{"id":"CVE-2022-48762","summary":"arm64: extable: fix load_unaligned_zeropad() reg indices","details":"In the Linux kernel, the following vulnerability has been resolved:\n\narm64: extable: fix load_unaligned_zeropad() reg indices\n\nIn ex_handler_load_unaligned_zeropad() we erroneously extract the data and\naddr register indices from ex-\u003etype rather than ex-\u003edata. As ex-\u003etype will\ncontain EX_TYPE_LOAD_UNALIGNED_ZEROPAD (i.e. 4):\n * We'll always treat X0 as the address register, since EX_DATA_REG_ADDR is\n   extracted from bits [9:5]. Thus, we may attempt to dereference an\n   arbitrary address as X0 may hold an arbitrary value.\n * We'll always treat X4 as the data register, since EX_DATA_REG_DATA is\n   extracted from bits [4:0]. Thus we will corrupt X4 and cause arbitrary\n   behaviour within load_unaligned_zeropad() and its caller.\n\nFix this by extracting both values from ex-\u003edata as originally intended.\n\nOn an MTE-enabled QEMU image we are hitting the following crash:\n Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000\n Call trace:\n  fixup_exception+0xc4/0x108\n  __do_kernel_fault+0x3c/0x268\n  do_tag_check_fault+0x3c/0x104\n  do_mem_abort+0x44/0xf4\n  el1_abort+0x40/0x64\n  el1h_64_sync_handler+0x60/0xa0\n  el1h_64_sync+0x7c/0x80\n  link_path_walk+0x150/0x344\n  path_openat+0xa0/0x7dc\n  do_filp_open+0xb8/0x168\n  do_sys_openat2+0x88/0x17c\n  __arm64_sys_openat+0x74/0xa0\n  invoke_syscall+0x48/0x148\n  el0_svc_common+0xb8/0xf8\n  do_el0_svc+0x28/0x88\n  el0_svc+0x24/0x84\n  el0t_64_sync_handler+0x88/0xec\n  el0t_64_sync+0x1b4/0x1b8\n Code: f8695a69 71007d1f 540000e0 927df12a (f940014a)","modified":"2026-08-12T03:51:16.195282668Z","published":"2024-06-20T11:13:39.855Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/48xxx/CVE-2022-48762.json","cna_assigner":"Linux"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/3758a6c74e08bdc15ccccd6872a6ad37d165239a"},{"type":"WEB","url":"https://git.kernel.org/stable/c/47fe7a1c5e3e011eeb4ab79f2d54a794fdd1c3eb"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/48xxx/CVE-2022-48762.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-48762"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"753b32368705c396000f95f33c3b7018474e33ad"},{"fixed":"47fe7a1c5e3e011eeb4ab79f2d54a794fdd1c3eb"},{"fixed":"3758a6c74e08bdc15ccccd6872a6ad37d165239a"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-48762.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.16.0"},{"fixed":"5.16.5"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-48762.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}