{
  "cveId": "CVE-2022-48847",
  "url": "https://patchblox.com/security/cve/CVE-2022-48847",
  "summary": "CVE-2022-48847 is fixed in linux on 1 platform, first by DEBIAN-CVE-2022-48847, released July 16, 2024. It is not reported as exploited. Patch Radar priority: High.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  watch_queue: Fix filter limit check  In watch_qu...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  watch_queue: Fix filter limit check  In watch_queue_set_filter(), there are a couple of places where we check that the filter type value does not exceed what the type_filter bitmap can hold.  One place calculates the number of bits by:     if (tf[i].type \u003E= sizeof(wfilter-\u003Etype_filter) * 8)  which is fine, but the second does:     if (tf[i].type \u003E= sizeof(wfilter-\u003Etype_filter) * BITS_PER_LONG)  which is not.  This can lead to a couple of out-of-bounds writes due to a too-large type:   (1) __set_bit() on wfilter-\u003Etype_filter  (2) Writing more elements in wfilter-\u003Efilters[] than we allocated.  Fix this by just using the proper WATCH_TYPE__NR instead, which is the number of types we actually know about.  The bug may cause an oops looking something like:    BUG: KASAN: slab-out-of-bounds in watch_queue_set_filter\u002B0x659/0x740   Write of size 4 at addr ffff88800d2c66bc by task watch_queue_oob/611   ...   Call Trace:    \u003CTASK\u003E    dump_stack_lvl\u002B0x45/0x59    print_address_description.constprop.0\u002B0x1f/0x150    ...    kasan_report.cold\u002B0x7f/0x11b    ...    watch_queue_set_filter\u002B0x659/0x740    ...    __x64_sys_ioctl\u002B0x127/0x190    do_syscall_64\u002B0x43/0x90    entry_SYSCALL_64_after_hwframe\u002B0x44/0xae    Allocated by task 611:    kasan_save_stack\u002B0x1e/0x40    __kasan_kmalloc\u002B0x81/0xa0    watch_queue_set_filter\u002B0x23a/0x740    __x64_sys_ioctl\u002B0x127/0x190    do_syscall_64\u002B0x43/0x90    entry_SYSCALL_64_after_hwframe\u002B0x44/0xae    The buggy address belongs to the object at ffff88800d2c66a0    which belongs to the cache kmalloc-32 of size 32   The buggy address is located 28 bytes inside of    32-byte region [ffff88800d2c66a0, ffff88800d2c66c0)",
  "published": "2024-07-16T13:15:11Z",
  "severity": "high",
  "cvss": 7.8,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "epss": 0.00241,
  "epssPercentile": 0.15263,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "5.16.18-1",
      "fix": "DEBIAN-CVE-2022-48847",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-48847",
      "released": "2024-07-16T13:15:11Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "5.16.18-1",
      "fix": "DEBIAN-CVE-2022-48847",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-48847",
      "released": "2024-07-16T13:15:11Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "5.16.18-1",
      "fix": "DEBIAN-CVE-2022-48847",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-48847",
      "released": "2024-07-16T13:15:11Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T00:53:09Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}