to evm_verifyxattr() may be negative, which may cause the integer overflow problem. The Linux kernel CVE team has assigned CVE-2022-49643 to this issue. Affected and fixed versions =========================== Issue introduced in 5.4 with commit 39b07096364a42c516415d5f841069e885234e61 and fixed in 5.4.207 with commit 388f3df7c3c8b7f2a32b9ae0a9b2f9f6ad3b1b77 Issue introduced in 5.4 with commit 39b07096364a42c516415d5f841069e885234e61 and fixed in 5.10.132 with commit 831e190175f10652be93b08436cc7bf2e62e4bb6 Issue introduced in 5.4 with commit 39b07096364a42c516415d5f841069e885234e61 and fixed in 5.15.56 with commit c8d5d81940938b5f6c0f495ca9538e7740416f30 Issue introduced in 5.4 with commit 39b07096364a42c516415d5f841069e885234e61 and fixed in 5.18.13 with commit 640cea4c2839a821adfbb703b590a5928abe9286 Issue introduced in 5.4 with commit 39b07096364a42c516415d5f841069e885234e61 and fixed in 5.19 with commit d2ee2cfc4aa85ff6a2a3b198a3a524ec54e3d999 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2022-49643 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: security/integrity/ima/ima_appraise.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/388f3df7c3c8b7f2a32b9ae0a9b2f9f6ad3b1b77 https://git.kernel.org/stable/c/831e190175f10652be93b08436cc7bf2e62e4bb6 https://git.kernel.org/stable/c/c8d5d81940938b5f6c0f495ca9538e7740416f30 https://git.kernel.org/stable/c/640cea4c2839a821adfbb703b590a5928abe9286 https://git.kernel.org/stable/c/d2ee2cfc4aa85ff6a2a3b198a3a524ec54e3d999