{"id":"CVE-2022-48847","summary":"watch_queue: Fix filter limit check","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nwatch_queue: Fix filter limit check\n\nIn watch_queue_set_filter(), there are a couple of places where we check\nthat the filter type value does not exceed what the type_filter bitmap\ncan hold.  One place calculates the number of bits by:\n\n   if (tf[i].type \u003e= sizeof(wfilter-\u003etype_filter) * 8)\n\nwhich is fine, but the second does:\n\n   if (tf[i].type \u003e= sizeof(wfilter-\u003etype_filter) * BITS_PER_LONG)\n\nwhich is not.  This can lead to a couple of out-of-bounds writes due to\na too-large type:\n\n (1) __set_bit() on wfilter-\u003etype_filter\n (2) Writing more elements in wfilter-\u003efilters[] than we allocated.\n\nFix this by just using the proper WATCH_TYPE__NR instead, which is the\nnumber of types we actually know about.\n\nThe bug may cause an oops looking something like:\n\n  BUG: KASAN: slab-out-of-bounds in watch_queue_set_filter+0x659/0x740\n  Write of size 4 at addr ffff88800d2c66bc by task watch_queue_oob/611\n  ...\n  Call Trace:\n   \u003cTASK\u003e\n   dump_stack_lvl+0x45/0x59\n   print_address_description.constprop.0+0x1f/0x150\n   ...\n   kasan_report.cold+0x7f/0x11b\n   ...\n   watch_queue_set_filter+0x659/0x740\n   ...\n   __x64_sys_ioctl+0x127/0x190\n   do_syscall_64+0x43/0x90\n   entry_SYSCALL_64_after_hwframe+0x44/0xae\n\n  Allocated by task 611:\n   kasan_save_stack+0x1e/0x40\n   __kasan_kmalloc+0x81/0xa0\n   watch_queue_set_filter+0x23a/0x740\n   __x64_sys_ioctl+0x127/0x190\n   do_syscall_64+0x43/0x90\n   entry_SYSCALL_64_after_hwframe+0x44/0xae\n\n  The buggy address belongs to the object at ffff88800d2c66a0\n   which belongs to the cache kmalloc-32 of size 32\n  The buggy address is located 28 bytes inside of\n   32-byte region [ffff88800d2c66a0, ffff88800d2c66c0)","modified":"2026-04-02T08:27:04.283207Z","published":"2024-07-16T12:25:15.804Z","related":["SUSE-SU-2024:2894-1","SUSE-SU-2024:2902-1","SUSE-SU-2024:2929-1","SUSE-SU-2024:2939-1","SUSE-SU-2024:2947-1"],"database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/48xxx/CVE-2022-48847.json"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/1b09f28f70a5046acd64138075ae3f095238b045"},{"type":"WEB","url":"https://git.kernel.org/stable/c/648895da69ced90ca770fd941c3d9479a9d72c16"},{"type":"WEB","url":"https://git.kernel.org/stable/c/b36588ebbcef74583824c08352e75838d6fb4ff2"},{"type":"WEB","url":"https://git.kernel.org/stable/c/c993ee0f9f81caf5767a50d1faeba39a0dc82af2"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/48xxx/CVE-2022-48847.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-48847"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"c73be61cede5882f9605a852414db559c0ebedfd"},{"fixed":"648895da69ced90ca770fd941c3d9479a9d72c16"},{"fixed":"1b09f28f70a5046acd64138075ae3f095238b045"},{"fixed":"b36588ebbcef74583824c08352e75838d6fb4ff2"},{"fixed":"c993ee0f9f81caf5767a50d1faeba39a0dc82af2"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-48847.json"}}],"schema_version":"1.7.5"}