CVE-2022-49444
Published: 26 February 2025
Summary
CVE-2022-49444 is a high-severity Out-of-bounds Read (CWE-125) vulnerability in Linux Linux Kernel. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 2.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 CM-11 (User-installed Software) and CM-14 (Signed Components).
Deeper analysis
CVE-2022-49444 is an out-of-bounds read vulnerability in the Linux kernel's module loading subsystem. It occurs when processing ELF modules with a section header string table index (e_shstrndx) where sh_size is set to 0, leading to an invalid access in the check `if (info->secstrings[strhdr->sh_size - 1] != '\0')`. This can trigger a page fault and kernel oops during module loading, as demonstrated by a crafted module loaded via insmod. The issue affects the load_module function and has a CVSS v3.1 base score of 7.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H), mapped to CWE-125.
A local attacker with low privileges can exploit this vulnerability by crafting and loading a malicious kernel module. The low attack complexity and lack of user interaction requirement make it straightforward to trigger. Successful exploitation results in high-impact availability disruption through a kernel crash (denial of service via oops) and potential high confidentiality impact by exposing kernel memory contents during the fault.
Mitigation involves applying the upstream kernel patches referenced in the stable repository, such as commits 09cb6663618a74fe5572a4931ecbf098832e79ec, 391e982bfa632b8315235d8be9c0a81374c6a19c, 45a76414b6d8b8b39c23fea53b9d20e831ae72a0, and 921630e2e5124a04158129a8f22f4b425e61a858, which have been rebased onto the modules-next branch to fix the OOB access. Security practitioners should ensure systems run patched kernel versions to prevent module loading from untrusted sources.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-54785
Vulnerability details
In the Linux kernel, the following vulnerability has been resolved: module: fix [e_shstrndx].sh_size=0 OOB access It is trivial to craft a module to trigger OOB access in this line: if (info->secstrings[strhdr->sh_size - 1] != '\0') { BUG: unable to handle…
more
page fault for address: ffffc90000aa0fff PGD 100000067 P4D 100000067 PUD 100066067 PMD 10436f067 PTE 0 Oops: 0000 [#1] PREEMPT SMP PTI CPU: 7 PID: 1215 Comm: insmod Not tainted 5.18.0-rc5-00007-g9bf578647087-dirty #10 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-4.fc34 04/01/2014 RIP: 0010:load_module+0x19b/0x2391 [rebased patch onto modules-next]
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Kernel OOB read in module loading directly enables crafted module load to trigger system crash (DoS via exploitation).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires timely identification, reporting, and remediation of the out-of-bounds read flaw in the kernel module loader through patching, directly eliminating the vulnerability.
Mandates digital signatures for kernel modules, preventing the loading of crafted unsigned ELF modules that trigger the OOB access during validation.
Blocks or controls user-installed kernel modules via insmod, stopping local low-privilege attackers from loading malicious modules exploiting the vulnerability.