CVE-2022-50299

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 5.4.0-1085-azure #90~18.04.1-Ubuntu

Description The Linux kernel contained an issue where the snprintf function was used instead of scnprintf in the md (multiple device) module. This could lead to a warning when the total characters in block device names plus slashes exceeded 200, potentially causing a buffer overflow due to the wrapping around of the calculation “200 – len”. The issue was addressed by replacing snprintf with scnprintf, which accurately returns the number of characters written into the buffer.

Recommendations Update the Linux kernel to version 5.4.0-1085-azure #90~18.04.1-Ubuntu or a later version to resolve this issue.