CVE-2022-49077 (GCVE-0-2022-49077)
Vulnerability from cvelistv5
Published
2025-02-26 01:54
Modified
2025-12-23 13:21
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: mmmremap.c: avoid pointless invalidate_range_start/end on mremap(old_size=0) If an mremap() syscall with old_size=0 ends up in move_page_tables(), it will call invalidate_range_start()/invalidate_range_end() unnecessarily, i.e. with an empty range. This causes a WARN in KVM's mmu_notifier. In the past, empty ranges have been diagnosed to be off-by-one bugs, hence the WARNing. Given the low (so far) number of unique reports, the benefits of detecting more buggy callers seem to outweigh the cost of having to fix cases such as this one, where userspace is doing something silly. In this particular case, an early return from move_page_tables() is enough to fix the issue.
References
Impacted products
Vendor Product Version
Linux Linux Version: 7b6efc2bc4f19952b25ebf9b236e5ac43cd386c2
Version: 7b6efc2bc4f19952b25ebf9b236e5ac43cd386c2
Version: 7b6efc2bc4f19952b25ebf9b236e5ac43cd386c2
Version: 7b6efc2bc4f19952b25ebf9b236e5ac43cd386c2
Version: 7b6efc2bc4f19952b25ebf9b236e5ac43cd386c2
Version: 7b6efc2bc4f19952b25ebf9b236e5ac43cd386c2
Version: 7b6efc2bc4f19952b25ebf9b236e5ac43cd386c2
Version: 7b6efc2bc4f19952b25ebf9b236e5ac43cd386c2
Version: 7b6efc2bc4f19952b25ebf9b236e5ac43cd386c2
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "mm/mremap.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a05540f3903bd8295e8c4cd90dd3d416239a115b",
              "status": "affected",
              "version": "7b6efc2bc4f19952b25ebf9b236e5ac43cd386c2",
              "versionType": "git"
            },
            {
              "lessThan": "eeaf28e2a0128147d687237e59d5407ee1b14693",
              "status": "affected",
              "version": "7b6efc2bc4f19952b25ebf9b236e5ac43cd386c2",
              "versionType": "git"
            },
            {
              "lessThan": "e2c328c2a8f9de8b761bd4025b66c63120c55761",
              "status": "affected",
              "version": "7b6efc2bc4f19952b25ebf9b236e5ac43cd386c2",
              "versionType": "git"
            },
            {
              "lessThan": "c19d8de4e682ec4b0ea2b04a832cd8cc0be3bb31",
              "status": "affected",
              "version": "7b6efc2bc4f19952b25ebf9b236e5ac43cd386c2",
              "versionType": "git"
            },
            {
              "lessThan": "7d659cb1763ff17d1c6ee082fa6feb4267c7a30b",
              "status": "affected",
              "version": "7b6efc2bc4f19952b25ebf9b236e5ac43cd386c2",
              "versionType": "git"
            },
            {
              "lessThan": "a04cb99c5d4668fe3f5c0e5b6da1cecd34c3f219",
              "status": "affected",
              "version": "7b6efc2bc4f19952b25ebf9b236e5ac43cd386c2",
              "versionType": "git"
            },
            {
              "lessThan": "2358aa84ef6dafcf544a557caaa6b91afb4a0bd2",
              "status": "affected",
              "version": "7b6efc2bc4f19952b25ebf9b236e5ac43cd386c2",
              "versionType": "git"
            },
            {
              "lessThan": "04bc13dae4a27b8d030843c85ae452bb2f1d9c1f",
              "status": "affected",
              "version": "7b6efc2bc4f19952b25ebf9b236e5ac43cd386c2",
              "versionType": "git"
            },
            {
              "lessThan": "01e67e04c28170c47700c2c226d732bbfedb1ad0",
              "status": "affected",
              "version": "7b6efc2bc4f19952b25ebf9b236e5ac43cd386c2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "mm/mremap.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.2"
            },
            {
              "lessThan": "3.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.9.*",
              "status": "unaffected",
              "version": "4.9.311",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.14.*",
              "status": "unaffected",
              "version": "4.14.276",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.238",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.189",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.111",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.34",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.16.*",
              "status": "unaffected",
              "version": "5.16.20",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.17.*",
              "status": "unaffected",
              "version": "5.17.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.9.311",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.14.276",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.238",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.189",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.111",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.34",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.16.20",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.17.3",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.18",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmmmremap.c: avoid pointless invalidate_range_start/end on mremap(old_size=0)\n\nIf an mremap() syscall with old_size=0 ends up in move_page_tables(), it\nwill call invalidate_range_start()/invalidate_range_end() unnecessarily,\ni.e.  with an empty range.\n\nThis causes a WARN in KVM\u0027s mmu_notifier.  In the past, empty ranges\nhave been diagnosed to be off-by-one bugs, hence the WARNing.  Given the\nlow (so far) number of unique reports, the benefits of detecting more\nbuggy callers seem to outweigh the cost of having to fix cases such as\nthis one, where userspace is doing something silly.  In this particular\ncase, an early return from move_page_tables() is enough to fix the\nissue."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-12-23T13:21:52.189Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a05540f3903bd8295e8c4cd90dd3d416239a115b"
        },
        {
          "url": "https://git.kernel.org/stable/c/eeaf28e2a0128147d687237e59d5407ee1b14693"
        },
        {
          "url": "https://git.kernel.org/stable/c/e2c328c2a8f9de8b761bd4025b66c63120c55761"
        },
        {
          "url": "https://git.kernel.org/stable/c/c19d8de4e682ec4b0ea2b04a832cd8cc0be3bb31"
        },
        {
          "url": "https://git.kernel.org/stable/c/7d659cb1763ff17d1c6ee082fa6feb4267c7a30b"
        },
        {
          "url": "https://git.kernel.org/stable/c/a04cb99c5d4668fe3f5c0e5b6da1cecd34c3f219"
        },
        {
          "url": "https://git.kernel.org/stable/c/2358aa84ef6dafcf544a557caaa6b91afb4a0bd2"
        },
        {
          "url": "https://git.kernel.org/stable/c/04bc13dae4a27b8d030843c85ae452bb2f1d9c1f"
        },
        {
          "url": "https://git.kernel.org/stable/c/01e67e04c28170c47700c2c226d732bbfedb1ad0"
        }
      ],
      "title": "mmmremap.c: avoid pointless invalidate_range_start/end on mremap(old_size=0)",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-49077",
    "datePublished": "2025-02-26T01:54:39.739Z",
    "dateReserved": "2025-02-26T01:49:39.247Z",
    "dateUpdated": "2025-12-23T13:21:52.189Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.