From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3AF3E21C177 for ; Wed, 26 Feb 2025 02:27:54 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1740536874; cv=none; b=IidJTclMUESgq3CCfnAjwpb78anY5xUeoqOret0loQrY7sAS7JDpp8WqsziRiPCCcqSX+uHgsg0YeDFTFNJf9MuoeGehDgknX4jLVwzHSU0YNBPx0dCTxStAq21i6gu1wU3lQJWYv+3mquiK5QXgUmjUrKVkhhspfswg1dZqz/8= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1740536874; c=relaxed/simple; bh=0UULhiwWoLpLUnKPmLd5nZL8DkTesmEpqK/vb/BFOsI=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=JbAER7wXueOTJM0ujJbeprtZjCxK8RVQxXhVM9/VsIhQO5AitOP7SFZuWBcZk8lX5//vsbiT9RfwUhALqIDg7uem+/4k+8aRDEWWPy4BEyVRKfIMq4H8nF8iw2TZ7tGQ21s4foF0Hjwr2dfn5J0K9DIzIOpV5Jzl7wJ7cFvNoqM= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=c0QGCBL/; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="c0QGCBL/" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0B62FC4CEDD; Wed, 26 Feb 2025 02:27:54 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1740536874; bh=0UULhiwWoLpLUnKPmLd5nZL8DkTesmEpqK/vb/BFOsI=; h=From:To:Cc:Subject:Date:Reply-to:From; b=c0QGCBL/6IBfVv5xjXIzNsHu/M11HGOgsW0pJlNK6Cvm1tiUxEbjhFUQg/qu+q0Do AWel9/C+1AKBsnbQ17WrFCS1BPtQOGwoUckKkrS99VmaqNAaBZY1EIvASe7OcoIGbK JGGWWPMmpLG0VN8AcN/5Qz/NcUDRV8QolEweu58Q= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2022-49673: dm raid: fix KASAN warning in raid5_add_disks Date: Wed, 26 Feb 2025 03:23:56 +0100 Message-ID: <2025022624-CVE-2022-49673-0197@gregkh> X-Mailer: git-send-email 2.48.1 Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Reply-to: , X-Developer-Signature: v=1; a=openpgp-sha256; l=2709; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=0UULhiwWoLpLUnKPmLd5nZL8DkTesmEpqK/vb/BFOsI=; b=owGbwMvMwCRo6H6F97bub03G02pJDOn7qh4oRf/w+vLd5Hubn5ryHae1eW3a72rkT59qNf5o7 X8vaEddRywLgyATg6yYIsuXbTxH91ccUvQytD0NM4eVCWQIAxenAEzkThTD/MRAXf9D7U++ptTY bPd98ned3u/POgwLDu4+cimYpzxD5xsX1/ScvJeS8qbqAA== X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit Description =========== In the Linux kernel, the following vulnerability has been resolved: dm raid: fix KASAN warning in raid5_add_disks There's a KASAN warning in raid5_add_disk when running the LVM testsuite. The warning happens in the test lvconvert-raid-reshape-linear_to_raid6-single-type.sh. We fix the warning by verifying that rdev->saved_raid_disk is within limits. The Linux kernel CVE team has assigned CVE-2022-49673 to this issue. Affected and fixed versions =========================== Fixed in 4.9.322 with commit 2d4e7c9898c20fb3d3f55381cab601761aab7d64 Fixed in 4.14.287 with commit 2fb2928728038280bd925ce2aafb4997e9d47ee9 Fixed in 4.19.251 with commit 3553a69bb52be2deba61d0ca064c41aee842bb35 Fixed in 5.4.204 with commit f157bd9cf377a947fdb7035e69466b6ecdc17c17 Fixed in 5.10.129 with commit d8bca518d5272fe349e0a722fdb9e3acb661f3f0 Fixed in 5.15.53 with commit d5b06039b195d4b6f94f5d345b1e4ac1975a9832 Fixed in 5.18.10 with commit 02cffb1921edadd9b6e4eee7ada4a5213e8ba12e Fixed in 5.19 with commit 617b365872a247480e9dcd50a32c8d1806b21861 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2022-49673 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/md/raid5.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/2d4e7c9898c20fb3d3f55381cab601761aab7d64 https://git.kernel.org/stable/c/2fb2928728038280bd925ce2aafb4997e9d47ee9 https://git.kernel.org/stable/c/3553a69bb52be2deba61d0ca064c41aee842bb35 https://git.kernel.org/stable/c/f157bd9cf377a947fdb7035e69466b6ecdc17c17 https://git.kernel.org/stable/c/d8bca518d5272fe349e0a722fdb9e3acb661f3f0 https://git.kernel.org/stable/c/d5b06039b195d4b6f94f5d345b1e4ac1975a9832 https://git.kernel.org/stable/c/02cffb1921edadd9b6e4eee7ada4a5213e8ba12e https://git.kernel.org/stable/c/617b365872a247480e9dcd50a32c8d1806b21861