CVE-2022-49077 (GCVE-0-2022-49077)

Vulnerability from cvelistv5 – Published: 2025-02-26 01:54 – Updated: 2025-12-23 13:21
VLAI?
Title
mmmremap.c: avoid pointless invalidate_range_start/end on mremap(old_size=0)
Summary
In the Linux kernel, the following vulnerability has been resolved: mmmremap.c: avoid pointless invalidate_range_start/end on mremap(old_size=0) If an mremap() syscall with old_size=0 ends up in move_page_tables(), it will call invalidate_range_start()/invalidate_range_end() unnecessarily, i.e. with an empty range. This causes a WARN in KVM's mmu_notifier. In the past, empty ranges have been diagnosed to be off-by-one bugs, hence the WARNing. Given the low (so far) number of unique reports, the benefits of detecting more buggy callers seem to outweigh the cost of having to fix cases such as this one, where userspace is doing something silly. In this particular case, an early return from move_page_tables() is enough to fix the issue.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 7b6efc2bc4f19952b25ebf9b236e5ac43cd386c2 , < a05540f3903bd8295e8c4cd90dd3d416239a115b (git)
Affected: 7b6efc2bc4f19952b25ebf9b236e5ac43cd386c2 , < eeaf28e2a0128147d687237e59d5407ee1b14693 (git)
Affected: 7b6efc2bc4f19952b25ebf9b236e5ac43cd386c2 , < e2c328c2a8f9de8b761bd4025b66c63120c55761 (git)
Affected: 7b6efc2bc4f19952b25ebf9b236e5ac43cd386c2 , < c19d8de4e682ec4b0ea2b04a832cd8cc0be3bb31 (git)
Affected: 7b6efc2bc4f19952b25ebf9b236e5ac43cd386c2 , < 7d659cb1763ff17d1c6ee082fa6feb4267c7a30b (git)
Affected: 7b6efc2bc4f19952b25ebf9b236e5ac43cd386c2 , < a04cb99c5d4668fe3f5c0e5b6da1cecd34c3f219 (git)
Affected: 7b6efc2bc4f19952b25ebf9b236e5ac43cd386c2 , < 2358aa84ef6dafcf544a557caaa6b91afb4a0bd2 (git)
Affected: 7b6efc2bc4f19952b25ebf9b236e5ac43cd386c2 , < 04bc13dae4a27b8d030843c85ae452bb2f1d9c1f (git)
Affected: 7b6efc2bc4f19952b25ebf9b236e5ac43cd386c2 , < 01e67e04c28170c47700c2c226d732bbfedb1ad0 (git)
Create a notification for this product.
    Linux Linux Affected: 3.2
Unaffected: 0 , < 3.2 (semver)
Unaffected: 4.9.311 , ≤ 4.9.* (semver)
Unaffected: 4.14.276 , ≤ 4.14.* (semver)
Unaffected: 4.19.238 , ≤ 4.19.* (semver)
Unaffected: 5.4.189 , ≤ 5.4.* (semver)
Unaffected: 5.10.111 , ≤ 5.10.* (semver)
Unaffected: 5.15.34 , ≤ 5.15.* (semver)
Unaffected: 5.16.20 , ≤ 5.16.* (semver)
Unaffected: 5.17.3 , ≤ 5.17.* (semver)
Unaffected: 5.18 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "mm/mremap.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a05540f3903bd8295e8c4cd90dd3d416239a115b",
              "status": "affected",
              "version": "7b6efc2bc4f19952b25ebf9b236e5ac43cd386c2",
              "versionType": "git"
            },
            {
              "lessThan": "eeaf28e2a0128147d687237e59d5407ee1b14693",
              "status": "affected",
              "version": "7b6efc2bc4f19952b25ebf9b236e5ac43cd386c2",
              "versionType": "git"
            },
            {
              "lessThan": "e2c328c2a8f9de8b761bd4025b66c63120c55761",
              "status": "affected",
              "version": "7b6efc2bc4f19952b25ebf9b236e5ac43cd386c2",
              "versionType": "git"
            },
            {
              "lessThan": "c19d8de4e682ec4b0ea2b04a832cd8cc0be3bb31",
              "status": "affected",
              "version": "7b6efc2bc4f19952b25ebf9b236e5ac43cd386c2",
              "versionType": "git"
            },
            {
              "lessThan": "7d659cb1763ff17d1c6ee082fa6feb4267c7a30b",
              "status": "affected",
              "version": "7b6efc2bc4f19952b25ebf9b236e5ac43cd386c2",
              "versionType": "git"
            },
            {
              "lessThan": "a04cb99c5d4668fe3f5c0e5b6da1cecd34c3f219",
              "status": "affected",
              "version": "7b6efc2bc4f19952b25ebf9b236e5ac43cd386c2",
              "versionType": "git"
            },
            {
              "lessThan": "2358aa84ef6dafcf544a557caaa6b91afb4a0bd2",
              "status": "affected",
              "version": "7b6efc2bc4f19952b25ebf9b236e5ac43cd386c2",
              "versionType": "git"
            },
            {
              "lessThan": "04bc13dae4a27b8d030843c85ae452bb2f1d9c1f",
              "status": "affected",
              "version": "7b6efc2bc4f19952b25ebf9b236e5ac43cd386c2",
              "versionType": "git"
            },
            {
              "lessThan": "01e67e04c28170c47700c2c226d732bbfedb1ad0",
              "status": "affected",
              "version": "7b6efc2bc4f19952b25ebf9b236e5ac43cd386c2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "mm/mremap.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.2"
            },
            {
              "lessThan": "3.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.9.*",
              "status": "unaffected",
              "version": "4.9.311",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.14.*",
              "status": "unaffected",
              "version": "4.14.276",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.238",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.189",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.111",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.34",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.16.*",
              "status": "unaffected",
              "version": "5.16.20",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.17.*",
              "status": "unaffected",
              "version": "5.17.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.9.311",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.14.276",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.238",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.189",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.111",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.34",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.16.20",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.17.3",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.18",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmmmremap.c: avoid pointless invalidate_range_start/end on mremap(old_size=0)\n\nIf an mremap() syscall with old_size=0 ends up in move_page_tables(), it\nwill call invalidate_range_start()/invalidate_range_end() unnecessarily,\ni.e.  with an empty range.\n\nThis causes a WARN in KVM\u0027s mmu_notifier.  In the past, empty ranges\nhave been diagnosed to be off-by-one bugs, hence the WARNing.  Given the\nlow (so far) number of unique reports, the benefits of detecting more\nbuggy callers seem to outweigh the cost of having to fix cases such as\nthis one, where userspace is doing something silly.  In this particular\ncase, an early return from move_page_tables() is enough to fix the\nissue."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-12-23T13:21:52.189Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a05540f3903bd8295e8c4cd90dd3d416239a115b"
        },
        {
          "url": "https://git.kernel.org/stable/c/eeaf28e2a0128147d687237e59d5407ee1b14693"
        },
        {
          "url": "https://git.kernel.org/stable/c/e2c328c2a8f9de8b761bd4025b66c63120c55761"
        },
        {
          "url": "https://git.kernel.org/stable/c/c19d8de4e682ec4b0ea2b04a832cd8cc0be3bb31"
        },
        {
          "url": "https://git.kernel.org/stable/c/7d659cb1763ff17d1c6ee082fa6feb4267c7a30b"
        },
        {
          "url": "https://git.kernel.org/stable/c/a04cb99c5d4668fe3f5c0e5b6da1cecd34c3f219"
        },
        {
          "url": "https://git.kernel.org/stable/c/2358aa84ef6dafcf544a557caaa6b91afb4a0bd2"
        },
        {
          "url": "https://git.kernel.org/stable/c/04bc13dae4a27b8d030843c85ae452bb2f1d9c1f"
        },
        {
          "url": "https://git.kernel.org/stable/c/01e67e04c28170c47700c2c226d732bbfedb1ad0"
        }
      ],
      "title": "mmmremap.c: avoid pointless invalidate_range_start/end on mremap(old_size=0)",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-49077",
    "datePublished": "2025-02-26T01:54:39.739Z",
    "dateReserved": "2025-02-26T01:49:39.247Z",
    "dateUpdated": "2025-12-23T13:21:52.189Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-49077\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-02-26T07:00:45.043\",\"lastModified\":\"2025-10-14T20:26:33.417\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmmmremap.c: avoid pointless invalidate_range_start/end on mremap(old_size=0)\\n\\nIf an mremap() syscall with old_size=0 ends up in move_page_tables(), it\\nwill call invalidate_range_start()/invalidate_range_end() unnecessarily,\\ni.e.  with an empty range.\\n\\nThis causes a WARN in KVM\u0027s mmu_notifier.  In the past, empty ranges\\nhave been diagnosed to be off-by-one bugs, hence the WARNing.  Given the\\nlow (so far) number of unique reports, the benefits of detecting more\\nbuggy callers seem to outweigh the cost of having to fix cases such as\\nthis one, where userspace is doing something silly.  In this particular\\ncase, an early return from move_page_tables() is enough to fix the\\nissue.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: mmmremap.c: evitar invalidate_range_start/end in\u00fatil en mremap(old_size=0) Si una llamada al sistema mremap() con old_size=0 termina en move_page_tables(), llamar\u00e1 a invalidate_range_start()/invalidate_range_end() innecesariamente, es decir, con un rango vac\u00edo. Esto provoca una ADVERTENCIA en mmu_notifier de KVM. En el pasado, se ha diagnosticado que los rangos vac\u00edos eran errores con un desfase de uno, de ah\u00ed la ADVERTENCIA. Dado el bajo n\u00famero (hasta ahora) de informes \u00fanicos, los beneficios de detectar m\u00e1s llamadores con errores parecen superar el costo de tener que arreglar casos como este, donde el espacio de usuario est\u00e1 haciendo algo tonto. En este caso particular, un retorno temprano de move_page_tables() es suficiente para solucionar el problema.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-193\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"4.9.311\",\"matchCriteriaId\":\"C86EFD13-93D4-4385-83E8-C665BE8F570F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.10\",\"versionEndExcluding\":\"4.14.276\",\"matchCriteriaId\":\"6D9B028C-6313-47F9-94B7-5F8122345E49\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.15\",\"versionEndExcluding\":\"4.19.238\",\"matchCriteriaId\":\"FA28527A-11D3-41D2-9C4C-ECAC0D6A4A2D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.20\",\"versionEndExcluding\":\"5.4.189\",\"matchCriteriaId\":\"8CB6E8F5-C2B1-46F3-A807-0F6104AC340F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.111\",\"matchCriteriaId\":\"96258501-7BCE-4C55-8A38-8AC9D327626D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.34\",\"matchCriteriaId\":\"D25878D3-7761-4E9F-8919-E92CD53896E0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"5.16.20\",\"matchCriteriaId\":\"ABBBA66E-0244-4621-966B-9790AF1EEB00\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.17\",\"versionEndExcluding\":\"5.17.3\",\"matchCriteriaId\":\"AE420AC7-1E59-4398-B84F-71F4B4337762\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.18:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"6AD94161-84BB-42E6-9882-4FC0C42E9FC1\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/01e67e04c28170c47700c2c226d732bbfedb1ad0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/04bc13dae4a27b8d030843c85ae452bb2f1d9c1f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/2358aa84ef6dafcf544a557caaa6b91afb4a0bd2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7d659cb1763ff17d1c6ee082fa6feb4267c7a30b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a04cb99c5d4668fe3f5c0e5b6da1cecd34c3f219\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a05540f3903bd8295e8c4cd90dd3d416239a115b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c19d8de4e682ec4b0ea2b04a832cd8cc0be3bb31\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e2c328c2a8f9de8b761bd4025b66c63120c55761\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/eeaf28e2a0128147d687237e59d5407ee1b14693\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.