{"id":"DEBIAN-CVE-2022-49771","details":"In the Linux kernel, the following vulnerability has been resolved:  dm ioctl: fix misbehavior if list_versions races with module loading  __list_versions will first estimate the required space using the \"dm_target_iterate(list_version_get_needed, &needed)\" call and then will fill the space using the \"dm_target_iterate(list_version_get_info, &iter_info)\" call. Each of these calls locks the targets using the \"down_read(&_lock)\" and \"up_read(&_lock)\" calls, however between the first and second \"dm_target_iterate\" there is no lock held and the target modules can be loaded at this point, so the second \"dm_target_iterate\" call may need more space than what was the first \"dm_target_iterate\" returned.  The code tries to handle this overflow (see the beginning of list_version_get_info), however this handling is incorrect.  The code sets \"param-\u003edata_size = param-\u003edata_start + needed\" and \"iter_info.end = (char *)vers+len\" - \"needed\" is the size returned by the first dm_target_iterate call; \"len\" is the size of the buffer allocated by userspace.  \"len\" may be greater than \"needed\"; in this case, the code will write up to \"len\" bytes into the buffer, however param-\u003edata_size is set to \"needed\", so it may write data past the param-\u003edata_size value. The ioctl interface copies only up to param-\u003edata_size into userspace, thus part of the result will be truncated.  Fix this bug by setting \"iter_info.end = (char *)vers + needed;\" - this guarantees that the second \"dm_target_iterate\" call will write only up to the \"needed\" buffer and it will exit with \"DM_BUFFER_FULL_FLAG\" if it overflows the \"needed\" space - in this case, userspace will allocate a larger buffer and retry.  Note that there is also a bug in list_version_get_needed - we need to add \"strlen(tt-\u003ename) + 1\" to the needed size, not \"strlen(tt-\u003ename)\".","modified":"2026-09-01T16:05:33.392649439Z","published":"2025-05-01T15:16:00.237Z","upstream":["CVE-2022-49771"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2022-49771"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:12","purl":"pkg:deb/debian/linux?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.10-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2022-49771.json"}},{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.10-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2022-49771.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.10-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2022-49771.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"}]}