{"id":"CVE-2022-48847","state":"PUBLISHED","title":"watch_queue: Fix filter limit check","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nwatch_queue: Fix filter limit check\n\nIn watch_queue_set_filter(), there are a couple of places where we check\nthat the filter type value does not exceed what the type_filter bitmap\ncan hold.  One place calculates the number of bits by:\n\n   if (tf[i].type >= sizeof(wfilter->type_filter) * 8)\n\nwhich is fine, but the second does:\n\n   if (tf[i].type >= sizeof(wfilter->type_filter) * BITS_PER_LONG)\n\nwhich is not.  This can lead to a couple of out-of-bounds writes due to\na too-large type:\n\n (1) __set_bit() on wfilter->type_filter\n (2) Writing more elements in wfilter->filters[] than we allocated.\n\nFix this by just using the proper WATCH_TYPE__NR instead, which is the\nnumber of types we actually know about.\n\nThe bug may cause an oops looking something like:\n\n  BUG: KASAN: slab-out-of-bounds in watch_queue_set_filter+0x659/0x740\n  Write of size 4 at addr ffff88800d2c66bc by task watch_queue_oob/611\n  ...\n  Call Trace:\n   <TASK>\n   dump_stack_lvl+0x45/0x59\n   print_address_description.constprop.0+0x1f/0x150\n   ...\n   kasan_report.cold+0x7f/0x11b\n   ...\n   watch_queue_set_filter+0x659/0x740\n   ...\n   __x64_sys_ioctl+0x127/0x190\n   do_syscall_64+0x43/0x90\n   entry_SYSCALL_64_after_hwframe+0x44/0xae\n\n  Allocated by task 611:\n   kasan_save_stack+0x1e/0x40\n   __kasan_kmalloc+0x81/0xa0\n   watch_queue_set_filter+0x23a/0x740\n   __x64_sys_ioctl+0x127/0x190\n   do_syscall_64+0x43/0x90\n   entry_SYSCALL_64_after_hwframe+0x44/0xae\n\n  The buggy address belongs to the object at ffff88800d2c66a0\n   which belongs to the cache kmalloc-32 of size 32\n  The buggy address is located 28 bytes inside of\n   32-byte region [ffff88800d2c66a0, ffff88800d2c66c0)","publishedAt":"2024-07-16T12:25:15.804Z","updatedAt":"2026-08-05T08:52:37.538Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"c73be61cede5882f9605a852414db559c0ebedfd","status":"affected","lessThan":"648895da69ced90ca770fd941c3d9479a9d72c16","versionType":"git"},{"version":"c73be61cede5882f9605a852414db559c0ebedfd","status":"affected","lessThan":"1b09f28f70a5046acd64138075ae3f095238b045","versionType":"git"},{"version":"c73be61cede5882f9605a852414db559c0ebedfd","status":"affected","lessThan":"b36588ebbcef74583824c08352e75838d6fb4ff2","versionType":"git"},{"version":"c73be61cede5882f9605a852414db559c0ebedfd","status":"affected","lessThan":"c993ee0f9f81caf5767a50d1faeba39a0dc82af2","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["include/linux/watch_queue.h","kernel/watch_queue.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.8","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.8","versionType":"semver"},{"version":"5.10.106","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.29","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"5.16.15","status":"unaffected","lessThanOrEqual":"5.16.*","versionType":"semver"},{"version":"5.17","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["include/linux/watch_queue.h","kernel/watch_queue.c"]}],"references":["https://git.kernel.org/stable/c/648895da69ced90ca770fd941c3d9479a9d72c16","https://git.kernel.org/stable/c/1b09f28f70a5046acd64138075ae3f095238b045","https://git.kernel.org/stable/c/b36588ebbcef74583824c08352e75838d6fb4ff2","https://git.kernel.org/stable/c/c993ee0f9f81caf5767a50d1faeba39a0dc82af2"],"weaknesses":[],"ingestedAt":"2026-10-29T20:05:26.763Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2022/48xxx/CVE-2022-48847.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2022-48847","state":"PUBLISHED","datePublished":"2024-07-16T12:25:15.804Z","dateUpdated":"2026-08-05T08:52:37.538Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2024-07-16T11:38:08.911Z"},"containers":{"cna":{"title":"watch_queue: Fix filter limit check","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwatch_queue: Fix filter limit check\n\nIn watch_queue_set_filter(), there are a couple of places where we check\nthat the filter type value does not exceed what the type_filter bitmap\ncan hold.  One place calculates the number of bits by:\n\n   if (tf[i].type >= sizeof(wfilter->type_filter) * 8)\n\nwhich is fine, but the second does:\n\n   if (tf[i].type >= sizeof(wfilter->type_filter) * BITS_PER_LONG)\n\nwhich is not.  This can lead to a couple of out-of-bounds writes due to\na too-large type:\n\n (1) __set_bit() on wfilter->type_filter\n (2) Writing more elements in wfilter->filters[] than we allocated.\n\nFix this by just using the proper WATCH_TYPE__NR instead, which is the\nnumber of types we actually know about.\n\nThe bug may cause an oops looking something like:\n\n  BUG: KASAN: slab-out-of-bounds in watch_queue_set_filter+0x659/0x740\n  Write of size 4 at addr ffff88800d2c66bc by task watch_queue_oob/611\n  ...\n  Call Trace:\n   <TASK>\n   dump_stack_lvl+0x45/0x59\n   print_address_description.constprop.0+0x1f/0x150\n   ...\n   kasan_report.cold+0x7f/0x11b\n   ...\n   watch_queue_set_filter+0x659/0x740\n   ...\n   __x64_sys_ioctl+0x127/0x190\n   do_syscall_64+0x43/0x90\n   entry_SYSCALL_64_after_hwframe+0x44/0xae\n\n  Allocated by task 611:\n   kasan_save_stack+0x1e/0x40\n   __kasan_kmalloc+0x81/0xa0\n   watch_queue_set_filter+0x23a/0x740\n   __x64_sys_ioctl+0x127/0x190\n   do_syscall_64+0x43/0x90\n   entry_SYSCALL_64_after_hwframe+0x44/0xae\n\n  The buggy address belongs to the object at ffff88800d2c66a0\n   which belongs to the cache kmalloc-32 of size 32\n  The buggy address is located 28 bytes inside of\n   32-byte region [ffff88800d2c66a0, ffff88800d2c66c0)"}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"c73be61cede5882f9605a852414db559c0ebedfd","status":"affected","lessThan":"648895da69ced90ca770fd941c3d9479a9d72c16","versionType":"git"},{"version":"c73be61cede5882f9605a852414db559c0ebedfd","status":"affected","lessThan":"1b09f28f70a5046acd64138075ae3f095238b045","versionType":"git"},{"version":"c73be61cede5882f9605a852414db559c0ebedfd","status":"affected","lessThan":"b36588ebbcef74583824c08352e75838d6fb4ff2","versionType":"git"},{"version":"c73be61cede5882f9605a852414db559c0ebedfd","status":"affected","lessThan":"c993ee0f9f81caf5767a50d1faeba39a0dc82af2","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["include/linux/watch_queue.h","kernel/watch_queue.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.8","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.8","versionType":"semver"},{"version":"5.10.106","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.29","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"5.16.15","status":"unaffected","lessThanOrEqual":"5.16.*","versionType":"semver"},{"version":"5.17","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["include/linux/watch_queue.h","kernel/watch_queue.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/648895da69ced90ca770fd941c3d9479a9d72c16"},{"url":"https://git.kernel.org/stable/c/1b09f28f70a5046acd64138075ae3f095238b045"},{"url":"https://git.kernel.org/stable/c/b36588ebbcef74583824c08352e75838d6fb4ff2"},{"url":"https://git.kernel.org/stable/c/c993ee0f9f81caf5767a50d1faeba39a0dc82af2"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached through local syscalls only: pipe2(O_NOTIFICATION_PIPE) followed by ioctl(IOC_WATCH_QUEUE_SET_FILTER) into pipe_ioctl → watch_queue_set_filter; there is no network or adjacent-protocol path.\nAC:L - An attacker fully controls the filter type and payload fields and can reliably trigger the mismatched bounds check (type in [128,1023] on 64-bit); CONFIG_WATCH_QUEUE is enabled on major distros such as Ubuntu and Fedora, and no victim-controlled conditions are required.\nPR:L - Creating a notification pipe and setting its filter require only an unprivileged local account; neither pipe2(O_NOTIFICATION_PIPE) nor IOC_WATCH_QUEUE_SET_FILTER performs capability or privilege checks.\nUI:N - Exploitation needs no victim action; the attacker issues the pipe2/ioctl sequence themselves.\nS:U - Impact stays within the host kernel authority (local privilege escalation via slab corruption); this is not a VM/IOMMU/sandbox boundary escape.\nC:H - The heap out-of-bounds write with attacker-controlled contents corrupts adjacent slab objects and has been demonstrated as a privilege-escalation primitive, enabling arbitrary kernel memory disclosure.\nI:H - Attacker-controlled OOB writes via filters[] and __set_bit provide a strong integrity primitive; a public exploit achieved root on Fedora 35 by corrupting adjacent kmalloc-32 objects.\nA:H - The same corruption causes kernel oopses (KASAN slab-out-of-bounds) and can panic or hang the system, as shown in the original report and exploit."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-05T08:52:37.538Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.8","versionEndExcluding":"5.10.106"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.8","versionEndExcluding":"5.15.29"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.8","versionEndExcluding":"5.16.15"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.8","versionEndExcluding":"5.17"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://git.kernel.org/stable/c/648895da69ced90ca770fd941c3d9479a9d72c16","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/1b09f28f70a5046acd64138075ae3f095238b045","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/b36588ebbcef74583824c08352e75838d6fb4ff2","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/c993ee0f9f81caf5767a50d1faeba39a0dc82af2","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-03T15:25:01.608Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2022-48847","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2024-09-10T16:56:35.105751Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-09-11T17:34:09.039Z"}}]}}}