CVE-2022-49170

Name of the Vulnerable Software and Affected Versions Linux kernel versions 5.17-rc4 through 5.17-rc6 linux-image-5.10.142-1-generic linux-image-5.10.142-1-hardened linux-image-5.15.0-33-generic linux-image-5.15.0-33-hardened linux-image-5.15.0-33-lowlatency linux-image-5.15.0-70-generic linux-image-5.15.0-70-hardened linux-image-5.15.0-70-lowlatency

Description An array-index-out-of-bounds issue exists in the Linux kernel when mounting and operating a corrupted image. The root cause is a missing sanity check on the curseg->alloc type variable within the sanity check curseg() function, which leads to out-of-bounds access of the sbi->block count[] array. This can impact the confidentiality, integrity, and availability of protected information.

Recommendations Update the Linux kernel to a version where the sanity check for curseg->alloc type has been implemented. Update linux-image-5.10.142-1-generic to a patched version. Update linux-image-5.10.142-1-hardened to a patched version. Update linux-image-5.15.0-33-generic to a patched version. Update linux-image-5.15.0-33-hardened to a patched version. Update linux-image-5.15.0-33-lowlatency to a patched version. Update linux-image-5.15.0-70-generic to a patched version. Update linux-image-5.15.0-70-hardened to a patched version. Update linux-image-5.15.0-70-lowlatency to a patched version.